Method, apparatus, and article of manufacture for managing a network storage system

Abstract

Embodiments of the present disclosure provide a method, device and equipment for managing a network storage system. An example method comprises: creating a confidential tenant and a confidential tenant administrator corresponding to the confidential tenant on the network storage system; and transferring management authority of the confidential tenant from a super administrator of the network storage system to the confidential tenant administrator, so that the confidential tenant is invisible to the super administrator. Embodiments of the present disclosure utilize an independent authority management model to achieve that once a tenant resource is allocated and created, the tenant resource is invisible to the super administrator, and is more unchangeable and unremovable, thereby improving the security of the confidential tenant in the network storage system.

Description

Technical Field

[0001] Embodiments of this disclosure relate to the field of computer technology, and more specifically, to the field of network storage system technology. Embodiments of this disclosure relate to methods, apparatus, electronic devices, computer-readable storage media, and computer program products for managing network storage systems. Background Technology

[0002] Storage systems can be categorized into local storage systems and network storage systems based on their data storage methods. Local storage systems store data on local devices (such as hard drives and solid-state drives), allowing direct access and management by the local device. This is suitable for scenarios requiring high data access speeds and relatively small data volumes. Network storage systems, on the other hand, store data on remote storage devices over a network, enabling resource sharing and centralized management. This allows for large-scale data storage and multi-device access. Tenants in a storage system refer to different users or organizations utilizing storage resources; each tenant has independent storage space and permissions. Network storage systems can also include multi-tenant environments. In a multi-tenant environment, multiple tenants can share the same network storage infrastructure, such as storage devices and network bandwidth, but technical measures ensure that each tenant's data is isolated and securely independent, achieving efficient resource utilization and cost optimization.

[0003] With increasing user focus on tenant security in private cloud deployments, high-performance computing (HPC) scenarios, and artificial intelligence (AI) training and push clusters, users have expressed concerns about the potential risk of sensitive data stored by tenants in network storage systems being stolen by administrators or device owners in multi-tenant environments. Traditional multi-tenant management models primarily rely on software-implemented logical isolation and access control mechanisms, achieving isolation of resources between tenants only. Current network storage system management models are structured in a multi-layered manner, with roles such as super administrator, administrator, and tenant administrator. Storage administrators can view tenant data, even manage tenants, and modify tenant security configurations. In other words, the tenant design of network storage systems is centered on the administrator holding the device, rather than the data holder. Summary of the Invention

[0004] The embodiments of this disclosure provide a hardware-isolated, highly secure network storage system management solution.

[0005] According to a first aspect of this disclosure, a method for managing a network storage system is provided. The method includes: creating a confidential tenant and a corresponding confidential tenant administrator on the network storage system; and transferring the management permissions of the confidential tenant from the network storage system's super administrator to the confidential tenant administrator, so that the confidential tenant is invisible to the super administrator. In this manner, embodiments of this disclosure utilize an independent permission management model to ensure that once tenant resources are allocated and created, the tenant resources are invisible to the super administrator during the lease term, and cannot be modified or deleted, thereby improving the security of confidential tenants in the network storage system. In this document, the super administrator may also be referred to as a storage administrator, system administrator, global administrator, etc.

[0006] In some embodiments of the first aspect, the confidential tenant administrator is configured with authentication credentials deployed in the trusted execution environment of the network storage system, and the method further includes: verifying the identity of the confidential tenant administrator based on the authentication credentials. In this way, hardware-level memory and address space isolation is provided through the trusted execution environment, and independent access control is performed using a separate confidential tenant authentication process, thereby improving the security of confidential tenant access control.

[0007] In some embodiments of the first aspect, the method may further include: destroying the confidential tenant in response to the confidential tenant administrator failing to perform initial identity verification within a preset time threshold. This approach avoids unverified confidential tenants consuming system resources and posing security risks.

[0008] In some embodiments of the first aspect, the method may further include: in response to an initial identity verification by a confidential tenant administrator, activating a lease clock, the lease clock being deployed in a trusted execution environment (TEX) of the network storage system, wherein the confidential tenant is not visible to the super administrator until the lease clock expires. Based on this approach, the trusted execution environment can be used to prevent the super administrator from tampering with the lease clock, elevating clock protection from the software level to the hardware level, thus improving the security of confidential tenant management.

