Abstract:
The Switch includes a port configured to receive a command frame when installed in a switching Fabric. The frame identifies a source device and a destination device in the Switching Fabric, a command, and a read/write flag which indicates if the identified source intends to exercise read-only or write access to the destination device. The Switch also includes a processor coupled to the port. The processor is configured to trap the frame and prevent it from reaching the defined destination device in the switching Fabric if both the source and destination devices are in a read-only zone and the flag indicates that the source intends to write to the destination device. In this manner, read-only zones can be implemented in the Switching Fabric.

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention relates to storage area networks, and more particularly, to implementing read-only zones in Fibre Channel Fabrics. 
     2. Background of the Invention 
     With the increasing popularity of Internet commerce and network centric computing, businesses and other organizations are becoming more and more reliant on information. To handle all of this data, storage area networks or SANs have become very popular. A SAN typically includes a number of storage devices, a plurality of Hosts, and a number of Switches arranged in a Switching Fabric that connects the storage devices and the Hosts. 
     Most SANs rely on the Fibre Channel protocol for communication within the Fabric. For a detailed explanation of the Fibre Channel protocol and Fibre Channel Switching Fabrics and Services, see the Fibre Channel Framing and Signaling Standard, Rev 1.70, American National Standard of Accredited Standards Committee (NCITS), Feb. 8, 2002, and the Fibre Channel Switch Fabric-2, Rev. 5.4, NCITS, Jun. 26, 2001, and the Fibre Channel Generic Services-3, Rev. 7.01, NCITS, Nov. 28, 2000, all incorporated by reference herein for all purposes. 
     Fibre Channel based SANs are often organized into zones. Within each zone, Hosts can see and access only storage devices or other hosts belonging to that zone. This allows the coexistence on the same SAN of different computing environments. For example, it is possible to define on a SAN a Unix zone and a separate Windows zone. Unix servers in the Unix zone may access only storage or hosts devices within the Unix zone, and do not interfere with the other devices connected to the SAN. In the same manner, Windows servers belonging to the Windows zone may access storage or host devices only within the Windows zone, without interfering with the other devices connected to the SAN. The SAN administrator may define in a SAN multiple zones, as required or dictated by the computing and storage resources connected to it. The Switching Fabric allows communications only between devices belonging to the same zone, preventing a device of one zone from seeing or accessing a device of another zone. A host for example can access a storage device in another zone only if that storage device happens to also be in the same zone as the host. 
     Generally, all the host(s) in a zone have both read and write access to the storage devices in their zone. In certain situations, such as data-mining application, centralized database search operations, etc., it would be desirable to designate one or more zones in a SAN as read-only zones. In other words, each of the hosts in a read-only zone can read, but cannot write to, the storage devices in that zone. Read-only zones would be advantageous because the same storage medium can be accessed by multiple hosts while only a selected hosts can modify the storage. In the absence of read-only zones, a separate copy of the storage contents has to be created. 
     SUMMARY OF THE INVENTION 
     To achieve the foregoing, and in accordance with the purpose of the present invention, a Switch for implementing read-only zones in a Switching Fabric is disclosed. The Switch includes a port configured to receive a command frame when installed in a switching Fabric. The frame identifies a source device and a destination device in the Switching Fabric, a command, and a read/write flag which indicates if the identified source intends to exercise read-only or write access to the destination device. The Switch also includes a processor coupled to the port. The processor is configured to trap the frame and prevent it from reaching the defined destination device in the switching Fabric if both the source and destination devices are in a read-only zone and the flag indicates that the source intends to write to the destination device. In this manner, read-only zones can be implemented in the Switching Fabric. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is an exemplary Storage Area Network according to the present invention. 
         FIG. 2  is a block diagram of a Switch according to the present invention. 
         FIG. 3  is a Fibre Channel frame header according to the present invention. 
         FIG. 4  is a flow chart illustrating the method of the present invention according to one embodiment. 
     
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be obvious, however, to one skilled in the art, that the present invention may be practiced without some or all of these specific details. In other instances, well known process steps have not been described in detail in order not to unnecessarily obscure the present invention. 
     Referring to  FIG. 1 , an exemplary Storage Area network (SAN) according to the present invention is shown. The storage area network (SAN)  10  includes a Switching Fabric  12  that includes a plurality of Fibre Channel Switches SW 1  through SW 5 . Also included in the SAN  10  are a plurality of hosts H 1  through H 4  and a plurality of storage devices D 1  through D 4 . According to various embodiments of the invention, the hosts can be any type of host including but not limited to servers or personal computers running on the Unix, Windows or any other computing platform. Similarly, the storage devices D 1 -D 4  can be any type of storage device including but not limited to tape back-up systems, emulated tape back-up systems, CD-ROM storage arrays, or one or more disks such as a Redundant Array of Independent Disks (RAID). The Switches SW 1 -SW 5  can be any type of Fibre Channel Switch such as those commercially available from Cisco Systems of San Jose, Calif. or Andiamo Systems, the assignee of the present application. 
