Fibre Channel

Fibre Channel is a set of standards for connecting storage devices in a fabric network. The Fibre Channel standard identifies a protocol and a collection of physical interfaces for managing computer peripheral components. This standard’s key purpose is managing large numbers of storage devices. Fibre Channel uses serial interfaces working at symbol rates from 133MB/s up to 4.25Gb/s. Optical as well as electrical signals are supported. Fibre Channel supports data transmission rates of 100MBps. It also allows 126 devices to be connected on a single network.

The channels are full duplex, offering full bandwidth and double the channel rate. Topologies comprise of point-to-point, shared loop, and switched. Fibre Channel is associated with numerous protocol layers, the most well-liked are the storage protocols SCSI (FCP) and ESCON (FICON). Fibre Channel is the primary technology used to deploy Storage Area Networks (SANs).

Fibre Channel Topologies

Fibre Channel supports three fabric topologies:

• Fabric
• Loop
• Point-to-Point

Fibre Channel Physical Connectivity

Fibre Channel supports connectivity over fiber optic cabling or copper wiring.

Fibre Channel devices using fiber optic cabling use two unidirectional fiber optic cables for each connection. One fiber optic cable is used for transmitting, the other for receiving. Fibre channel over fiber optic cable supports cable distances of up to 10Km.

Fibre Channel devices that communicate over copper cabling are limited to distances of 30m.

Fibre Channel Devices

Fibre Channel Devices include:

• Host Bust Adapters (HBA’s)
• Fibre Channel Hubs
• Fibre Channel Switches

Fibre Channel Ports

Fibre Channel uses a shorthand terminology to describe different types of connections to the Fibre Channel network.

Fibre Channel uses the term “ports” and defines seven different types of ports:

Fibre Channel Standards

The American National Standards Institute (ANSI) defines the Fibre Channel standards.

FCAP (Fibre Channel Authentication Protocol)

FCAP is an optional authentication mechanism employed between any two devices or entities on a Fibre Channel network using certificates or optional keys.

FCPAP (Fibre Channel Password Authentication Protocol)

FCPAP is an optional password based authentication and key exchange protocol that is utilized in Fibre Channel Storage Area Networks (SANs).

FCPAP is used to mutually authenticate Fibre Channel ports to each other. This includes E_Ports, N_Ports, and Domain Controllers.

ESP over Fibre Channel

ESP (Encapsulating Security Payload) is an Internet standard for the authentication and encryption of IP packets. ESP is defined in RFC 2406: IP Encapsulating Security Payload (ESP).

FC-SP (Fibre Channel – Security Protocol)

Fibre Channel – Security Protocol (FC-SP) is a security protocol for Fibre Channel Protocol (FCP) and fiber connectivity (Ficon).

FC-SP is a project of Technical Committee T11 of the International Committee for Information Technology Standards (INCITS).

FC-SP is a security framework that includes protocols to enhance Fibre Channel security in several areas, including Fibre Channel device authentication, cryptographically secure key exchange, and cryptographically secure communication between Fibre Channel devices.

FC-SP is focused on protecting data in transit throughout the Fibre Channel network. FC-SP does not address the security of data that is stored on the Fibre Channel network.

ESP is widely deployed in IP networks and has been adapted for use in Fibre Channel networks. The IETF iSCSI proposal specifies ESP link authentication and optional encryption.

ESP over Fibre Channel is focused on protecting data in transit throughout the Fibre Channel network. ESP over Fibre Channel does not address the security of data that is stored on the Fibre Channel network.

SLAP (Switch Link Authentication Protocol)

SLAP is an authentication method for Fibre Channel switches that utilizes digital certificates to authenticate switch ports.

SLAP was designed to prevent the unauthorized addition of switches into a Fibre Channel network.

DH-CHAP

DH-CHAP (Diffie Hellman – Challenge Handshake Authentication Protocol) is a forthcoming Internet Standard for the authentication of devices connecting to a Fibre Channel switch.

DH-CHAP is a secure key-exchange authentication protocol that supports both switch-to-switch and host-to-switch authentication.

DH-CHAP supports MD5 and SHA-1 algorithm-based authentication.

Attacks against FCP

Attacks against FCP (Fibre Channel Protocol) include:

• Node Name / Port Name spoofing at Port Login time
• Source Port ID spoofing on data-less FCP commands
• Snooping and spoofing on FC-AL
• Snooping and Spoofing after Fabric reconfiguration
• Denial of Service attacks can be made in User mode