[0009] In some embodiments of the first aspect, the method may further include: terminating the confidential tenant administrator's management privileges over the confidential tenant in response to the expiration of the lease clock. This approach enables effective control over the usage period of confidential tenants.

[0010] In some embodiments of the first aspect, the confidential tenant also includes a pre-defined self-destruct configuration at creation, and terminating the confidential tenant administrator's management rights over the confidential tenant includes: destroying the confidential tenant based on the pre-defined self-destruct configuration. In this way, a customized security mechanism can be used to ensure that confidential data is completely deleted after use, preventing data leakage.

[0011] In some embodiments of the first aspect, the method may further include: generating a cluster shared key for a confidential tenant within a trusted execution environment of the network storage system; and, in response to the confidential tenant creating an encrypted storage pool, generating an authentication key for the hard drives in the encrypted storage pool based on the cluster shared key, the authentication key being managed by a trusted application within the trusted execution environment. In this manner, the cluster shared key can be used to further enhance the authentication key strength of the encrypted storage pool, elevating key protection from the software level to the hardware level, thereby further improving the security of tenant data.

[0012] In some embodiments of the first aspect, the method may further include: in response to the presence of storage nodes to be added in the network storage system, the primary storage node of the network storage system distributes a cluster shared key to the storage nodes to be added. Based on this approach, it can adapt to scenarios such as the creation, expansion, and scaling down of the network storage system, ensuring the scalability of the network storage system while maintaining tenant data security.

[0013] In some embodiments of the first aspect, the distribution of a cluster shared key from the master storage node of the network storage system to storage nodes to be joined includes: the trusted execution environment (TEE) of the network storage system using the communication channels of the rich execution environment (REA) of the network storage system to decouple trusted applications and certificate authorities; determining a session key based on device certificates in the TEE; sending a key synchronization request from the storage node to be joined to the master storage node of the network storage system based on a secure communication channel established through the authentication certificates of trusted applications; and the master storage node of the network storage system encrypting the cluster shared key based on the session key and sending it to the storage nodes to be joined. This approach ensures the security of the cluster shared key distribution process.

[0014] In some embodiments of the first aspect, the confidential tenant includes a unique resource identifier, and the method further includes: in response to detecting that an extended field of a mount request message includes a resource identifier on the rich execution environment side of the network storage system, forwarding the mount request message to the trusted execution environment of the network storage system for processing. Based on this approach, it is possible to distinguish between confidential and non-confidential tenants and process them differently, ensuring the security of confidential tenants.

[0015] According to a second aspect of this disclosure, an electronic device is provided. The electronic device includes a processing unit and a memory, wherein the processing unit executes instructions in the memory to cause the electronic device to perform a method, the method comprising: creating a confidential tenant and a corresponding confidential tenant administrator on a network storage system; and transferring management privileges of the confidential tenant from a super administrator of the network storage system to the confidential tenant administrator, such that the confidential tenant is invisible to the super administrator.

[0016] According to a third aspect of this disclosure, an apparatus for managing a network storage system is provided. The apparatus includes: a confidential tenant creation unit configured to create a confidential tenant and a corresponding confidential tenant administrator on the network storage system; and an access control unit configured to transfer management permissions of the confidential tenant from the network storage system's super administrator to the confidential tenant administrator, such that the confidential tenant is invisible to the super administrator.

[0017] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided that stores one or more computer instructions thereon, wherein one or more computer instructions are executed by a processor to cause the processor to perform the method according to a first aspect of this disclosure.

[0018] According to a fifth aspect of this disclosure, a computer program product is provided, including machine-executable instructions that, when executed by a device, cause the device to perform the method according to a first aspect of this disclosure. Attached Figure Description

[0019] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0020] Figure 1 This diagram illustrates the structure of a multi-tenant functional scheme in a network storage system.