     As depicted in  FIG. 1 , the hosts H and storage devices D are arranged into three zones. The members of zone A include hosts H 1  and H 2  and storage disk D 1 . The members of zone B include host H 3  and storage devices D 2  and D 3 . The members of zone C include host H 4  and storage device D 4 . The individual zones are typically defined on the basis of the operating systems used, and so they can be either Unix zones, Windows zones, or some other type of computing platform zone, but they can be defined also on the basis of other requirements. Although not depicted, zones can also overlap with one another. It should be noted that the number and types of hosts H, storage devices D, and Switches SW, and their particular arrangement in the zones A, B and C as shown is merely illustrative. In no way should this example be construed as limiting the invention. 
     Referring to  FIG. 2 , a block diagram of the Switches SW 1 -SW 5  is shown. The Switch  20  includes a data plane  22  and a control plane  24 . In the data plane  22 , the Switch includes switching logic  26  connected between two sets of ports  28   a  and  28   b . The switching logic  26  is configured to route or internally switch traffic received on one port  28   a  to another port  28   b  and vice versa. The control plane  24  includes a generic or application-specific processor  30  for implementing all the switching Fibre Channel functionality and protocols such as those specified in the aforementioned NCITS documents, incorporated by reference herein. In various embodiments of the invention, the processor  30  may be implemented in a state machine, a micro-controller, hardware, firmware, programmable logic, or a combination thereof. 
     Referring  FIG. 3 , a simplified Fibre Channel frame header according to the present invention is shown. The simplified frame header  40  includes a source identifier field  42 , a destination identifier field  44 , a WRDATA field  46 , and a command field  48  for including the command defined by the frame. The source identifier field  42  and destination identifier field  44  identify the source and destination of the frame. It should be noted that the header  40  illustrated in the  FIG. 3  is a simplified frame used for illustrating the present invention. An actual frame would include all of the fields used with a standard Fibre Channel frame as described in the aforementioned NCITS documents. 
     The Fibre Channel standard requires that WRDATA field  46  be set in any and all Fibre Channel commands which have data frames associated with the command frame which are traveling in the same direction as the command frame. Accordingly, if a command frame is sent from a first end device H 1  (either a host or storage device) to a second end device H 2  (again, either a host or storage device) and there are associated data frames being sent from end devices H 1  to H 2 , then the WRDATA field  46  is set by the sending entity, in this case the end device H 1 . On the other hand, with a read command from end device H 1  to end device H 2 , there are no associated data frames in the H 1  to H 2  direction. Consequently, the end device H 1  will reset the WRDATA field  46 . The WRDATA flag is present only in the command frame. The flag is not present in the response frame. 
     Thus with all command frames that will alter or modify the data on an end device, the WRDATA field  46  is set (equal to 1). With command frames that will not modify or alter the data on an end device, it is cleared or reset (equal to 0). For example, a Format command is usually associated with data that specifies a defect list (i.e., a list of blocks to be hidden from the user after formatting) or initialization pattern (i.e., a pattern to write onto a disk during formatting). Consequently, the WRDATA field  46  is typically set for Format commands and other SCSI commands (e.g., WRITE) that will modify or alter the data on a storage device. It should be noted that the “WRDATA” label used herein is arbitrary and should not be construed as limiting the invention. The field  46  is in essence a read/write flag regardless of the label it is given. 
     According to the present invention, “read-only” zones are configured by setting an access attribute of a Fibre Channel zone thereby providing the host(s) within that zone with read-only access to other members of that zone. In zone A of  FIG. 1  for example, the hosts H 1  and H 2  would ordinarily have read and write access to the storage device D 1  by default. However, if zone A is to be made a read-only zone, then hosts H 1  and H 2  are given read-only access to the storage device D 1 . The access attribute of a zone is configured by a SAN administrator and is enforced by the Switches in the Fabric based on this configuration. 
       FIG. 4  is a flow chart  50  illustrating the enforcement of read-only zones within the switching Fabric  12 . When a frame is injected into the Fabric  12  by a source end device in a read-only zone to a destination device (either a storage device or another host) within the same read-only zone, it is received at one of the Switches (box  52 ). In decision diamond  52 , the Switch determines if both the identified source and destination end devices in the frame are within the same read-only zone. If no, the frame is forwarded along the best path to its destination (box  56 ). (If neither the source and destination end devices are in a read-only zone or a read-write zone, then the frame is dropped). If yes, in decision diamond  54 , the control processor  30  of the Switch checks the status of the WRDATA flag in field  46 . If the flag is reset to read, then the frame is forwarded along the best path to the specified destination (box  56 ). On the other hand, if the flag is set to write, then the frame or command is trapped (box  60 ) by the processor  30 . The Switch then generates a standard Fibre Channel “Write Protect” response message to the source end device (box  62 ) that generated the frame. When the Write Protect message is received by the source end device, the user is notified that the frame or command was not accepted by the destination device (box  64 ). The origin of the Write-Protect message is transparent. The source device is unaware that the Write-Protect message was actually from the Switch and not from the destination device. This feature is preferable over simply dropping the frame because it prevents the source device from becoming “hung up” waiting for a response from the destination device, which of course, will never arrive in situations where a trap occurred. 
     The embodiments of the present invention described above are to be considered as illustrative and not restrictive. A SAN can be configured to have both read-only zones and standard read and write zones. In addition, hosts and storage device members of a read-only zone can also be included in multiple zones having read-only and/or read and write access. The description of the invention provided above predominately covers access between hosts and storage devices. The present invention, however, can equally apply between any two Fibre Channel devices, such as access between two hosts. The invention is not to be limited to the details given herein, but may be modified within the scope and equivalents of the appended claims.