System and method for providing and using a vlan-aware storage device

Abstract

The present invention provides secure IP protocol capable storage devices using Virtual Local Area Network (VLAN) techniques. Specific embodiments of the present invention provide techniques for securing VLAN aware storage devices, and the like. In specific embodiments, techniques according to the present invention can provide Internet data centers that are responsible for keeping their customer's computers and storages safe and secure with the capability to strictly separate LAN access for different customers using VLAN (virtual LAN) technology.

1 . A storage apparatus comprising:
 a network interface connectable to a local area network separated logically into a plurality of virtual local area networks, including a first virtual local area network and a second virtual local area network;   a storage system operable to provide storage resources for storing user data over the local area network to at least one network entity, the storage system separated logically into a plurality of virtual volumes, including a first virtual volume and a second virtual volume;   at least one file system, the at least one file system being used by a computer different from the storage system to store data in the storage system, each file system being managed by each of a plurality of file server modules;   a memory storing a configuration comprising a mapping of the plurality of virtual local area networks to the at least one file system and a mapping of the plurality of virtual volumes to the at least one file system; and   a controller operable to route information from a network entity associated with one of the plurality of virtual local area networks to the plurality of virtual volumes and prevent communication from a second network entity not associated with the plurality of virtual local area networks to the plurality of virtual volumes based upon the configuration.   
   
   
       2 . The apparatus of  claim 1 ,
 further comprising an out of band management interface connectable to a second network.   
   
   
       3 . The apparatus of  claim 1 ,
 wherein the network interface connectable to the virtual local area networks comprises an interface to a VLAN trunk line.   
   
   
       4 . The apparatus of  claim 3 ,
 wherein information carried by the VLAN trunk line is identified using an embedded tag.   
   
   
       5 . The apparatus of  claim 1 ,
 wherein the network interface connectable to the virtual local area networks comprises an interface to a VLAN switch, the VLAN switch connectable to at least one host computer via at least one VLAN access link.   
   
   
       6 . The apparatus of  claim 5 ,
 wherein information carried by the at least one VLAN access link comprises untagged frames.   
   
   
       7 . The apparatus of  claim 6 ,
 wherein information carried by the at least one VLAN access link is identified using a VLAN Identifier of a receiving port.   
   
   
       8 . The apparatus of  claim 6 ,
 wherein information carried by the at least one VLAN access link is identified using a Media Access Control (MAC) address.   
   
   
       9 . The apparatus of  claim 6 ,
 wherein an untagged frame comprises:   a preamble field;   a source MAC field;   a destination MAC field;   a type field;   a data field; and   a CRC field.   
   
   
       10 . The storage apparatus of  claim 1 , wherein the file system comprises a file. 
   
   
       11 . A method, comprising:
 separating logically a local area network into a plurality of virtual local area networks, including a first virtual local area network and a second virtual local area network;   separating logically a storage system operable to provide storage resources for storing user data over the local area network to at least one network entity into a plurality of virtual volumes, including a first virtual volume and a second virtual volume;   establishing at least one file system, the at least one file system being used by a computer different from the storage system to store data in the storage system, each file system being managed by each of a plurality of file server modules;   managing a configuration comprising a mapping of the plurality of virtual local area networks to the at least one file system and a mapping of the plurality of virtual volumes to the at least one file system; and   routing information from a network entity associated with one of the plurality of virtual local area networks to the plurality of virtual volumes and preventing communication from a second network entity not associated with the plurality of virtual local area networks to the plurality of virtual volumes based upon the configuration.   
   
   
       12 . The method of  claim 11 ,
 further comprising at least one of:   configuring network parameters;   configuring a new file system;   configuring a designated file system; and   deleting a designated file system.   
   
   
       13 . The method of  claim 11 ,
 further comprising at least one of:   updating a management interface IP address;   updating a physical network interface IP address;   updating a VLAN interface IP address and a VLAN tag;   deleting a designated VLAN interface; and   adding a new VLAN interface.   
   
   
       14 . The method of  claim 11 ,
 further comprising at least one of:   adding a VLAN to a file system;   removing a VLAN from the file system;   adding a volume to the file system; and   removing a volume from the file system.   
   
   
       15 . The method of  claim 11 ,
 further comprising:   authenticating user authority.   
   
   
       16 . The method of  claim 11 , wherein the file system comprises a file. 
   
   
       17 . A computer program product embodied in a computer-readable medium, comprising:
 code for separating logically a local area network into a plurality of virtual local area networks, including a first virtual local area network and a second virtual local area network;   code for separating logically a storage system operable to provide storage resources for storing user data over the local area network to at least one network entity into a plurality of virtual volumes, including a first virtual volume and a second virtual volume;   code for establishing at least one file system, the at least one file system being used by a computer different from the storage system to store data in the storage system, each file system being managed by each of a plurality of file server modules;   code for managing a configuration comprising a mapping of the plurality of virtual local area networks to the at least one file system and a mapping of the plurality of virtual volumes to the at least one file system; and   code for routing information from a network entity associated with one of the plurality of virtual local area networks to the plurality of virtual volumes and preventing communication from a second network entity not associated with the plurality of virtual local area networks to the plurality of virtual volumes based upon the configuration.   
   
   
       18 . The computer program product of  claim 17 ,
 further comprising at least one of:   code for receiving configuration information for the file system;   code for receiving configuration information for the virtual volume; and   code for receiving configuration information for a virtual local area network segment.   
   
   
       19 . The computer program product of  claim 18 ,
 further comprising at least one of:   code for updating configuration information for the file system;   code for updating configuration information for the virtual volume; and   code for updating configuration information for the virtual local area network segment.   
   
   
       20 . The computer program product of  claim 17 , wherein the file system comprises a file. 
   
   
       21 . A method, comprising:
 separating a virtual LAN into a plurality of segments;   managing a mapping of the plurality of segments to at least one file system, the at least one file system being used by a computer different from a storage system to store data in the storage system, each file system being managed by each of a plurality of file server modules, and mapping of a plurality of storage system operable to provide storage resources for storing user data over a network to at least one network entity to the file system;   assigning a plurality of virtual volumes to the file system and assigning a plurality of segments to the file system; and   controlling access to the plurality of virtual volumes, such that the plurality of virtual volumes will communicate only with the plurality of segments within the same file system.   
   
   
       22 . The method of  claim 21 , wherein the file system comprises a file. 
   
   
       23 . A storage system comprising:
 a network interface connectable to a virtual LAN separated into a plurality of segments;   at least one file system, the at least one file system being used by a computer different from the storage system to store data in the storage system, each file system being managed by each of a plurality of file server modules;   a plurality of storage systems operable to provide storage resources for storing user data over a network to at least one network entity using the file system; and   a processing module operable to:
 manage a mapping of the plurality of segments to the at least one file system and mapping of the plurality of storage systems to the file system; 
 assign a plurality of virtual volumes to the file system and assigning a plurality of segments to the file system; and 
 control access to the plurality of virtual volumes, such that the plurality of virtual volumes will communicate only with the plurality of segments within the same file system.