Method for connecting computer systems

Abstract

In a storage network, two access restriction methods, i.e., zoning and LUN security are available. These functions must be set for each units of the storage network. This disadvantageously takes a long period time and manpower. Since the setting is independently conducted for each unit, inconsistent setting cannot be prevented. A utility program having a management console screen using integrated representation of the zoning and the LUN security is provided. The program removes the user's setting operation for each unit and detects any inconsistent user's operation for the screen. Therefore, the inconsistent setting can be prevented.

Claims

What is claimed is:

1. A computer system, comprising:

a plurality of computers each having a computer port coupled to a network;

a plurality of storage apparatuses each having storage ports coupled to said network and logical units storing data from said computers;

a plurality of switch apparatuses each having switch ports coupled to either said computers or a storage system via said network; and

a management module that manages states of connections among said computers, said switch apparatuses and said plurality of storage apparatuses;

wherein said management module comprises:

a correspondence table which indicates relations between a plurality of symbols each indicating a port of said computers, said plurality of storage apparatuses and said plurality of switch apparatuses, and display coordinate values of a display screen,

a path table which indicates relations between said symbols and connections among said computers, said plurality of storage apparatuses and said plurality of switch apparatuses,

a connection state display module for displaying on said display screen a state of said connections in said computer system,

a zone table which indicates relations between a plurality of zones and said symbols indicating said computers, said plurality of storage apparatuses and said plurality of switch apparatuses, and

an input module for inputting a user's request for creating new connections among said symbols on said display screen and changing said connections among said symbols on said display screen,

wherein said connection state display module comprises:

a display module for displaying on said display screen said symbols of said computers, said plurality of storage apparatuses, and the state of said connections at positions indicated by said coordinate values in a graphic image, and

a create module for creating, by use of said input module, an area displaying said plurality of computers and said plurality of storage apparatuses on said display screen,

wherein said management module further comprises:

a display position comparing module for comparing, based on said coordinate values and said user's request, respectively a graphic image display position of said graphic image of said computers and said plurality of storage apparatuses in said connection state display module with a graphic image display position of an area created by use of said input module, and

a setting module for setting said plurality of storage apparatuses and said plurality of switch apparatuses according to a result of the comparison by said display position comparing module,

wherein said management module refers to, in response to zoning information, an area in said zone table and said correspondence table to display symbols for computer ports and storage ports included in a zone corresponding to said zone information on said display screen,

wherein said management module sets an access restriction to a logical unit not to be accessed from said computer ports when a symbol of said logical unit is placed out of said zone, and

wherein when said user's request includes an instruction for creating a connection between symbols of computers, storage apparatuses and said plurality of switch apparatuses not included in said zone table, said user's request is invalidated.

2. A computer system according to claim 1, wherein the area created by said input module of said connection state display module in said management means overlaps with other areas; and

wherein said display position comparing module sets, when the area overlaps with other areas and the overlapped areas contain a graphic image of said computer or said storage apparatus, said storage apparatus and said switch apparatus according to a positional relationship between each of the areas and the graphic image based on said coordinate values and said user's request.

3. A computer system according to claim 1, wherein the graphic image representing computers and storage apparatus displayed on said connection state display module in said management module can be moved by said input module, and

wherein said display position comparing module compares, after the graphic image is moved by use of said input module, a positional relationship between an area and the graphic image and sets said storage apparatus and said switch apparatus according to a result of the comparison.

4. A computer system according to claim 1, wherein said setting module also sets computers according to a result of the comparison by said display position comparing module.

5. A computer system according to claim 1, wherein said management module sets an access restriction to a logical unit when whose symbol is placed out of said zone not to be accessed from said computer port whose symbol being placed within said zone.

6. A method of managing a connection relationship in a computer system which includes a plurality of computers each having a computer port coupled to a network, a plurality of storage apparatuses each having storage ports coupled to said network and logical units storing data from said computers, and a plurality of switch apparatuses each having switch ports coupled to either said computers or a storage system via said network, said method comprising the steps of:

preparing a correspondence table which indicates relations between a plurality of symbols each indicating a port of said computers, said plurality of storage apparatuses and said plurality of switch apparatuses, and display coordinate values, and a path table which indicates relations between said symbols and connections among said computers, said plurality of storage apparatuses and said plurality of switch apparatuses;

displaying an area representing said computers and said plurality of storage apparatuses on a management screen of a management module;

displaying symbols of said computers and said plurality of storage apparatuses in a graphic image on said management screen;

displaying, on said management screen, a state of said connections in said computer system;

