User roles controlling execution of operations on copy pair volumes

One or a plurality of copy pairs are disposed in a plurality of storage systems. A management server determines the propriety of execution of an operation request for each user for either a local copy pair or a remote copy pair. As operation requests, a pair create, a split, a resync, a restore, and a pair delete can be cited.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application relates to and claims priority from Japanese Patent Application No. 2009-244348 filed on Oct. 23, 2009, the entire disclosure of which is incorporated herein by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a computer system and a program recording medium.

2. Description of the Related Art

To preserve the data that a host computer uses, a technique for preparing a copy pair from a primary volume and a secondary volume, and regularly or irregularly copying data from the primary volume to the secondary volume is known. A local copy and a remote copy are known as copies between the primary volume and the secondary volume.

A local copy is executed between a primary volume and a secondary volume inside the same storage system. A remote copy refers to the copying of data from one storage system to another storage system.

A technique that makes it possible to control the remote copy operation for each copy group by issuing an instruction from a management apparatus to the storage system in accordance with a user operation is known (JP-A-2005-332354).

In the prior art, in a case where a copy pair is managed by a plurality of users, it is not possible to control the copy pair operational authority of each user. For example, there are cases in which a single copy pair is managed by a plurality of users with respectively different roles in the computer system, such as the user who is responsible for the entire system, the user who has responsibility for the copy pair, and the user who has responsibility for the service level of the application program.

In accordance with this, it is preferable that this copy pair be capable of being operated in accordance with the role of each user. However, the prior art does not include an aspect for managing the operation of a single copy pair by each of the users, making for poor usability.

SUMMARY OF THE INVENTION

Accordingly, an object of the present invention is to provide a computer system and a program recording medium that makes it possible to control the operation of the copy pair for each user. Another object of the present invention is to provide a computer system and a program recording medium, which, in a case where a plurality of users with respectively different roles are managing a single copy pair, makes it possible to control the propriety of operations related to this copy pair in accordance with the role of each user. Yet other objects of the present invention should become clear from the descriptions of the embodiments explained hereinbelow.

To solve for the above-mentioned problems, a computer system according to a first aspect of the present invention comprises a storage system and a management system, the storage system comprises a copy-source volume which is the logical volume of the copy source, and a copy-destination volume which is the logical volume of the copy destination, and the management system comprises a communication interface circuit which communicates with the storage system via a communication line, a memory which stores a prescribed program for managing the storage system, and a microprocessor which reads the prescribed program from memory and executes this program. The microprocessor receives a user-inputted operation request having as the operation target a single copy pair comprising a copy-source volume and a copy-destination volume, makes a determination as to whether or not to permit the execution of the operation request for each user who has inputted an operation request, and in a case where the execution of an operation request is permitted, sends a request corresponding to the operation request to the storage system.

In a second aspect according to the first aspect, roles related to the operation of the copy pair are set beforehand for the respective users, and the microprocessor determines whether or not to permit the execution of the operation request on the basis of the roles of the respective users.

In a third aspect according to the second aspect, a management table for managing, in association with each other, a plurality of roles prepared beforehand in relation of an operation-targeted copy pair, one or a plurality of operation requests that are capable of being executed for each role, and a plurality of users is stored in the memory, and the microprocessor uses the management table to determine whether or not to permit the execution of an operation request based on the roles of the respective users.

In a fourth aspect according to the second aspect, a prescribed operation request for changing the content stored in the copy-source volume is included in the operation request, and the users include a user who is permitted to execute a prescribed operation request and a user who is prohibited from executing a prescribed operation request.

In a fifth aspect according to the fourth aspect, the roles comprise a first role that is able to execute all operation requests related to an operation-targeted copy pair, a second role that is able to execute, from among all the operation requests, a copy-pair create request, a copy-pair delete request, a split request, a resync request, and a restore request, a third role that is able to execute, from among all of the operation requests, the split request, the resync request, and the restore request, and a fourth role that is able to execute, from among all of the operation requests, the split request and the resync request.

In a sixth aspect according to the fourth aspect, a plurality of operation-targeted copy pairs are provided, and a role for a first copy pair of the plurality of copy pairs and a role for a second copy pair of the plurality of copy pairs can be set such that the role differs for each user.

In a seventh aspect according to the sixth aspect, a third copy pair is included among the operation-targeted copy pairs, the third copy pair is associated with one of the first copy pair and the second copy pair, and an operation request that is executed for the copy pair of one of the first copy pair and the second copy pair that is associated with the third copy pair, is also executed for the third copy pair.

In an eighth aspect according to the first aspect, a plurality of storage systems are provided, the copy-source volume is disposed in one storage system of the plurality of storage systems, and the copy-destination volume is disposed in the other storage system of the plurality of storage systems.

The present invention may also be perceived as either a computer system or a recording medium for a computer program. Furthermore, the present invention is not limited to the combination of aspects described above, and may comprise combinations other than these.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

The embodiments of the present invention will be explained below based on the drawings. In this embodiment, as will be explained below, in a case where a plurality of users with different scopes of responsibility (scopes of management) are managing a common copy pair, it is possible to set an executable operation request for each user.