[0021] Figure 2 A schematic diagram of an example environment in which embodiments of the present disclosure can be implemented is shown;

[0022] Figure 3 A schematic flowchart illustrating a process for managing a network storage system according to an embodiment of the present disclosure is shown;

[0023] Figure 4 A schematic diagram of the structure of a confidential tenant management model according to an embodiment of the present disclosure is shown;

[0024] Figure 5 A schematic diagram illustrating the distribution process of a cluster shared key according to an embodiment of the present disclosure is shown;

[0025] Figure 6 A schematic diagram of the internal structure of an execution environment module according to an embodiment of the present disclosure is shown;

[0026] Figure 7 A schematic block diagram of an apparatus for managing a network storage system according to embodiments of the present disclosure is shown; and

[0027] Figure 8 A schematic block diagram of an example device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0028] The technical solutions of this disclosure will now be described with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments.

[0029] The technical solutions of the embodiments of this disclosure will now be described with reference to the accompanying drawings. In the description of the embodiments of this disclosure, unless otherwise stated, " / " signifies "and / or," for example, A / B can mean A or B, or A and B. "And / or" in this text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Furthermore, in the description of the embodiments of this disclosure, "plural" or "multiple" refers to two or more than two.

[0030] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this embodiment, unless otherwise stated, "a plurality of" means two or more.

[0031] The terminology used in the following embodiments is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure. As used in the specification and appended claims of this disclosure, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to also include expressions such as “one or more,” unless the context clearly indicates otherwise. It should also be understood that in the following embodiments of this disclosure, “at least one” and “one or more” refer to one, two, or more than two. The term “and / or” is used to describe the relationship between related objects, indicating that three relationships may exist; for example, A and / or B can indicate: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character “ / ” generally indicates that the preceding and following related objects are in an “or” relationship.

[0032] References to "one embodiment" or "some embodiments" as used in this specification mean that one or more embodiments of this disclosure include a particular feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "one embodiment," "some embodiments," "another embodiment," "other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0033] The numbers or values ​​used in this specification are illustrative and are intended only to facilitate understanding of the techniques of the embodiments of this disclosure, and are by no means intended to limit the scope of this disclosure.

[0034] Overview

[0035] In network-based computing and storage systems, a tenant is an independent user, organization, or customer instance that possesses logically isolated resources, data, and services within a shared underlying infrastructure. The concept of a tenant is central to multi-tenant architecture, allowing multiple users or organizations (tenants) to share the same set of physical resources while ensuring that their respective data, configurations, and operations are isolated and do not interfere with each other.

[0036] To meet the data security and privacy protection requirements of network storage systems, some vendors have adopted virtualization technology in existing technical solutions. This abstracts physical storage resources into logical units, providing isolated environments for tenants. Each virtual logical unit provides independent namespaces, authentication, network configurations, and data volumes, achieving logical resource isolation. Each individual virtual storage logical unit provides tenant-level administrators, who can perform independent shared configurations, permission configurations, etc. Each tenant administrator can only operate on the resource objects of their assigned tenant; cross-tenant management is not possible between tenant administrators. Regular administrators and super administrators within the storage system can configure all tenants, modify tenant resource status, operate on resource objects within a tenant, and modify security configurations that apply to all tenants.

[0037] Many current storage systems, especially within their operating systems, offer multi-tenancy support, primarily through Storage Virtual Machines (SVMs) that provide virtualized storage containers. Each virtualized container contains data volumes, logical interfaces, and protocol configurations. Other storage products offer multi-level access control to ensure data and management security. Furthermore, some storage families provide independent storage space and resources for different tenants, with each virtual storage domain having its own namespace, configuration information, and management permissions. From the perspective of intra-tenant resource isolation, storage systems define the virtual resource units that tenants can operate on through logical management of software-managed resources. By identifying different tenants, providing each tenant with an independent view of virtual storage resources, and authenticating the resource objects accessed each time, the mapping relationship between tenants and virtual storage resources is implemented through software management.