preparing a zone table which indicates relations between a plurality of zones and said symbols indicating said computers, and said plurality of storage apparatuses and said plurality of switch apparatuses,

inputting a user's request for creating new connections among said symbols on said management screen and changing said connections among said symbols on said management screen;

comparing, based on said coordinate values and said user's request, respectively information of positions of areas with information of positions of graphic images respectively of computers and said plurality of storage apparatuses on said management screen;

setting an interface for said storage apparatus according to a result of the comparison; and

setting an interface for said switch apparatus according to a result of the comparison,

wherein said management module refers to, in response to zoning information, an area in said zone table and said correspondence table to display symbols for computer ports and storage ports included in a zone corresponding to said zone information on said management screen,

wherein said management module sets an access restriction to a logical unit not to be accessed from said computer ports when a symbol of said logical unit is placed out of said zone, and

wherein when said user's request includes an instruction for creating a connection between symbols of computers, storage apparatuses and switch apparatuses not included in said zone table, said user's request is invalidated.

7. A method of managing a connection relationship in a computer system according to claim 6, further comprising the steps of:

changing a position and a size of an area on said management screen; and

changing a position of each of the graphic images respectively representing computers and storage apparatus on said management screen.

8. A method of managing a connection relationship in a computer system according to claim 6, further comprising the step of:

when a position and a size of an area on said management screen is changed or when a position of each of the graphic images respectively representing computers and storage apparatus on said management screen is changed, determining for each area whether or not the computers and the storage apparatus have valid connectivity therebetween in the area.

9. A method of managing a connection relationship in a computer system according to claim 6, further comprising the step of:

setting connection for the computers according to a result of the comparison of said positional information comparing step.

10. A method according to claim 6, wherein said management module sets an access restriction to a logical unit when whose symbol is placed out of said zone not to be accessed from said computer port whose symbol being placed within said zone.

Description

BACKGROUND OF THE INVENTION

The present invention relates to a utility program to manage security between a storage device and a computer, and in particular, to a method of implementing a utility program and an operation method thereof in which security can be managed without considering methods of setting a security function supported by a storage device, a security function supported by a computer, and a security function supported by a switching device (connecting device), respectively.

The connection most employed between a computer and an external storage device are changing from a connection layout in which the storage device exclusively belongs to the computer to a storage network layout in which a plurality of computers are connected via a network to a plurality of storage devices. One of such storage network layouts in which a fibre channel is used as a connecting medium between the computer and the storage is particularly known as "storage area network (SAN)".

The SAN uses connecting devices called "fabric switch" or "a fibre channel switch". The fabric switch is a device including a plurality of fibre channel ports. By connecting computers and storage devices via fibre channel cables to ports of the fibre channel switch, the computer and storage devices can communicate with each other. By connecting the fabric switches via a fibre channel cable to each other, computers and storage devices connected to the SAN can communicate via a plurality of fabric switches with each other.

The devices such as storage devices and computers constituting the SAN will be referred to as nodes hereinbelow. Each node includes at least one port to be connected to the SAN and is connected via a fibre channel cable to a fibre channel switch.

All nodes connected to the SAN can communicate with each other as described above. Therefore, a plurality of computers connected to the SAN can access any areas of the storage devices connected to the SAN. In general, it is assumed that an operating system running in each computer exclusively use a storage area, and it is not considered that the storage area can be accessed by other computers. Therefore, there possibly occurs, for example, a case in which when two or more computers write data in one storage area of the SAN, first data written first in the storage area is by mistake lost by a subsequent writing operation in the storage area.

As above, the property of the SAN easily causes hindrance to the operating system. There also exists a program product which uses the property of the SAN so that a plurality of computers share the storage area. The system manager must manage the programs such that a plurality of computers simultaneously access one storage area excepting when such a program product described above is used.

To easily solve this problem, the fabric switch generally supports a function called "zoning". The zoning function is used to classify the ports of the nodes connected to the fabric switch into groups so that only the computers belonging to a zone can access the storage devices belonging to the zone. To set a zone, a value called "worldwide name (WWN) which is a unique identifier assigned to a port is used. The SAN manager sets worldwide names of storage devices and zones which contain worldwide names of computers allowed to access the storage devices to the fabric switch so that the computers access only the storage devices set as above.

Incidentally, one port can belong to a plurality of zones. In this case, the port can mutually communicate with the ports contained in all zones to which the port belongs.

