1. In a data processing network including a client, a metadata server, and a block storage device, the metadata server managing metadata of a shared-disk file system, and the block storage device storing file data of the shared-disk file system, a method of securing read or write access of the client to the block storage device, said method comprising: the client sending a request to the metadata server for access to at least a portion of a file in the shared-disk file system, and the metadata server granting access of the client to said at least a portion of the file by returning to the client information specifying a token for validating read or write access to file data of said at least a portion of the file; the client sending a read or write command for read or write access to storage of the block storage device, the read or write command including the token and specifying a logical block address; and the block storage device receiving the read or write command from the client and evaluating the token to determine whether or not the token permits the client to read from or write to the storage at the specified logical block address, and the block storage device permitting the client to read from or write to the storage at the specified logical block address upon determining that the token permits the client to read from or write to the storage at the specified logical block address; which further includes the metadata server forming a virtual block address for a range of contiguous logical block addresses, the virtual block address including the token, and the metadata server sending the virtual block address to the client upon granting the client access to said at least a portion of the file, and wherein the client inserts the virtual block address into at least a portion of an address field of the read-write command; and which further includes the metadata server sending the token and a logical block address for said range of contiguous logical block addresses to the block storage device, and the block storage device storing the received token in a memory in association with the logical block address for said range of contiguous logical block addresses, and the block storage device using the virtual block address in the read or write command received from the client to perform a look-up in the memory in order to perform the evaluation of the token to determine whether or not the token permits the client to read from or write to the storage at the specified logical block address when a token is found in the memory in association with the logical block address for said range of contiguous logical block addresses and the token found in the memory in association with the logical block address for said range of contiguous logical block addresses is the same as the token in the virtual address.