Patent ID: 6968463

Claim:
A method for implementing security management in a storage area network including at least one storage resource user, an data storage RAID controller, and a data storage array coupled to the controller, the method comprising the steps of: granting access to data storage areas on disks in the storage array to specific storage resource users of the at least one storage resource user; storing, in a table of approved entities in non-volatile memory in the controller, indicia of data storage areas on disks in the storage array accessible to any storage resource user that has been granted access to data storage areas on disks in the storage array; storing, in a table of not-yet-approved entities in volatile memory in the controller, indicia of any of the at least one storage resource user that have not been granted access to data storage areas on disks in the storage array; requesting access to the areas by sending at least the identifying indicia from the storage resource user to the resource provider; and examining the table of approved entities for the identifying indicia to determine whether any of the data storage areas are available to the requesting storage resource user; wherein, if the data storage areas are determined to be available to the storage resource user requesting access to the data storage areas, then allowing the storage resource user to access the data storage areas; otherwise, if no the data storage areas are determined to be available to the requesting storage resource user, then storing the identifying indicia in the table of not-yet-approved entities; uploading the table of not-yet-approved entities from the controller; selecting the identifying indicia corresponding to a storage resource user, from the table of not-yet-approved entities; selecting, from the list of available data storage areas, the data storage areas to be made available to the storage resource user; sending association information to the controller, the association information including a list of the data storage areas to be made available to the storage resource user and the identifying indicia corresponding to a storage resource user; and allocating, to the storage resource user, the data storage areas included in the association information.