On the other hand, the access limiting function may be supported by an external storage device. A function called "logical unit number (LUN) security" or "LUN masking" is used to limit, by use of a worldwide name, computers which can access storage areas in storage devices. A logical unit number is an 8-bit value assigned to a storage area and is defined by small computer system interface (SCSI) specifications used as a communication protocol of the SAN. A computer specifies a logical unit number in the SCSI protocol to conduct communication via a fibre channel with a storage device to thereby access a particular storage area.

However, if an LUN security has been set to the storage area, the storage device makes a check using a worldwide name to determine whether or not the access is issued from a computer allowed to access the storage area. If the computer (WWN) is not allowed to access the storage area, the storage device rejects the access. In this specification, a storage area will be referred to as a logical unit according to the definition of SCSI.

There exists a method in which the LUN security function is supported or provided by a device driver of a fibre channel host bus adapter installed in a computer. In this method, the device driver of the fibre channel host bus adapter limits an access to a logical unit by concealing the logical unit of an SAN specified for the operating system. The device driver of the fibre channel host bus adapter having the function includes an interface to set the LUN security.

The zoning function and the LUN security function are mutually independent of each other. Therefore, to change setting of the zoning and the setting of the LUN security, the manager must respectively operate the fabric switches and the storage devices and the computers connected to the fabric switches. This disadvantageously takes a long period of time.

To limit the access in the storage area network, the access restriction of the zoning function and that of the LUN security must integrally match each other. For example, even if the manager sets the LUN security to allow a computer access a logical unit, when the zoning function inhibits the computer from accessing the logical unit, the computer cannot access the logical unit. This possibly leads to a fatal event in which the system including the storage area network stops. In the prior art, since the zoning function and the LUN security function are independent of each other, there exists possibility of such inconsistent setting of these functions as described above.

SUMMARY OF THE INVENTION

It is therefore an object of the present invention, which has been devised to remove the problem, to provide a utility program and an operation method thereof in which the user can set the zoning function and the LUN security function, without paying attention to two security levels respectively of these functions, in one graphical user interface (GUI) screen without causing any inconsistency between these functions.

To achieve the object according to the present invention, in a computer system comprising computers, storage devices, and a switch unit (connection means) including a fibre channel and the like, management means for managing connection in said computer system includes connection display means for displaying a state of connection in said computer system and input means for changing the connection. Said connection state display means can display computers, storage devices, and the connection state in a graphic image, and an area can be created by use of said input means. Moreover, there are also disposed display position comparing means for comparing a graphic image display position of said graphic image of said computers and said storage devices in said connection state display means with a graphic image display position of an area created by use of said input means and setting means for setting said storage devices and said switch unit according to a result of the comparison by said display position comparing means. The setting means is so configured to set computers according to necessity.

Additionally, to create an area by the input means, it is possible to create the area overlapped with other areas. The position and the size of the area as well as the position of a graphic image representing computers and storage devices can be changed by the input means.

Moreover, the display position comparing means includes processing to verify an actual relationship of connections between the switch unit, storage devices, and computers according to the displayed area and a positional relationship between graphic images of the computers and storage devices contained in the area.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be more apparent from the following detailed description, when taken in conjunction with the accompanying drawings, in which:

FIG. 1 is a block diagram showing a configuration of a computer system;

FIG. 2 is a block diagram showing a configuration of a management computer;

FIG. 3 is a block diagram showing a configuration of a management console computer;

FIG. 4 is a block diagram showing a configuration of a computer to access a logical unit;

FIG. 5 is a diagram showing a configuration of a storage device;

FIG. 6 is a diagram showing a configuration of a fabric switch;

FIG. 7 is a diagram showing a relationship between zones set by a zoning setting operation;

FIG. 8 is a diagram showing a display example on a display of a management console computer;

FIG. 9 is a diagram showing a layout of a management program;

FIG. 10 is a diagram showing a layout of a management console program;

FIG. 11 is a diagram showing a table of symbols shown in FIG. 8;

FIG. 12 is a diagram showing a table of areas shown in FIG. 8;

FIG. 13 is a diagram showing a table to keep a relationship between the areas and the symbols shown in FIG. 8;

FIG. 14 is a diagram showing a table to keep a relationship between the areas and zones shown in FIG. 8;

FIG. 15 is a diagram showing a table to keep a relationship between logical unit symbols and storage device port symbols shown in FIG. 8;

FIG. 16 is a diagram showing a table of computer ports;

FIG. 17 is a diagram showing a table of storage device ports;

FIGS. 18A to 18C are diagrams partially showing other display examples on the display of FIG. 3;

FIG. 19 is a flowchart for explaining processing to move a computer port symbol;

FIG. 20 is a flowchart for explaining processing to move a logical unit symbol;

FIG. 21 is a flowchart for explaining processing to move a storage device port symbol;

FIG. 22 is a flowchart for explaining processing to generate areas;

FIG. 23 is a flowchart for explaining processing to invalidate areas;

FIG. 24 is a flowchart for explaining processing to validate areas;

FIG. 25 is a flowchart for explaining processing to change size or a position of an area; and

FIG. 26 is a diagram showing another display example on the display of FIG. 3.

