Access control appartus and access control method

Abstract

In an access control system, accesses are controlled which are received from not only the same communication network, but also either one or a plurality of other communication networks. In this access control system, a channel processor of a storage control system accepts a log-in request containing a target IP address from a target host apparatus, and compares this target IP address with the own IP address stored in an iSCSI port. Based upon a comparison result, the channel processor judges a network relative logical distance of a target network with respect to a communication network containing the storage control system as to the target network containing a target host apparatus. Then, the channel processor permits an access of a permission access type corresponding to the judged network relative logical distance with respect to a target upper grade apparatus.

1 . An access control apparatus connected via either one or a plurality of communication networks to an upper grade apparatus, comprising: 
 access accepting means for accepting an access issued from a target upper grade apparatus via said either one or plural communication networks; and    access control means for identifying a target network attribute corresponding to an attribute related to a target communication network to which said target upper grade apparatus is connected based upon information contained in said access issued from said target upper grade apparatus, and for controlling an access type which is permitted to said target upper grade apparatus.    
   
   
       2 . An access control apparatus as claimed in  claim 1  wherein: 
 said access control apparatus is further comprised of:    access controlling information storage means for storing thereinto plural sorts of permission access types which correspond to plural sorts of target network positions/sorts indicative of said logical positions and/or said types of the target communication networks; wherein:    said access control means identifies said target network position/type based upon information contained in an access issued from said target upper grade apparatus; identifies a permission access type corresponding to said identified target network position/type with reference to the information stored in said access controlling information storage means; and permits such an access corresponding to said identified permission access type with respect to said target upper grade apparatus.    
   
   
       3 . An access control apparatus as claimed in  claim 2  wherein: 
 said access control means accepts an access containing a target IP address from said target upper grade apparatus; and judges said target network position based upon said target IP address.    
   
   
       4 . An access control apparatus as claimed in  claim 2  wherein: 
 said access controlling information storage apparatus further stores thereinto the own IP address allocated to said access control apparatus;    said target network position corresponds to a network logical distance indicative of a logical distance between the own communication network to which said access control apparatus is connected and said target communication network;    said plural sorts of access types are defined in correspondence with said plural sorts of network logical distances, and further, each of said plural sorts of access types becomes such a type which implies that the larger said network logical distance corresponding to the access type becomes, the smaller an accessible action time with respect to said data storage apparatus of said target upper grade apparatus is decreased; and    said access control means accepts an access containing a target IP address from said target upper grade apparatus, and judges said network logical distance based upon both said own IP address and said target IP address.    
   
   
       5 . An access control apparatus as claimed in  claim 1  wherein: 
 said access control apparatus is further comprised of:    an access controlling information storage apparatus for storing thereinto a plurality of upper grade apparatus identification information corresponding to a plurality of upper grade apparatus;    in the case that said access control means accepts an access containing the target upper grade apparatus identification information of said target upper grade apparatus from said target upper grade apparatus, if said target upper grade apparatus identification information has not been stored in said access controlling information storage apparatus, then said access control means does not permit an access with respect to said target upper grade apparatus.    
   
   
       6 . An access control method for controlling that an upper grade apparatus accesses via either one or a plurality of communication networks to a lower grade apparatus, comprising: 
 a step for identifying target network information equal to such an information related to a target communication network based upon predetermined information contained in an access outputted from a target upper grade apparatus, said target upper grade apparatus being connected to said target communication network; and    a step for controlling an access type which is permitted with respect to said upper grade apparatus based upon said identified target network information.