FIG. 1shows an overview of an entire computer system according to this embodiment. The hardware configuration of the computer system will be described below usingFIG. 2. The computer system, for example, comprises a management server10, a first storage system20(1), a second storage system20(2), host computers (hereinafter, the hosts)30(1),30(2), and a client terminal40. In a case where it is not particularly necessary to make a distinction, the hosts (30(1),30(2) may be called the host30, and the storage systems20(1),20(2) may be called the storage system20.

The coupling configuration of the respective apparatuses will be explained. The management server10, the respective storage systems20(1),20(2) and the respective hosts30(1),30(2) are coupled via a first communication network CN10. The management server10, the respective hosts30(1),30(2) and the client terminal40are coupled via a second communication network CN20.

The first communication network CN10, for example, may be configured as a FC_SAN (Fibre Channel_Storage Area Network) or an IP_SAN (Internet Protocol_SAN). The second communication network CN20, which is the management communication network, for example, may be configured as a LAN (Local Area Network) or may be the Internet. Furthermore, the first communication network CN10and the second communication network CN20may be integrated, and configured to make a single communication network.

The management server10as a “management system”, for example, comprises a storage management program110, a user management table120, an operational authority management table130, a copy group management table140, and a log management table150. The storage management program110sends a request to the respective storage systems20(1),20(2) in accordance with an instruction from the client terminal40. In addition, the storage management program110manages the respective tables120through150. Each of tables120through150will be explained in detail below.

The first storage system20(1) and the second storage system20(2) may be disposed in the same site, or may be disposed in respectively different sites. Each of the storage systems20(1),20(2) correspond to a “storage system”. Furthermore, the storage system provides at the least a primary volume and a secondary volume, and as long as it is possible to realize either a local copy or a remote copy, which will be explained below, a single storage system20may be the storage system, or the storage system20(1) and the storage system20(2) ofFIG. 1may collectively form the storage system.

The first storage system20(1), for example, comprises a controller200(1), and a plurality of logical volumes260. One of the plurality of logical volumes260is a primary volume (PVOL) and the other one is a secondary volume (SVOL1).

The primary volume260(PVOL) stores data that is used by an application program310of the host30. The secondary volume260(SVOL1) stores data copied from the primary volume260(PVOL). A data copy between the primary volume260(PVOL) and the secondary volume260(SVOL1) may be called a local copy, and a copy pair in accordance with the two volumes may be called a local copy pair.

The controller200(1) reads and writes data from and to the primary volume260(PVOL) based on an I/O (Input/Output) request issued from the host30. In addition, the controller200(1) controls the operation of a local copy and a remote copy in accordance with an instruction from the management server10. The controller200(1) also collects the various states of the storage system20(1) and sends these states to the management server10. The various states, for example, include frequency and quantity of I/O requests, CPU load, memory consumption, and the presence or absence of a failure.

The second storage system20(2) comprises a controller200(2) and a plurality of volumes260the same as the first storage system20(1). One of the plurality of logical volumes260is an intermediate volume260(S/PVOL), and the other is a secondary volume260(SVOL2).

The intermediate volume260(S/PVOL) is located between the primary volume260(PVOL) and the secondary volume260(SVOL2), and performs the role of the secondary volume in a remote copy and the role of the primary volume in a local copy.

A remote copy pair is created using the primary volume260(PVOL), which is the copy source, and the intermediate volume260(S/PVOL), which is the copy destination. A local copy pair is created inside the second storage system20(2) using the intermediate volume260(S/PVOL), which is the copy source, and the secondary volume260(SVOL2), which is the copy destination.

Synchronous and asynchronous remote copy methods are known. In a synchronous remote copy, when data is written to the primary volume260(PVOL), this data is immediately transferred and written to the intermediate volume260(S/PVOL).

In an asynchronous remote copy, after data has been written to the primary volume260(PVOL), this data is transferred and written to the intermediate volume260(S/PVOL) at an arbitrary timing. Either one of the synchronous or asynchronous methods may be employed.

The controller200(2) controls processing related to the above-mentioned remote copy and local copy. In addition, the controller200(2) collects various states from inside the second storage system20(2) and sends these states to the management server10.

The host30, for example, is configured either as a so-called open system server computer or as a mainframe machine or other such computer. The host30comprises an application program310. A customer management program, a sales management program, a video delivery program, a text creation program, an image creation program and an electronic mail management program can be cited as examples of the application program310.

For example, the one host30(1) may be disposed at a local site together with the first storage system20(1), and the other host30(2) may be disposed at a remote site together with the second storage system20(2).

In addition, even in a case where either one of the sites has been suspended due to a failure, configuring the host30(1) and the host30(2) into a cluster makes it possible to use the application program310to provide information processing services at the other site.

The client terminal40is a computer terminal that utilizes the management server10. The respective users provide instructions to the management server10via the client terminal40. Furthermore, the client terminal40may also serve as the host30.

The hardware configuration will be explained by referring toFIG. 2. The management server10, for example, comprises a microprocessor11, a memory12, and communication interfaces13,14. Furthermore, in the drawing, the microprocessor is abbreviated as CPU (Central Processing Unit) and the interface is abbreviated as I/F.

The memory12, for example, is a storage device such as a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory device, or a hard disk drive. The memory12, for example, stores an operating system, a storage management program110, and the respective tables120through150. The microprocessor11executes the processing described hereinbelow by reading and executing the storage management program110stored in the memory12.