DESCRIPTION OF THE EMBODIMENTS

FIG. 1 shows a configuration of a computer system 80 as an object of management in a favorable embodiment according to the present invention.

The computer system 80 includes a management computer 1 to manage the computer system 80, a management console computer 2 for a user to operate the management computer 1, a storage device 3 having an LUN security function, a fabric switch 4, a computer 5 using the storage device 3, fibre channels 6, and a communication unit 7 for the management computer 1 to communicate with the management console computer 2, the storage device 3, and the fabric switch 4. The storage device 3 includes logical units 33a to 33d. The storage device 3 also includes fibre channel ports 35a and 35b. The logical units 33a and 33b can be accessed as LUN0 and LUN1 respectively via paths 37a and 37b in the storage device 3 from the fibre channel port 35a. The logical units 33c and 33d can be accessed as LUN0 and LUN1 respectively via paths 37c and 37d in the storage device 3 from the fibre channel port 35b. The fabric switch 4 includes fibre channel ports 45a to 45e. The fibre channel port 45d is connected via a fibre channel cable 6 to the fibre channel port 35a of the storage device 3. The fibre channel port 45e is connected via a fibre channel cable 6 to the fibre channel port 35b of the storage device 3. The computers 5a to 5c respectively include fibre channel ports 55a to 55c. The fibre channel ports 55a to 55c are respectively connected via fibre channel cables 6 to the fibre channel ports 45a to 45c of the fabric switch 4.

In the description below, the computers 5a to 5c will be simply and representatively referred to as computers 5.

In the embodiment, it is assumed that the communication unit 7 is configured for a connection layout of network type such as a local area network or the internet. However, it is only necessary that the management computer 1 includes the management console computer 2, the storage device 3, the fabric switch 4, and the communication unit for the client computers 5. That is, the communication unit 7 is not limited to the connection layout of network type. For example, when the management computer 1 includes a fibre channel port like the fabric switch 4 and is connected via the fibre channel port to the fabric switch 4, it is also possible to use the fibre channels 6 to conduct the function of the communication unit 7 for the storage device 3, the fabric switch 4, and the computer 5. The management computer 1 may also be connected via a serial cable to the fabric switch 4 or the storage device 3 such that the management computer 1 uses the serial cable as a communication unit to operate the fabric switch 4 or the storage device 3. The management computer 1 and the management console computer 2 may be implemented by one computer. Or, the management computer 1 and the management console computer 2 may be included in each of the computers 5. Although the storage device 3 is only one storage device in the embodiment, the present invention is applicable also to a computer system including a plurality of storage devices.

FIG. 2 shows a configuration of the management computer 1.

The management computer 1 includes a central processor 11 to control the management computer 1, a memory 12 to store programs to be executed by the central processor 11 and data associated therewith, a network interface unit 13 to conduct communication via the communication unit 7, an input/output (I/O) processor 14 for the user to operate the management computer 1, a storage device 15 such as a hard disk device to store programs to be executed by the central processor 11 and data associated therewith, and a bus 16 to connect the constituent elements 11 to 15 of the computer 1 to each other. Although not shown in FIG. 2, the I/O processor 14 is connected to a display to present information to the user and a keyboard and a pointing device such as a mouse for the user to input data to the computer 1.

FIG. 3 shows a configuration of the management console computer 2.

The management console computer 2 includes a central processor 21 to control the computer 2, a memory 22 to store programs to be executed by the central processor 21 and data associated therewith, an I/O processor 23 for the user to operate the computer 2, a keyboard 24 connected to the I/O processor 23, a pointing device such as a mouse connected to the I/O processor 23, a display 26 connected to the I/O processor 23, a network interface unit 27 to conduct communication via the communication unit 7, a storage device 28 such as a hard disk device to store programs to be executed by the central processor 21 and data associated therewith, and a bus 29 to connect the constituent elements 21, 22, 23, 27 and 28 of the computer 2 to each other.

FIG. 4 shows a configuration of the computers 5a to 5c representatively referred to as computers 5.

