FC SAN中交换机端口安全策略的设计与实现

摘要

信息安全在FC SAN中是一个重要的问题，它涉及到的技术手段包括数据加密和访问控制等。使用ZONE划分及LUN掩码解决这方面的问题时主要是通过对SAN的设置实现，其缺乏灵活性和对数据的访问控制。为了提高光纤通道存储区域网络访问的安全性，设计了一个基于端口策略的交换机安全系统。首先介绍该系统的功能模块，然后分析用到的关键技术，并介绍了系统关键模块的设计。测试表明该系统运行结果符合设计要求，能够起到安全访问控制的效果。%Information security is an important issue in FC SAN,which involves the technical means including data encryp⁃tion and access control. ZONE division and LUN masking is used to solve the problems in this area. This method is mainly realized through the setting of the SAN,whose main problem is the lack of flexibility and data access control. To improve the fiber chan⁃nel storage area network(FCTAN)access security,a switch security system based on the port strategy was designed. In this pa⁃per,the function modules of the system are introduced,the key technologies of the system are analyzed,and the design of the system′s key modules is presented. The final test result shows that the system′s run results can meet the design requirements, and can play a role of the security access control.