The one communication interface13is a circuit for communicating with the respective hosts30(1),30(2) and the client terminal40via the management communication network CN20. The microprocessor11collects information via the communication interface13and the communication network CN20, and, in addition, sends a prescribed instruction to the respective hosts30(1),30(2).

The other communication interface14is coupled to the respective storage systems20(1),20(2) and the respective hosts30(1),30(2) via the first communication network CN10.

Furthermore, the configuration may also do away with the client terminal40and provide a user interface in the management server10. For example, the user is able to use a display device and a keyboard coupled to the management server10to provide an instruction to the management server10.

The first storage system20(1) and the second storage system20(2) are configured substantially the same. Therefore, the configuration of the first storage system20(1) will be explained, and an explanation of the second storage system20(2) will be omitted.

The first storage system20(1) comprises a controller200(1) and either one or a plurality of logical volumes260. The logical volume260is created on the basis of either one or a plurality of storage devices. A hard disk drive, a semiconductor memory, an optical disk drive, a magneto-optical disk drive, a magnetic tape drive and various other such storage devices capable of reading and writing data can be cited as examples of the storage device.

In a case where a hard disk device is used, for example, it is possible to use a FC (Fibre Channel) disk, a SCSI (Small Computer System Interface) disk, a SATA disk, an ATA (AT Attachment) disk, a SAS (Serial Attached SCSI) disk and the like. Further, for example, a flash memory, a FeRAM (Ferroelectric Random Access Memory), a MRAM (Magnetoresistive Random Access Memory), an Ovonic Unified Memory, a RRAM (Resistance RAM), and a PRAM (Phase change RAM) can also be used as the storage device. In addition, for example, the configuration may also be such that different types of storage devices, like a flash memory device and a hard disk drive, are used together in a mixed fashion.

The physical storage areas of either one or a plurality of storage devices may be grouped together, and either one or a plurality of logical storage areas may be provided in this group of storage areas. This logical storage area is called the logical volume260.

The controller200(1), for example, comprises a front-end interface210(FEIF in the drawing), a back-end interface220(BEIF in the drawing), a microprocessor230(MP in the drawing), a cache memory240(CM in the drawing) and a switching circuit250(SW in the drawing). Furthermore, the controller200(1) is also able to couple to the management server10via a service processor (abbreviated as SVP) not shown in the drawing.

The front-end interface210is a communication control circuit for communicating with the hosts30(1),30(2), the management server10, and the second storage system20(2) by way of the first communication network CN10. The back-end interface220is a communication control circuit for communicating with the respective storage devices configuring the logical volume260.

The microprocessor230is for reading and executing a program stored in either the cache memory240or a prescribed logical volume260. The cache memory240stores received data and a program. The switching circuit250couples the cache memory240to the microprocessor230and the respective communication interfaces210,220. Furthermore, the program and information of the various control tables do not necessarily have to be stored in the cache memory, and may be stored in a different memory. Furthermore, there may be a plurality of front-end interfaces210, back-end interfaces220, microprocessors230, cache memories240and switching circuits250configuring the controller200. In addition, the controller200need not be a single circuit board, but rather may be a plurality of circuit boards, or a set of a plurality of devices, such as a virtual device.

Each of the hosts30(1),30(2) comprises a microprocessor31, a memory32, and communication interfaces33,34. The memory32, for example, stores an operating system and an application program310. The microprocessor31reads and executes the application program310stored in the memory35.

The one communication interface33is a circuit for communicating with the respective storage systems20(1),20(2). The other communication interface34is a circuit for communicating with the management server10.

The client terminal40comprises a microprocessor41, a memory42, a communication interface43, and a user interface44. The memory42, for example, stores a program, such as a web browser, for providing an instruction to the management server10. The communication interface43is a circuit for communicating with the management server10. The user interface44comprises a device for outputting information from the management server10, and a device for inputting information to the management server10. Either a display device or a voice output device can be cited as an example of the information output device. A keyboard, pointing device, microphone or the like can be cited as an example of the information input device.

Examples of the configurations of the information used in this embodiment will be explained based onFIGS. 3 through 6. In this embodiment, for example, the various information is explained using expressions such as “XX table”, “XX database”, “XX list”, and “XX queue”. However, the various information used in this embodiment does not always have to be data structures like a table, database, list or queue, and structures other than these may be used. That is, the various information used in this embodiment is not dependent on a specific data structure. Furthermore, various expressions, such as “identification information”, “identifier”, “ID” and “name”, for example, may be utilized when explaining the various information used in this embodiment, but these various expressions are interchangeable.

FIG. 3shows a user management table120. The user management table120is for managing a plurality of users. The respective users manage the copy pair, which is the operation-targeted resource inside the computer system, in accordance with respective roles.

The user management table120, for example, manages a user ID121, a password122(PW in the drawing), an administrator authority123, and a role124.

The user ID121is identification information for identifying the plurality of users who manage the computer system. The password122is information for authentication use that the user utilizes to log in to the management screen of the management server10. The administrator authority123shows the authority that makes it possible to set a role for another user. A user for whom “1” is set in the administrator authority123is provided administrator authority, and is able to set the role of another user. A user for whom “0” is set in the administrator authority123is not provided administrator authority, and is not able to set the role of another user.