The computer 5 includes a central processor 51 to control the computer 5, a memory 52 to store programs to be executed by the central processor 51 and data associated therewith, an I/O processor 53 for the user to operate the computer 5, a fibre channel interface unit 54, a fibre channel port 55, a network interface unit 56 to conduct communication via the communication unit 7, a storage device 57 such as a hard disk device to store programs to be executed by the central processor 51 and data associated therewith, and a bus 58 to connect the constituent elements 51 to 54 and the constituent elements of the computer 2 to each other.

FIG. 5 shows a configuration of the storage device 3.

The storage device 3 includes a central processor 31 to control the storage device 3, a memory 32 to store programs to be executed by the central processor 31 and data associated therewith, logical units 33a to 33d disposed in the storage device 5, a fibre channel interface unit 34, fibre channel ports 35a and 35b, and a network interface unit 36 to conduct communication via the communication unit 7.

The memory 32 has stored a program 321 to control the LUN security, LUN security information 322 to keep information regarding LUN and access control, and a program 323 to process an access from a computer to an LUN.

FIG. 6 shows a configuration of the fabric switch 4.

The fabric switch 4 includes fibre channel ports 45a to 45e, a central processor 41 to control setting of zones and data passing through the fibre channel ports 45a to 45e, a zoning information 42 to be used by the central processor 41, and a network interface unit 43 connected to the communication unit 7.

FIG. 7 shows zones set in a computer system 80. In FIG. 7, three zones are set to the fabric switch 4. The zones are a zone 81 with an identifier "zone81" in which the fibre channel port 55a of the computer 5a can mutually communicate with the fibre channel port 35a of the storage device 3, a zone 82 with an identifier "zone82" in which the fibre channel port 55b of the computer 5b, the fibre channel port 35a of the storage device 3, and the fibre channel port 35b of the storage device 3 can mutually communicate with each other, and a zone 83 with an identifier "zone83" in which the fibre channel port 55c of the computer 5c can mutually communicate with the fibre channel port 35b of the storage device 3.

FIG. 8 shows a configuration of a screen 1000 presented on the display 26 of the management console computer 2 in the embodiment.

The screen 1000 shows a configuration of the access restriction of the computer system 80 shown in FIGS. 1 and 7 in the embodiment. The screen 100 is displayed in the overall screen or in a part of the screen of the display 26 of the computer 2. In the screen 1000, scroll bars 1080 and 1081 are displayed respectively on a right end section and a lower end section thereof. By operating the scroll bars 1080 and 1081, the user can scroll the screen image in the screen 100 to display continuous parts of the screen image being presently displayed.

Numerals 1021 to 1023 are computer port symbols respectively indicating the fibre channel ports 55a to 55c respectively of the computers 5a to 5c. For easy understanding of the configuration, it is assumed in this embodiment that one computer 5 includes one port and the symbol is indicated by an icon similar to the form of a computer. Naturally, this will not restrict the fields to which the present invention is applied.

Numerals 1031 and 1032 are storage device port symbols respectively indicating the ports 35a and 35b of the storage device 3. For easy understanding, each port of the storage device 3 is indicated by a small circle in the embodiment.

Numerals 1041 to 1044 are logical unit symbols respectively indicating the logical units 33a to 33d arranged in the storage device 3.

Lines 1051 to 1054 respectively indicate paths set between the ports 35a and 35b of the storage device 3 and the logical units 33a to 33d. Lines 1051 and 1052 respectively indicate that the logical units 33a and 33b can be accessed from the port 35a. Lines 1053 and 1054 respectively indicate that the logical units 33c and 33d can be accessed from the port 35b.

Areas 1011 to 1013 are displayed in the screen 1000. These areas respectively indicate ranges of access restriction, which will be described later. The areas 1011 to 1013 respectively correspond to zones 81 to 83 allocated to the computer system 80. Each area is expressed by a rectangle on the screen 1000. However, any contour other than the rectangle can be used to express the area without departing from the gist of the present invention. Therefore, although only a rectangular area is used for simplification of the description, the applicable range of the present invention is not restricted by the embodiment.

A cursor 1070 is moved in the screen 1000 in response to an operation of the pointing device 25 by the user.

The use can move the computer port symbol, the storage device port symbol, the logical unit symbol, and the symbol indicating a storage device on the screen 1000 by conducing a drag-and-drop operation. Specifically, the user places the cursor over a target symbol by operating the pointing device 25, depresses a button 25a of the pointing device 25, moves the cursor 1070 with the button 25a kept depressed to a desired position, and then releases the button 25a. Resultantly, the symbol is moved to the desired position. However, the destination of each symbol is restricted, which will be described later. The user can change the size and the position of each area by operating the pointing device 25.