[0038] From the perspective of tenant resource permission management models, the tenant models currently offered in the storage system field are generally as follows: In existing technical solutions, administrator permissions typically present a multi-level hierarchical structure. The storage superadmin, as the source of the highest-level permission management, has operational permissions for resources deployed on all devices. Regular administrators (Admin) usually have basic resource permissions required for daily maintenance and task execution, can manage all tenant-level resource and policy definitions, and can modify file system shares, Logical Unit Numbers (LUNs), and LUN group configurations related to tenant configurations in the storage system. Tenant administrators (Tenant Admins) are responsible for managing storage virtual resource groups within a specific scope in a multi-tenant isolated environment of the storage system, creating, modifying, and deleting volumes or file systems, managing network configurations (usually including data logical interfaces and management logical interfaces), and storing tenant data.

[0039] Figure 1 A schematic diagram of the structure 100 of a multi-tenant functional scheme in a network storage system is shown. For example... Figure 1As shown, this solution utilizes a hierarchical management model of super administrator, regular administrator, and tenant administrator. Tenant administrator 1 and tenant administrator 2 manage their respective tenant resources, realizing the multi-tenant function of the network storage system and ensuring the independent, secure, and effective management of each tenant's resources. Specifically, tenant administrators can use applications in the operating system to initiate access requests to the corresponding tenant resources through the network path of the Virtual Local Area Network (VLAN). The requests are forwarded by network devices such as switches according to the VLAN rules, ultimately reaching the server where the tenant resource resides. The server may include a set of logical network interfaces, file system sharing, LUN-related storage components, and also covers functional modules such as protocol configuration, security management, and configuration database.

[0040] While the aforementioned solution successfully isolates different tenants' access to independent storage resources in terms of operational views and stored resource objects, it is vulnerable to administrator account leaks, malicious operations by internal personnel, and other software vulnerabilities. The security of tenant data placed on network storage devices depends on factors such as the security awareness of multiple administrators of the network storage device, the network storage device's management system, the device's long-term security maintenance and vulnerability patching strategies, the physical environment of the device (including access control, fingerprint devices, etc.), and the security of the network in which the storage device is deployed. Some cases demonstrate that due to potential mismanagement of storage devices, attacks that gain storage administrator privileges can damage tenant data or directly steal data resources from the tenant's file system or LUN. In other words, tenant data security directly depends on how the storage administrator manages and uses tenant data.

[0041] Furthermore, existing network storage systems are vulnerable to vulnerabilities arising from publicly known operating system vulnerabilities and common components in the software supply chain. As the business functions of network storage systems continue to expand, the external business exposure of storage software continues to increase. Critical logical security modules in storage systems (such as permission verification and resource verification modules) are easily affected by combined attacks through other exposure surfaces, thus breaching resource isolation defenses. Moreover, existing software isolation measures cannot provide hardware-level tenant-level protection against potential vulnerabilities introduced by hardware.

[0042] The inventors noted that some chip manufacturers currently provide a separate, protected execution environment (TEE) within the main processor, which can resolve data ownership and management conflicts between device owners and tenants. The TEE is a secure area within the processor used to ensure that sensitive data is stored, processed, and protected in an isolated and trusted environment. In contrast, the Rich Execution Environment (REE) is the primary operating environment running outside the TEE. Normal applications and the operating system run here, providing regular computing functions but not guaranteeing the security of sensitive data. Compared to the REE, the TEE provides complete isolation at the physical space level of computing, ensuring that internal accounts do not compromise other tenants in a shared environment.

[0043] TEE and REE can run in parallel on a single core, ensuring security through hardware-enforced isolation. Running a complex software stack within an REE, including large application sets, complex operating systems (such as Linux), and potentially virtual machines (such as hypervisors), results in a larger and more complex stack with greater software exposure, leading to faster vulnerability discovery and thus greater vulnerability to attacks. Conversely, running a small and simple software stack within a TEE provides a secure environment. Trusted Applications (TAs) are applications running within the TEE that provide security services and handle sensitive operations such as encryption processes and secure communication. Trusted services deployed within a TEE are typically supported by a separate, lightweight kernel, providing functions such as key management, digital signatures, and encryption. TEE resources and data are accessible only to specific security services; REE software cannot access these resources.