In this embodiment, only the user who is set as the storage administrator, which is the highest level role, is able to set the role of another user. A log of the roles set for other users by the user who is the storage administrator is recorded in a log management table150.

The configuration may also be such that it is possible to change the role of a user who has a role that is lower than one's own role. For example, the configuration may be such that the storage administrator is able to set the roles of the copy pair administrator, the application administrator, and the application operator, the copy pair administrator is able to set the roles of the application administrator and the application operator, the application administrator is only able to set the role of the application operator, and the application operator is not able to set a role.

The role124denotes the range of management responsibility related to an operation-targeted copy pair (or a consistency group). The respective roles will be explained. The authority possessed by each role will be explained in detail below usingFIG. 4.

(1) Storage Administrator

As a “first role”, the storage administrator is the highest level administrator, having authority for the management of the entire storage system20. For example, the storage administrator has authority related to volume resource management, the management of various types of configurations, and various operations. More specifically, the storage administrator is able to create a plurality of logical volumes in the storage system20, and is able to decide how many logical volumes, from among the plurality of logical volumes, can be used for copy pairs. The storage administrator is able to transfer a portion of his authority to a lower-level administrator (user) than himself. The storage administrator is also able to concurrently serve as the below-described lower-level administrators.

(2) Copy Pair Administrator

As a “second role”, the copy pair administrator has authority related to the management and operation of the replication configuration of the storage system20. The authority designated as copy pair administrator is transferred from the storage administrator. The copy pair administrator is able to create a copy pair by selecting a primary volume and a secondary volume from among volumes prepared beforehand for copy pair creation.

(3) Application Administrator

As a “third role”, the application administrator has responsibility for the service level and data preservation of the application program310. The application administrator has authority for carrying out a backup and a restore with respect to a volume that is used by the management-targeted application program310. The application administrator is able to carry out operations for a backup and a restore within the range of the application configuration (the copy pair configuration) defined by the copy pair administrator.

(4) Application Operator

As a “fourth role”, the application operator has authority for carrying out the maintenance (for example, version upgrades, batch processing, and so forth) that repeatedly occurs in relation to the management-targeted application program310. The authority of the application operator is transferred from the application administrator. The application operator is able to acquire the backup of a volume being used by the application program310. However, the application operator is not permitted to perform a restore operation to a volume that is being used by the application program310.

In this embodiment, the above-mentioned four roles are given as examples of user roles. But the present invention is not limited to these four roles, and the configuration may also be such as to enable the setting of a new role. For example, the configuration may be such that a role of backup administrator, who is charged solely with backup management, may be newly set, and provided with the same authority as the application operator. Also, in the above explanation, it is assumed that, from the viewpoint of the storage administrator, the application operator is a lower-level administrator than the application administrator, the application administrator is a lower-level administrator than the copy pair administrator, and the copy pair administrator is a lower-level administrator than the storage administrator. However, another example of the higher-level/lower-level relationship may be used. For example, in a case where the management server10also manages the application program310, the application administrator may be able to execute a management operation the execution of which would otherwise be prohibited by the storage administrator. Further, the copy pair administrator, application administrator and application operator may not be subject to a higher-level/lower-level relationship, and may all be ranked as administrators who are at a lower level than the storage administrator.

FIG. 4shows an operational authority management table130. The operational authority management table130manages the operational authority of each role with respect to the operation-targeted copy pair. The operational authority management table130, together with the user management table120, is an example of “a management table for correspondingly managing a plurality of roles prepared beforehand for an operation-targeted copy pair, either one or a plurality of operation requests executable by each role, and a plurality of users”.

The operational authority management table130, for example, manages a role131, a storage setting132, a replication definition133, and a replication operation134. The role131is the same as the role124described usingFIG. 3.

The storage setting132denotes the authority for enabling the creation of a logical volume260for copy pair use inside the storage system20. A role for which “enabled” is set in the storage setting132is able to create a copy pair logical volume260inside the storage system20.

The replication definition133denotes the authority that enables a copy pair to be defined. The replication definition133comprises create1331and delete1332.

The create1331denotes the authority that enables the creation of a copy pair. Using the authority of the storage setting132, it is possible to create a copy pair by selecting a primary volume and a secondary volume from among the logical volumes260prepared beforehand, and, in addition, carrying out an initial copy from the primary volume to the secondary volume. The delete1332denotes the authority that enables a copy pair to be deleted. When deleting a copy pair, the respective volumes that formed this copy pair return to normal volumes and are held inside a volume pool for replication use.

The replication operation134denotes the authority that enables a copy pair to be operated. The replication operation134comprises a split1341, a resync1342, and a restore1343.

The split1341is an operation for suspending a data copy from the primary volume to the secondary volume, or a data copy from the secondary volume to the primary volume. When the host30updates the data of the copy-source volume (either the primary volume or the secondary volume) subsequent to a split, difference data is generated between the copy-destination volume (either the secondary volume or the primary volume) and the copy-source volume. Furthermore, in a case where the format for implementing a replication is one that provides a virtual secondary volume in accordance with the Copy-On-Write method, a data copy is not carried out prior to a split. However, the fact that the split operation is one that denotes the creation of data at a certain point in time of the primary volume in the secondary volume is shared in common.

