Patent ID: 7346924

Claim:
A security system in a storage area network using an Internet Protocol (IP) in which a plurality of both servers and storage devices are connected to Internet via each of a plurality of firewalls provided within each of the servers and storage devices, comprising a manager for managing each of said firewalls, wherein said manager creates a security policy based on access source set definitions defined by each of combinations of an Internet Small Computer System Interface (iSCSI) name and portal information having been assigned to each of servers and storage devices and distributes said security policy to each of said firewalls, the access source set definitions being arranged to be stored in an Internet Storage Name Server (iSNS) connected to the manager, wherein each of said firewalls refers to the distributed security policy to perform access control for distinguishing a valid access complying with the security policy from an unauthorized access breaching the security policy with a judgment on whether or not an access to each of the servers and the storage devices complies with the security policy, by prohibiting an establishment of TOP - connection, wherein when said manager receives notification from said firewall of a detection of access from an unauthorized access source sending an access which does not comply with the security policy and information regarding the unauthorized access source as unauthorized access information, said manager informs said firewall of said unauthorized access source information, and wherein said manager refers to said access source set definitions periodically according to an update interval defined in advance by an administrator, and updates said security policy when said definitions have been updated, or refers to said access source set definitions upon reception of notification issued by a function for managing said access source set definitions indicating that the network has been updated, and updates said security policy in accordance with the update content thereof, or refers to said access source set definitions upon reception of notification issued by a network device indicating reconstruction of the network, and updates said security policy in accordance with the modification content thereof.