FIG. 9 is a layout of a management program 120 to run on the management computer 1. The management program 120 includes a command process block 121 which interprets a user's operation sent from a management console program 220, which will be described later, and which accordingly instructs a setting block 127 to change the setting of a device to thereby change security information 122 as internal data, security information 122 to keep areas and symbols to be displayed on the screen 1000, a communication block 123 to communicate with the management console computer 2, and a setting block 127 to change the setting of the storage device 3, the fabric switch 4, and the computers 5.

In the embodiment, the computer system 80 as a target system includes only one fabric switch 4. However, the present invention is applicable to a computer system including a plurality of fabric switches by arranging in the setting block 127 an operation unit to operate the fabric switches.

FIG. 10 shows a configuration of the management console program 220 to run on the management console computer 2. The management console program 220 includes a display block 222 to draw the screen 1000 on the display 26 of the computer 2 and a GUI process block 223 to process operations conducted by the user from a keyboard 24 and the pointing device 25 of the computer 2.

Description will next be given of tables 3100 to 3900 contained in the security information 122 as internal data of the management program 120.

FIG. 11 shows the table 3100 to keep a correspondence between symbols to be displayed on the screen 1000 and management target objects. A first item of each row of the table 3100 is an identifier of a symbol. The symbol identifier is uniquely assigned to the symbol and is used to indicate the symbol between the management program 120 and the management console program 220. A second item of the row indicates coordinate values and a size of the symbol on the screen 1000. A third item is a name of the symbol to be displayed below the symbol on the screen 1000. A fourth item is a type of a system constituent element expressed by the symbol. HOST_PORT indicates a port of a computer, STORAGE_PORT indicates a port of a storage device, and LU indicates a logical unit. A fifth item is an identifier in the management program 120 of a system constituent element expressed by the symbol. In the table 3100, the first to fifth rows keep information respectively of the symbols 1021, 1022, 1023, 1031, and 1032. Sixth to ninth rows keep information respectively of the symbols 1041 to 1044.

FIG. 12 shows the table 3200 to keep ranges and validity of areas to be displayed on the screen 1000. In each row of the table 3200, a first item is a value of an identifier of the area. The area identifier is a value uniquely assigned to the area and is used to indicate the area between the management console program 220 and the management program 120. A second item indicates a range of the area by two pairs of coordinate values respectively of an upper-left corner and a lower-right corner of the area on the screen 1000. A third item is a name assigned to the area for the user to identify the area. A fourth item is a validity flag to indicate validity of the area. The validity of the area will be described later. When the validity flag has a value of "1", the area identified by the identifier in the first item is valid. When the flag has a value of "0", the area is invalid. The first to third rows of the table 3200 keep information of the areas 1011 to 1013, respectively.

FIG. 13 shows the table 3300 to keep a relationship between the areas and the symbols in the areas on the screen 1000. In each row of the table 3300, a first item is an identifier of the area and has a value equal to that of the first item of the table 3200. A second item is an identifier of a symbol arranged in the area identified by the identifier of the first item and has a value equal to that of the first item of the table 3100. The first to third rows of the table 3300 indicate that the area 1011 includes the symbols 1021, 1031, and 1041, respectively. The fourth to eighth rows of the table 3300 indicate that the area 1012 includes the symbols 1022, 1031, 1042, and 1043, respectively. The ninth to 11th rows of the table 3300 indicate that the area 1013 includes the symbols 1023, 1033, and 1044, respectively.

FIG. 14 shows the table 3500 to store a correspondence between zones set to the fabric switch 4 and areas on the screen 1000. In each row of the table 3500, a first item is a value as an identifier to indicate a zone between the management console program 220 and the management program 120. A second item is an identifier of the area and has a value equal to that of the first item of the table 3200. A third item is a value as an identifier of a zone when the fabric switch 4 is operated. The value is described in a format associated with the fabric switch 4. The first row of the table 3500 indicates that the area 1011 corresponds to the zone 81. The second row of the table 3500 indicates that the area 1012 corresponds to the zone 82. The third row of the table 3500 indicates that the area 1013 corresponds to the zone 83.