The resync1342is an operation for making the data stored in the secondary volume match the data stored in the primary volume by copying the difference data from the primary volume to the secondary volume. Furthermore, the resync operation need not exist in a case where the format for implementing the replication is Copy-On-Write.

The restore1343is an operation for making the data stored in the primary volume match the data stored in the secondary volume by copying the difference data from the secondary volume to the primary volume. Taking into account the fact that there may also be cases in which the format for implementing the replication is Copy-On-Write, the restore operation may also return the primary volume data to the data of the primary volume at the certain point in time at which the secondary volume either virtually or actually stored this data.

In a case where data is backed up, a split1341is carried out after performing a resync1342. In a case where a volume is to be restored using backup data, a split1341is executed after carrying out the restore1343. Furthermore, the split may be omitted in the restoration of a volume.

The operation request permitted for each role131will be explained. The storage administrator, which is the highest level role, is permitted to execute all operation requests. The copy pair administrator, which is the second role, is permitted to execute the respective operation requests133,134other than the storage setting132. The application administrator, which is the third role, is permitted to execute only the replication operation134, and is not permitted to execute the storage setting132and the replication definition133. The application operator, which is the lowest level role, is only permitted to execute the replication operations134split1341and resync1342, and is not permitted to execute restore1343.

The application operator is able to arbitrarily acquire a backup of a primary volume that is associated with the application program310. However, the application operator is not permitted to use the backup data to restore the storage contents of the primary volume to the storage contents of a prescribed point in time, that is, the application operator is not permitted to execute a restore1343.

In the case of a resync (backup), it is possible to carry out a resynch independently of the execution status of the application program310, and, in addition, even when the resync operation generates an error, the affects of this operation on the application program310are minimal. This is because the storage contents of the primary volume are accurately maintained.

By contrast, in the case of a restore, the execution status of the application program310must be taken into account during execution. Because the application program310uses the primary volume to carry out prescribed information processing, a case in which the storage contents of the primary volume are suddenly changed to backup data will have a big impact on the application program310. In addition, in a case where the storage contents of the primary volume are destroyed as the result of an operational error, it is highly likely that the application program310will become unable to execute the prescribed information processing correctly. Accordingly, in this embodiment, the application operator is only permitted the authority to execute a resync operation and a split operation, and is not granted authority for a restore operation.

FIG. 5shows a copy group management table140. The copy group management table140manages a copy pair as an operation-targeted resource. As will be explained below, it is also possible to create a single group from a plurality of copy pairs that are associated with one another. This is called a consistency group.

Specifically, the copy group is a grouping of a plurality of copy pairs, and is used for efficiently carrying out a batch operation. Various types of operations are carried out in copy pair units. By contrast, the consistency group is an attribute given to a copy group, and the consistency group is able to apply an operation with respect to a specific copy pair to the entire group.

That is, the consistency group is also a copy group, and guarantees that each of a plurality of copy pairs inside the group is able to be split so as to satisfy the consistency, which will be explained below, for the secondary volumes of the plurality copy pairs inside the group.

(1) In a case where the host writes the first data A and then the next data B to the primary volume in order, the host writes the data B to the primary volume after waiting until a data A write-complete has arrived from the storage system.

(2) For a write that satisfies the conditions of (1), subsequent to a split, either all or a part of the data of data B is stored in the secondary volume only in a case where all of data A is stored in the secondary volume.

Furthermore, an item explained with respect to the “copy group” in the following explanation will also be applicable to the consistency group.

The copy group management table140, for example, manages a group ID141, primary volume information142, secondary volume information143, and a status144. Furthermore, although not disclosed inFIG. 4, the copy group management table140also manages the identifier of a copy pair identified by the primary volume information142and the secondary volume information143. The group ID141is information for identifying the copy group to which respective copy pairs belong.

The primary volume information142is for identifying a primary volume that configures a copy pair. The primary volume information142, for example, comprises information1421for identifying a logical volume260, and information1422for identifying a storage system20. Similarly, the secondary volume information143is for identifying a secondary volume that configures a copy pair. The secondary volume information143, for example, comprises information1431for identifying a logical volume260, and information1432for identifying a storage system20.

The status144denotes the status of a copy pair. The copy pair status may include “pair”, “suspend”, “copying (PVOL→SVOL)” and “copying (SVOL→PVOL)”. “Pair” denotes the status in which primary volume storage contents and the secondary volume storage contents are synchronized. “Suspend” denotes either a status in which the synchronization of the primary volume and the secondary volume has been canceled, or a status in which the primary volume data of a prescribed point in time has been stored in the secondary volume. “Copying (PVOL→SVOL)” denotes the state in which data is being copied from the primary volume to the secondary volume. “Copying (SVOL→PVOL)” denotes the state in which data is being copied from the secondary volume to the primary volume.

FIG. 6shows a log management table150. The log management table150manages a log of the role changes of the respective users. The log management table150, for example, manages a date/time151, an execution user152, a target user153, and an operational content154.