[0044] The independent operating system deployed on the TEE side is called the TEE OS. The TEE OS employs a streamlined kernel design to reduce the attack surface and improve security, and supports secure task scheduling and context switching to ensure isolation between various security applications. Externally, the TEE OS provides controlled and restricted interfaces, interacting with the main operating system and applications through controlled APIs, and provides strict access control policies to ensure that only authorized entities can access specific resources, preventing and blocking unauthorized access.

[0045] Given that existing methods for managing network storage systems suffer from issues such as tenant resources being administrator-centric and resource isolation being limited to the software level, embodiments of this disclosure provide a hardware-isolated, highly secure solution for managing network storage systems. By utilizing an independent permission management model and a trusted execution environment, compared to existing technologies, it enables the super administrator to ensure that once a tenant resource is allocated and created, the tenant resource remains invisible to the super administrator from initialization to the end of the lease term. Furthermore, it elevates resource protection from the software level to the hardware level, minimizing the business exposure surface.

[0046] Example Environment

[0047] Figure 2 A schematic diagram of an example environment 200 in which embodiments of the present disclosure can be implemented is shown. It should be understood that... Figure 2 The environment 200 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the implementation described in this disclosure. Figure 2 As shown, the example environment 200 includes a network storage system 202, which may include a hardware-isolated Trusted Execution Environment (TEE) 204 and a Rich Execution Environment (REE) 206. In a multi-tenant scenario, the super administrator 208 has the authority to allocate and create tenant resources. The super administrator 208 can choose to create ordinary tenants or confidential tenants based on user needs, and generate corresponding tenant administrators (also known as tenant administrator accounts).

[0048] In this system, both regular tenants and confidential tenants use storage device 210 to actually store user resources. However, the keys, authentication credentials, lease time clocks, etc., of regular tenants are deployed on the REE 206 side, while the authentication and resource management of confidential tenants are deployed on the TEE 204 side. Furthermore, once a confidential tenant is created by the super administrator 208, the transfer of permissions from super administrator 208 to the confidential tenant administrator is completed. Even super administrator 208 cannot access the data and execution environment on the TEE side without the authorization mechanism and interface specifically set up by the TEE. Therefore, the privacy and security of confidential tenant data can be guaranteed.

[0049] Taking AI training and push tasks as an example, a large-scale network storage system cluster 202 can be deployed in the AI ​​training field, and the underlying hard disk resources (i.e., storage devices 210) of the storage system can be shared externally with tenants as management units. At this time, the super administrator 208 can create tenant units in the storage system cluster and generate tenant administrators capable of managing these units. If the created tenant unit is a confidential tenant, the super administrator 208 must transfer management permissions to the confidential tenant administrator, making the confidential tenant resources invisible to the super administrator 208 (and undeletable and unmodifiable). After configuring tenant shared access, the tenant administrator uploads the tenant's training data and the model to be trained to the storage file system. The computing cluster nodes access the file system through the mounted file system and the tenant's configured permission credentials to obtain training data and model data. The training and push containers then mount the training and model data for task training. When the tenant's independent clock exceeds the lease period initially configured by the super administrator 208, the tenant resources will be destroyed, erasing the hard disks used by the tenant and releasing the tenant's storage space back to the storage device.

[0050] In the above process, by utilizing an independent permission management model, once the super administrator of the storage device allocates and creates tenant resources, the tenant resources are invisible to the super administrator from the initial initialization to the end of the lease term. Furthermore, hardware-level data isolation is achieved using a trusted execution environment. Compared to traditional solutions where tenant resources are centered on the device administrator and resource isolation is limited to the software level, the embodiments of this disclosure can center tenant resources on the data holder and elevate resource protection from the software level to the hardware level, minimizing the business exposure surface.

[0051] Managing network storage systems

[0052] The following is for reference Figures 3 to 8 Embodiments of this disclosure are further described below.

[0053] Figure 3 A schematic flowchart of a process 300 for managing a network storage system according to an embodiment of the present disclosure is shown. It should be understood that method 300 may also include additional actions not shown and / or the actions shown may be omitted, and the scope of the present disclosure is not limited in this respect.