FIG. 15 shows the table 3600 to keep, when logical units of the computer system 80 has paths to storage device ports, a relationship between the logical unit symbols of the logical units and the storage device port symbols of the storage device ports. In each row of the table 3600, a first item is an identifier of the logical unit symbol and has a value equal to that of the first item of the table 3100. A second item is an identifier of a symbol indicating a port having a path to the logical unit and has a value equal to that of the table 3100. A third item is a logical unit number (LUN).

The first row of the table 3600 indicates that the logical unit 33a indicated by the logical unit symbol 1041 has a path to the storage device port 35a indicated by the storage device port symbol 1031 and the logical unit 33a has a logical unit number of "0". The third row of the table 3600 indicates that the logical unit 33b indicated by the logical unit symbol 1042 has a path to the storage device port 35a indicated by the storage device port symbol 1031 and the logical unit 33b has a logical unit number of "1". The second row of the table 3600 indicates that the logical unit 33c indicated by the logical unit symbol 1043 has a path to the storage device port 35b indicated by the storage device port symbol 1032 and the logical unit 33c has a logical unit number of "0". The fourth row of the table 3600 indicates that the logical unit 33d indicated by the logical unit symbol 1044 has a path to the storage device port 35b indicated by the storage device port symbol 1032 and the logical unit 33d has a logical unit number of "1".

FIG. 16 shows the table 3800 to keep all computer ports of the computer system 80. In each row of the table 3800, a first item is a value as a port identifier to indicate a port between the management console program 220 and the management program 120. A second item is a worldwide name of the computer port identified by the first item. A third item is an identifier of the computer having the port identified by the identifier of the first item. The identifier has a unique value associated with the computer for use in the management program 120. A fourth item is an identifier number (0, 1, 2, . . . ) of the port identified by the value of the first item, the identifier being used in the computer identified by the value of the third item. In this embodiment, since the computer includes only one port, "0" is set to the third item. A fifth item is an identifier address in the communication unit 7 in the communication unit 7 for the management program 120 to communicate via the communication unit 7 with the computer having the port. Since the communication unit 7 is configured for a network using transmission control protocol (TCP)/internet protocol (IP) in the embodiment, an IP address of the computer is set as the value of the fifth item.

The first to third rows of the table 3800 respectively keep information of computer ports indicated by the symbols 1021 to 1023, respectively.

FIG. 17 shows the table 3900 to keep all storage device ports of the computer system 80. In each row of the table 3900, a first item is a value as a port identifier to indicate a port between the management console program 220 and the management program 120. A second item is a worldwide name of the storage device port. A third item is an identifier of the storage device having the port identified by the identifier of the first item. The identifier has a unique value associated with the storage device for use in the management program 120. A fourth item is an identifier of the port identified by the value of the first item, the identifier being used in the computer identified by the value of the third item. The value of the fourth item is used to specify the port to the storage device. Therefore, the value is described in a format depending on the storage device. A fifth item is an identifier address in the communication unit 7 for the management program 120 to communicate via the communication unit 7 with the storage device having the port. Since the communication unit 7 is configured for a network using TCP/IP in the embodiment, an IP address of the computer is set as the value of the fifth item.

The first row of the table 3900 keeps information of the storage device port corresponding to the symbol 1031. The second row of the table 3900 keeps information of the storage device port corresponding to the symbol 1032.

The display block 222 refers to the table 3200 and draws the areas 1011 to 1013 according to the coordinate values and the validity flag of each row. The display block 222 refers to the table 3100 and then draws the computer port symbols 1021 to 1023, the storage device symbols 1031 an 1032, and the logical unit symbols 1041 to 1044 according to the coordinate values, the symbol type, and the symbol name of each row. Finally, the display block 222 refers to the table 3600 and then draws the paths 1051 to 1054 between the logical unit symbols and the storage device port symbols.

To display the screen 1000, the management console program 220 refers to the tables 3100, 3200, and 3600 as above. However, the management console program 220 may obtain these tables from the management program 120 when the management console program 220 draws the screen 1000. Or, the management console program 220 may have the same tables as those of the management program 120. This also applies to the security information 122 kept by another management program 120.

The screen 1000, the security information 122 as internal data of the management program, and a correspondence therebetween are as follows. Description will now be given of meanings and validity of the areas 1011 to 1013 displayed on the screen 1000. A valid state of an area and an invalid state thereof are criteria introduced for the management program 120 to determine whether or not mismatching exists between an operation conducted by the user for the screen 1000 and a configuration which can be set to the system.

In the description below, when a symbol is arranged in an area on the screen 1000, it is assumed that the symbol belongs to the area. This state is also referred to as "the area contains the symbol" depending on cases.