The date/time151denotes the date and time at which a role was set (or changed. The same holds true below). The execution user152is information for identifying the user who set the role for the target user153. In this embodiment, only the storage administrator is able to set the role for another user. The target user153is information for identifying the user for which a role has been set. The operational content154denotes information such as the role that has been set for the target user. The operational content154, for example, may include information that identifies the name of the role that has been set and the operation-targeted resource (copy pair).

The role setting process will be explained by referring toFIG. 7. The various processes described hereinbelow are realized in accordance with the microprocessor11of the management server10reading and executing the storage management program110. For convenience sake, the management server10will be used as the subject of the action in the following explanation. Furthermore, the same holds true for items other than those inFIG. 7explained using the management server10in that the processing is realized by the microprocessor11reading and executing the storage management program110.

As described usingFIG. 3, the specific user who has administrator authority123is able to set the role for another user. The user for which the role of storage administrator has been set (simply called the storage administrator) accesses the management server10via the client terminal40and inputs a password and a user ID into the management server10.

The management server10performs user authentication by determining whether or not the user ID and password are registered in the user management table120(S10). The management server10determines whether or not the user desiring to log in has administrator authority.

When user authentication is successful, the management server10sends a user management screen500to the client terminal40, and displays this screen on the client terminal40(S11). The user having administrator authority uses the user management screen500to set the roles for the other users. The management server10receives the operational input from the user (S12), and determines the propriety thereof (S13).

That is, the management server10determines whether or not the role settings for the other users being inputted by the user having administrator authority are permissible (S13). For example, as in another example that will be explained hereinbelow, in a case where it is possible to set a role for each copy pair, the management server10is able to determine whether or not it is possible to set a specified role for a specified user with respect to a specified copy pair.

Or, in the case of a configuration in which the changing of a role set for a user is prohibited beforehand, it is possible to make a determination in S13with respect to setting this prohibited role for a user.

Or, the configuration may be such that S13is discarded. For example, in a case where it is possible to confirm in S10that the user wishing to log in has administrator authority related to the identified copy pair (or consistency group), it is possible to discard the error processing of S13and S15.

A case in which the management server10determines the propriety of the user management table120prior to updating the user management table120will be explained (S13). In a case where updating of the user management table120is permitted (S13: YES), the management server10updates the user management table120(S14). In a case where updating of the user management table120is not permitted (S13: NO), the management server10performs error processing (S15). In the error processing, for example, an error message, such as “This role setting is prohibited. Please make sure you set the correct role.” is displayed on the client terminal40.

Furthermore, it is also possible to configure the user management screen500such that a user who has logged in to the user management screen500is only able to perform an operation for which he has permission. The configuration is such that items that the user is not able to operate are either not displayed on the user management screen500, or are displayed dimly but are not able to be operated. The above-mentioned screen configuration method may also be carried out the same way for another management screen that will be explained below.

FIG. 8shows the user management screen500. The user management screen500, for example, comprises a user ID display part501and a role setting part502. The user ID display part501is an area for displaying the IDs of the respective users who manage the computer system.

The role setting part502is an area for displaying the names of the roles that have been set for the respective users. The role setting part502, for example, may comprise a so-called pull-down menu503. The user having administrator authority selects one desired role from the pull-down menu503.

An operational authority setting process will be explained by referring toFIG. 9. In the operational authority setting process, it is possible to set operations that are able to be executed by the respective roles as described below.

The management server10performs authentication for a user desiring to log in to the operational authority management screen510(S20). Furthermore, user authentication is the same as all or part of the processing/screen explained usingFIG. 7andFIG. 8. When user authentication is successful, the management server10sends and displays the operational authority management screen510shown inFIG. 10on the client terminal40(S21). The configuration of the operational authority management screen510will be explained below.

The management server10receives operational input from the user (S22), and determines whether or not to permit this operation (to change the operational authority) (S23). In a case where the change of operational authority is permitted (S23: YES), the management server10updates the operational authority management table130(S24). In a case where the change of operational authority is not permitted (S23: NO), the management server10performs error processing (S25). In the error processing, for example, an error message, such as “This change is prohibited.” is sent on the client terminal40and displayed. Furthermore, as described hereinabove, the configuration can be such that an item that the user is not able to change will either not be displayed on the screen510, or will be displayed but will be not operable.

FIG. 10shows the operational authority management screen510. The operational authority management screen510, for example, comprises a role display part511, storage setting display part512, a replication definition display part513, and a replication operation display part514.

The role display part511is an area for displaying the names of the respective roles. The storage setting display part512is an area for displaying the presence or absence of authority for enabling a storage setting to be carried out. The replication definition display part513is an area for displaying a request related to a replication definition. The replication operation display part514is an area for displaying a request related to a replication operation.

The replication definition display part513comprises a create request display part5131and a delete request display part5132. The replication operation display part514comprises a split request display part5141, a resync request display part5142, and a restore request display part5143.

The user who wants to change the operational authority selects the desired request of the desired role (512,5131,5132,5141through5143), and sets either “enabled” or “disabled”.

In this embodiment, the operation request that is possible for each role is set beforehand, and a case where these roles are fixed such that the user is not able to change them will be explained. However, as described usingFIGS. 9 and 10, for example, the configuration may be such that the user having administrator authority is able to change the operation requests permitted for each role. In accordance with this, the user having administrator authority is also able to add a new operation request.