[0054] like Figure 3 As shown in box 310, method 300 creates a confidential tenant and a corresponding confidential tenant administrator on the network storage system. Specifically, the super administrator of the network storage system can initiate the confidential tenant creation process based on system quotas in the management view. During the creation phase, the super administrator can configure the generation of confidential tenant keys, authentication credentials, lease time clocks, etc., and deploy them to the TEE environment of the network storage system.

[0055] In some embodiments, to further enhance the security of confidential tenants, each confidential tenant supports only one confidential tenant administrator by default. Furthermore, the maximum number of confidential tenant administrators allowed to log in simultaneously for the same confidential tenant is one. In some embodiments, if an initial confidential tenant administrator has not logged in for an extended period exceeding the default time since the confidential tenant's creation, the confidential tenant resources can be proactively released and reclaimed to ensure the confidential tenant's security.

[0056] In box 320, method 300 transfers the management authority of the confidential tenant from the super administrator of the network storage system to the confidential tenant administrator, making the confidential tenant invisible to the super administrator. This allows the centralization of confidential tenant resources to be shifted from the super administrator to the data holder.

[0057] Upon initial login authentication, the confidential tenant administrator can be redirected to a separate confidential tenant management view to manage confidential tenant resources during the lease term. This disclosure does not restrict the authentication method for confidential tenant administrators, including but not limited to graphical user interface (GUI) authentication and command-line interface (CLI) authentication.

[0058] In some embodiments, within the confidential tenant authentication and authorization management, a separate login authentication view, isolated from the regular tenant authentication interface, can be provided for confidential tenants. Upon successful authentication, the user is redirected to the confidential tenant management view. After successful authentication via the management interface or CLI, a confidential tenant role is assigned by default, and a confidential tenant management view is provided to avoid permission confusion. In some embodiments, a separate confidential tenant resource identifier can be provided, granting independent permission objects to the storage pools, file systems, protocols, and network devices assigned to the confidential tenant, distinguishing them from regular tenant roles. Furthermore, after entering the confidential tenant view, tenant resources are managed according to the confidential tenant administrator's role and permissions.

[0059] In some embodiments, confidential tenant authentication is implemented based on Pluggable Authentication Modules (PAM). PAM is a framework for implementing authentication and authorization, providing applications with a set of common authentication interfaces that allow administrators to flexibly configure authentication methods according to their needs. Compared to ordinary authentication methods, PAM supports multiple authentication mechanisms, which can be flexibly combined according to requirements, and has rich security-related modules to implement various security control policies. In a multi-tenant environment, the data and permissions of different tenants need to be strictly isolated. To ensure the security and independence of each tenant, a tenant-specific authentication and authorization mechanism needs to be implemented in the system. Deploying the PAM module in a TEE can leverage the security features of the TEE to ensure that the tenant authentication process and sensitive data are processed in an isolated and secure environment.

[0060] An exemplary PAM-based authentication and authorization process is as follows: Step 1. User Request: The tenant user enters authentication information (such as administrator username and password) on the storage confidential tenant login interface; Step 2. PAM Capture: The front-end message interface captures the authentication request and passes the information to the PAM Authentication Trusted Application (TA) within the TEE; Step 3. Processing within the TEE: The authentication TA verifies the user's identity and checks permissions within the TEE; Step 4. Result Return: The authentication result is returned to the previous message processing module, which returns a success or failure result for the user's session. Notably, authentication can support password hash verification to prevent plaintext password storage.

[0061] In some embodiments, after initial identity verification, the confidential tenant administrator starts a lease time clock, which can be deployed in the TEE (Transfer Execution Environment) of the network storage system. To ensure the lease time clock is not subject to human interference, a combined clock update can be used, comparing a software timer deployed on the TEE side with the TEE clock, independent of the system clock. In this way, while the super administrator can adjust the system clock, they cannot modify the independently deployed clock. Confidential tenants are not visible to the super administrator until the lease time clock expires. Upon lease time clock expiration, the confidential tenant administrator's management privileges over the confidential tenant can be terminated.