In the embodiment, an area is in a valid state or in an invalid state. An area in the valid state is called a valid area, and an area in the invalid state is called an invalid area. The invalid area is displayed in a color different from a color of the valid area on the screen 1000.

When there exists a valid area containing a plurality of port symbols, it is indicated that the symbols in the area can mutually communicate with associated ports, and these ports can communicate with each other in the computer system 80. The ports include computer ports and storage device ports. When a plurality of ports can communicate with each other, the fabric switch 4 sets a zone containing the ports.

In the embodiment, for a valid area containing two or more ports, there exists a zone corresponding to the valid area in any situation. As described above, the correspondence between the valid area and the zone is recorded in the table 3500. When one valid area contains a plurality of port symbols, it is assumed that connectivity exists between the port symbols. Also, it is assumed that connectivity exists between ports indicated by the port symbols, respectively.

When there exists a valid area containing computer symbols and logical unit symbols, it is indicated that for the logical units indicated by the logical unit symbols can be accessed from the computer ports using the LUN security function, and actually, the logical units can be accessed from the computer ports in the computer system 80.

In the description below, when there exists a valid area containing computer symbols and logical unit symbols, it is assumed that the computer port symbols can access the logical unit symbols on the screen. Also, the computer ports indicated by the computer port symbols can access the logical units indicated by the logical unit symbols.

The areas can overlap with each other. When a plurality of overlapped valid areas contain a symbol, an actual port or logical unit indicated by the symbol has the above meaning for all valid areas in which the symbol is arranged.

As above, an area indicates a group including accessible constituent elements indicated by the symbols.

An invalid area represents a system configuration which the user intentionally sets as "invalid" or an inconsistent system configuration. For example, assume that the user intentionally invalidates an area containing a logical unit symbol and a computer port symbol. In response to the user's operation, the management program 120 changes the configuration of the computer system (assume that the areas do not overlap each other in this case) such that the computer port indicated by the computer port cannot access the logical unit indicated by the logical unit symbol. Processing in this case will be described later. When an area contains a logical unit symbol and a computer port symbol, the area is an invalid area if connectivity exists between the storage device port symbol having a path to the logical unit symbol and the computer port symbol. This will be described by referring to FIGS. 18A to 18C.

In the case of FIG. 18A, an area 4001 guarantees connectivity between a storage device port symbol 4002 having a path to a logical unit symbol 4004 and a computer port symbol 4003. Therefore, the area 4001 containing the logical unit symbol 4004 and the computer port symbol 4003 is valid by itself. In the case of FIG. 18B, when an area 4011 is valid, the area 4011 guarantees connectivity between a storage device port symbol 4013 and a computer port symbol 4014, and hence an area 4012 is valid. However, in the case of FIG. 18C, connectivity is absent between a storage device port symbol 4023 and a computer port symbol 4024, and hence an area 4022 is invalid, but an area 4021 is valid.

It is one of the objects of the present invention to avoid inconsistent setting of devices. Therefore, when either one of the areas becomes invalid on the screen 1000 as a result of influence from a user's operation, the operation is regarded as invalid. However, there exists an exceptional case of operation of the user to generate an area. In this case, the user can initialize an invalid area. The invalid area thus generated does not influence the other area.

Even when an invalid area becomes a consistent area, i.e., a valid area as a result of influence from a user's operation, the management program 120 does not automatically validate the area. An invalid area remains invalid up to a point of time when the user explicitly validates the invalid area. The invalid area can be validated from a menu or the like through a screen operation. For example, the user selects an invalid area and then conducts an operation to select "validate" from a menu, then the invalid area is validated to a valid area.

As above, whether an area is in a valid state or in an invalid state is recorded in the fourth item of the area control table 3200 in the security information 122. If the area is invalid, a value of "0" indicating "invalid" is recorded in the fourth item. If the area is valid, a value of "1" indicating "valid" is recorded in the fourth item.

Description has been given of the constituent elements of the embodiment, namely, the computer system 80, the screen 100 to be displayed on the display 26 of the management console computer 2, the security information 122 as internal data of the management software 129, and the valid and invalid areas. Next, description will be given of a method in which the embodiment supports, by use of the constituent elements, an access restriction setting function to restrict a user from accessing the computer system 80.

In the embodiment, the management program 120 provides via the screen 1000 three function regarding the computer system access restriction to the user (typically, the computer system manager). The functions are (1) generation and deletion of a zone, (2) change of a port contained in a zone, and (3) allocation of a logical unit to a computer by the LUN security. Details thereof are as follows.