A sequence of processes related to a copy pair will be explained by referring toFIGS. 11 through 14.FIG. 11is a flowchart showing the definition of a copy pair and the creation of a pair. The storage administrator logs in to the management server10and performs a storage setting (S30). That is, the storage administrator creates a plurality of primary volumes and a plurality of secondary volumes, and registers these volumes in the volume pool.

The management server10uses the operational authority management table130to determine whether or not the storage administrator has the authority to carry out a storage setting (S31). The processing for determining the presence or absence of this authority will be explained in detail usingFIG. 14. When the operational authority of the storage administrator is confirmed, the management server10implements the storage setting based on an instruction from the storage administrator (S32).

Next, the copy pair administrator logs in to the management server10, and instructs the management server10to form a pair (S40). The management server10carries out user authentication for the copy pair administrator and determines whether or not the copy pair administrator has the authority to issue a pair creation request (S41).

When the management server10confirms the operational authority of the copy pair administrator, the management server10instructs the storage system20to form a pair (S42). The storage system20updates a copy pair table that is stored in either the storage system memory or the cache memory in accordance with the pair creation request from the management server10(S43).

Furthermore, the copy pair table is information in which is registered a pair of identifiers of the primary volume and the secondary volume for which copying is to be performed via either a local copy or a remote copy.

In accordance with this, a copy pair is formed using a specified primary volume and a specified secondary volume. Next, the storage system20carries out an initial copy from the primary volume to the secondary volume in accordance with the copy pair table. The initial copy is processing for copying the data of the primary volume to the secondary volume to make the data stored in both volumes match.

The process for acquiring a backup will be explained by referring to the flowchart ofFIG. 12. The application operator logs in to the management server10, and instructs the management server10to acquire a backup (issues a resync request) (S50).

The management server10performs user authentication for the application operator and determines whether or not the application operator has backup acquisition authority (S51). The management server10, upon confirming the authority of the application operator, issues a resync request to the storage system20, and instructs the creation of a backup (S52).

The storage system20copies the data of the primary volume to the secondary volume in accordance with the resync request from the management server10(S53). Subsequent to completion of the above-described initial copy, the data stored in the primary volume and the data stored in the secondary volume match. Thereafter, when the copy pair is split and the host30updates the primary volume data, difference data is generated between the primary volume and the secondary volume. This difference data is managed inside the storage system20. Therefore, the storage system20copies the difference data from the primary volume to the secondary volume to make the data of the primary volume and the data of the secondary volume match. In accordance with this, a backup of a prescribed point in time of the primary volume is created. Thereafter, the storage system20splits the primary volume and the secondary volume, and resumes difference data management (S54). Furthermore, the authority determination of S51may be determined at a minimum for the split operation. This is an example of a case in which copy pair that has already undergone a resync is to be operated, or a case that is targeted at a Copy-On-Write copy, which does not require a resync. However, the authority determination of S51may be determined for the resync operation as well.

A restore process will be explained by referring to the flowchart ofFIG. 13. The application administrator logs in to the management server10and requests that the management server10execute a restore (S60). The management server10performs user authentication for the application administrator, and also determines whether or not the application administrator has restore execution authority (S61).

The management server10, upon confirming the authority of the application administrator, sends a restore request to the storage system20(S62). The storage system20copies the difference data generated between the secondary volume and the primary volume from the secondary volume to the primary volume in accordance with the restore request from the management server10(S63). More abstractly stated, S63is a step for changing the data stored in the primary volume to the data stored in the secondary volume.

In accordance with this, the storage contents of the primary volume match the storage contents of the secondary volume. Subsequent to completion of the difference data copy, the storage system20splits the primary volume and the secondary volume and moves these volumes to the suspend state. Furthermore, the authority determination of S61may be determined at the least for the restore operation, and the authority determination may also be determined for a resync operation.

The bottom part ofFIG. 13shows what happens in a case where the application operator attempts to carry out a restore operation. The application operator logs in to the management server10and requests that the management server10execute a restore (S70).

The management server10confirms the authority of the application operator (S71). As described above, in this embodiment, the authority to execute a restore is not given to the application operator.

Therefore, the management server10executes error processing without issuing a restore request (S72). In the error processing, for example, an error message, such as “You do not have restore authority”, is sent to and displayed on the client terminal40.

Furthermore, the user authentications ofFIGS. 11 through 13are either all or partially the same as the user authentications explained usingFIG. 7andFIG. 9.

In this process, a description of user authentication based on the user ID and password has been omitted. In addition, for the sake of explanation, the flowchart ofFIG. 14also comprises the step (S86) that is executed after determining the operational authority.

The management server10references the user management table120based on the user ID of the user who has logged in (S80), and identifies the role that has been set for the user (S81). The management server10references the operational authority management table130based on the role identified in S81(S82), and confirms the operation (operation request) permitted for the user (S83).

The management server10determines whether or not the user-requested operation is permitted for this user (S84). In a case where the user-requested operation is permitted (S84: YES), the management server10sends a request corresponding to the user-requested operation to the storage system20(S85).

The storage system20executes the processing related to the copy pair in accordance with the request received from the management server10, and replies to the management server10with this execution result. The management server10, upon receiving the execution result from the storage system20, sends this execution result to the client terminal40and displays same thereon (S86). Furthermore, as described hereinabove, because S86is executed subsequent to a determination as to the propriety of the operation having been made, this step may also be omitted from this process.