[0062] In some embodiments, the lease time clock for confidential tenants can be initialized by a TEE cluster security clock, which is stored in the cluster database by default. Optionally, the frequency is updated every 10 seconds in memory and every minute on disk, and the clock data can be encrypted and written to disk using a globally shared key (PSK). It should be understood that the update and disk writing frequencies of the lease time clock can have different settings.

[0063] When the lease expires, the confidential tenant administrator's management privileges over the confidential tenant are terminated. For example, the confidential tenant can be destroyed based on the self-destruct configuration preset by the super administrator when the confidential tenant resource was first created (once configured, it cannot be modified). When the confidential tenant's lease is about to expire, the confidential tenant administrator can also request an extension from the super administrator.

[0064] The self-destruction process for confidential tenants is as follows: 1. Verify that the self-destruction access conditions are met; 2. Check if the confidential tenant's lease period has expired. If so, enable the manual destruction switch for the confidential tenant; 3. Check the health status of the main modules in sequence and obtain the module health status list; 4. Send a tenant destruction confirmation alarm within the default time before destruction; 5. Back up the confidential tenant's policy configuration; 6. Disable confidential tenant management login and set the allowed number of online users for confidential tenant login to 0; 7. Uninstall all network devices under the confidential tenant; 8. Delete all open ports under the confidential tenant; 9. Delete the firewall configuration policy of the confidential tenant; 10. Delete all policies and snapshot configurations under the confidential tenant; 11. Delete all external links under the confidential tenant, including but not limited to Active Directory (AD), Lightweight Directory Access Protocol (LDAP), etc.; 12. Delete all file system shares; 13. Delete all file systems; 14. Execute the data destruction task for the storage pool to which the confidential tenant belongs; 15. Delete all backup configurations of the confidential tenant; 16. Destroy all independent keys of the confidential tenant; 17. Display the destruction execution result.

[0065] In addition to pre-setting a self-destruct configuration when a confidential tenant is created, the super administrator can also manually configure the destruction process during the lease term. Once manual destruction is configured, this configuration cannot be changed within the lease term. In this case, after the confidential tenant's lease expires, the super administrator will manually trigger the release of the expired resources. After the manual destruction process of the confidential tenant is triggered, the execution process is consistent with that of automatic destruction. In addition to manual and automatic destruction, within the lease term, the confidential tenant administrator can also proactively initiate a destruction request, which will be approved by the super administrator and then executed, with the execution process being consistent with that of automatic destruction.

[0066] Figure 4 A schematic diagram of the structure of a confidential tenant management model 400 according to an embodiment of the present disclosure is shown. Figure 4 As shown, in response to a user request, the super administrator 402 can create a confidential tenant 404 and a regular encrypted storage pool 408. Then, the super administrator 402 can allocate the regular encrypted storage pool 408 to the confidential tenant 404 and initialize it to obtain a confidential storage pool 410, and generate a confidential tenant administrator 406 corresponding to the confidential tenant 404. Preferably, the confidential tenant 404 and the confidential tenant administrator 406 can be matched one-to-one. The confidential tenant administrator 406 can then manage the confidential storage pool 410, for example, by creating a file system 412, for further resource utilization.

[0067] Once created, confidential tenant 404 is invisible to super administrator 402, and super administrator 402 cannot manage confidential tenant administrator 406 (e.g., change its password). For example, confidential tenant administrator 406 can gain sole administrative privileges over confidential tenant 404 by forcibly changing its password after initial authentication. Similarly, the operation logs of confidential tenant administrator 406 regarding confidential tenant 404 are also invisible to super administrator 402.

[0068] In some embodiments, after initializing and generating the confidential storage pool 410, the confidential tenant 404 can also generate authentication keys for all hard drives in the confidential storage pool 410 based on the cluster shared key. These authentication keys are stored by the confidential tenant key management module created by the TEE. The cluster shared key is mainly used for secure communication between storage nodes, data encryption, and node authentication. Specifically, the TEE can first generate an initial shared key, for example, using a hardware-secure random number generator to ensure key strength. Then, the generated shared key can be encrypted using the hardware physical key of each storage node and stored in a distributed database, restricting access to the key to a designated TA application on the TEE side. In scenarios involving the creation, scaling, and reduction of the storage cluster, the TEE can also support the secure distribution of the shared key. (See the following reference.) Figure 5 The key distribution process will be described further.

