untrusted internal or external sources from launching attacks. In addition, the security infrastructure must provide flexible and interoperable data integrity mecha- nisms to safeguard against tampering or modifying data as it travels over the SNP. Endpoints can be broken down to two constituents-the iSCSI initiators and the iSCSI targets: For the iSCSI initiator devices, network security capabilities within such products are an important value differentiator as compared to the current Fibre Channel host bus adapters (FC HBAs) and even Gigabit Ethernet NICs. In addition, built-in security capabilities within such devices also enable an improved cost of ownership for IP storage deployment. However, the economics of the proposition should not be underestimated. If the cost of security is distributed over a plethora of sys- tems (both computers and storage devices) that are connected onto an infrastructure network, the cost of security per port drops dramatically and becomes easier for an organization/enterprise to budget and justify. Incidentally, embedded network security capabilities are mandatory in order for iSCSI initiators to fully comply with the IETF iSCSI specification. For the iSCSI target devices, securing the network is not just a matter of satisfying a critical part of the IETF iSCSI specification. Including embedded network security inside iSCSI target devices makes even more sense because it also provides some very important functional benefits. Having fine-grained embedded network security capabilities enables iSCSI switches, such as iSCSI/Fibre Channel bridges and iSCSI virtualization engines, to provide optimized support for several IP stor- Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. STORAGE NETWORK PROCESSORS (SNPS) STORAGE NETWORK PROCESSORS (SNPs) 215 age deployment scenarios. This can only be accomplished if an all-e