In a case where the user-requested operation is not permitted (S84: NO), the management server10executes error processing (S87). The management server10, for example, sends an error message to the client terminal40and displays this message thereon.

Configuring this example like this makes it possible to set and manage an executable operation for each user with respect to a single copy pair. Therefore, it is possible to enhance user usability, and to prevent in advance the occurrence of a failure due to a copy pair operational error, enabling system reliability to be improved.

In addition, in this embodiment, because the user management table120is stored in the management server10, the management server10is able to integratively manage the operational authority related to a copy pair even in a case where this copy pair is configured spanning a plurality of storage systems20.

For example, as shown inFIG. 1, even in a case where a remote copy is carried out between a logical volume260(PVOL) of the first storage system20(1) and a logical volume260(S/PVOL) of the second storage system20(2), the management server10is able to control the execution restrictions related to this remote copy pair.

In addition, in this embodiment, because the concept of a role is used for managing the operation requests permitted for each user, there is no need to individually set a propriety of execution for each operation request from each user. In this embodiment, the propriety of execution of an operation request is defined beforehand for each user (FIG. 4), and corresponds to the role of each user (FIG. 3). Therefore, the execution authority to be permitted for each user related to the operation of a copy pair is able to be set relatively easily.

A second embodiment will be explained by referring toFIGS. 15 through 17. Because this embodiment corresponds to a variation of the first embodiment, the explanation will focus on the points of difference with the first embodiment. In this embodiment, the copy pairs, which are the operation-targeted resources, are grouped together and associated with the respective users. That is, in this embodiment, it is possible to set the roles of the respective users for each of a plurality of copy groups.

FIG. 15shows the user management table120A. The user management table120A of this embodiment is the same as the user management table120shown inFIG. 3, and comprises a user ID121, a password122, an administrator authority123A, and a role124A. In addition, the user management table120A of this embodiment also comprises a group ID125A.

The group ID125A is information for identifying a copy group that comprises a plurality of copy pairs.

In this embodiment, it is possible to provide a plurality of copy groups, and it is also possible to associate each user with a plurality of copy groups. Accordingly, a plurality of groups IDs125A are associated with a single user ID121in the user management table120A.

In addition, in this embodiment, it is possible to set the respective roles of the users for each copy group. Accordingly, a plurality of roles124A and a plurality of administrator authorities123A are associated with a single user ID121in the user management table120A.

In the example shown inFIG. 15, a user (UID001) has storage administrator, which is a higher-level role, set for the one copy group (GID010), and has application operator, which is a lower-level role, set for the other copy group (GID020). As a further example, another user (UID004) has application operator set for the one copy group (GID010), and has storage administrator set for the other copy group (GID020).

FIG. 16is a flowchart of the role setting process. This process comprises the respective steps of S10through S15the same as the flowchart ofFIG. 7. However, in this process, it is possible to respectively set the role of each user for each copy group (S12A).

FIG. 17schematically shows the relationships of the respective users, the respective copy groups and the respective roles. A plurality of users UA through UD are displayed in the center ofFIG. 17. Each user is associated with a plurality of copy groups CGA, CGB.

The one copy group CGA is configured from one copy pair. By contrast, the other copy group CGB is configured from a plurality of copy pairs that are related to one another.

The respective users UA through UD have different roles for each copy group CGA, CGB. For example, the user UA has storage administrator set for the one copy group CGA, but has application operator set for the other copy group CGB.

Similarly, the user UB has copy pair administrator set for the one copy group CGA, but has application administrator set for the other copy group CGB. The user UC has application administrator set for the one copy group CGA, but has copy pair administrator set for the other copy group CGB. The user UD has application operator set for the one copy group CGA, but has storage administrator set for the other copy group CGB. Furthermore, inFIG. 17, the relationships between the copy group CGA, the users and the roles are represented using solid lines, and the relationships between the copy group CGB, the users and the roles are represented using dotted lines.

Configuring this example like this exhibits the same effects as the first example. In addition, in this embodiment, it is possible to set a user role for each of a plurality of copy groups. For this reason, in this embodiment, it is also possible to set a different role for each copy group for the same user, and it is also possible to set roles that are shared in common for the respective copy groups. For example, it is possible to make settings for the same user such that a restore of a local copy pair is permitted, but a restore of a remote copy pair is not permitted. Therefore, usability is enhanced even more than in the first example.

In a case where there is a large number of copy pairs, it is even easier to make a setting that targets a copy group. This is because the copy group is a single operation unit, thereby making it possible to change the roles allocated to a certain user for each copy group using fewer setting items. However, in the second example, a copy pair may be targeted instead of a copy group, and may be used concurrently in the case of a copy group.

Furthermore, in a case where the operable copy pair operation is fixed for each role, the present invention may be realized without using the operational authority management table130by embedding a determination in the storage management program110with an operable copy pair as a conditional branch.

Furthermore, the present invention is not limited to the above-described embodiment. A person with ordinary skill in the art, for example, will be able to make various additions and changes within the scope of the present invention so as to combine the above-mentioned examples as the occasion may demand.