[0069] Figure 5 A schematic diagram of a cluster shared key distribution process 500 according to an embodiment of the present disclosure is shown. Figure 5 As shown, storage node 502 (also known as the "master storage node") needs to distribute keys to storage node 504 (also known as the "node to be joined"). At this point, communication is initiated internally by the TEE and completed via a channel with the REE. The main processes include a registration callback function phase, a key negotiation phase, a secure communication phase, and a key distribution phase. In the registration callback function phase, the TEE uses the REE's communication channel. The TA (Transaction Agent) and the Certificate Authority (CA) are logically decoupled. The TA triggers communication independently without the CA's awareness; that is, a proxy module within the TEE completes the communication, and the TA only needs to focus on the business logic itself. In the key negotiation phase, nodes negotiate session keys using the device certificate contained within the TEE (e.g., using the ECDH key exchange algorithm) and establish a secure channel through TA certificate authentication.

[0070] In some embodiments, the storage node 504 to be joined proactively communicates with the master storage node 502 and sends a key synchronization request. The master storage node 502 encrypts the cluster shared key PSK using the negotiated session key and sends it to the storage node 504, thereby achieving key distribution. The key distribution process may include, at the master storage node 502 of the network storage system, decoupling the TA and CA using the communication channel between the TEE and REE, and determining the session key based on the device certificate of the TEE. At the storage node 504 to be joined, a key synchronization request is sent to the master storage node 502 based on the secure communication channel established through the CA of the TA. In response to receiving the key synchronization request, the master storage node 502 encrypts the cluster shared key based on the session key and sends it to the storage node 504 to be joined.

[0071] Figure 6 A schematic diagram of the internal modules of an execution environment 600 according to an embodiment of the present disclosure is shown. Figure 6 As shown, the network storage system includes hardware-independent TEE and REE environments. The various functional modules for confidential tenants are deployed on the TEE side and independently published as TA applications, thereby improving the security of confidential tenants. The following will provide a detailed description of several key functional modules within the TEE.

[0072] The Confidential Tenant Lease Management application provides complete confidential tenant lease management functionality on the TEE side. It is designed to run within the TEE, securely managing confidential tenant lease information, ensuring tenant data and access permissions are protected during the lease term, and taking appropriate measures after lease expiration to guarantee system security and compliance. Specifically, the Confidential Tenant Lease Management (TA) application can include the following sub-functions: Lease Creation, allowing administrators to set lease terms for new confidential tenants, including start and end dates; Lease Query, providing tenants and administrators with the ability to query the current lease status, including remaining days and expiration date; Lease Expiration Processing, automatically restricting tenant access permissions after lease expiration to prevent unauthorized operations; Lease Renewal and Approval, allowing tenants to submit renewal applications when their leases are about to expire, which administrators can view, review, and approve or reject; and Independent Secure Clock for Confidential Tenants, providing granular clock management for confidential tenants.

[0073] The built-in authentication management service for confidential tenants provides built-in confidential tenant administrator account authentication, permission verification, and temporary credential verification on the TEE side. Built-in passwords, critical identity credentials, and sensitive data of confidential tenants are all hardware-level securely isolated through the TEE, and all data written to disk is encrypted and stored using the shared key of the TEE cluster.

[0074] The confidential tenant key management application can include the following sub-functions: confidential tenant storage pool key management, encompassing the entire lifecycle management of encrypted disk keys deployed in the storage pool belonging to a confidential tenant, including generation, deletion, updating, and backup; and confidential tenant storage pool root hardware protection, ensuring that the confidential tenant-level root key remains within the storage system's TEE security hardware scope even under multi-level key hierarchical management conditions. Furthermore, during storage cluster creation and scaling, shared keys can be generated and securely distributed by the TEE. When a confidential tenant's storage pool has multiple storage nodes, keys can be protected within the cluster through a shared key mechanism within the TEE cluster.

[0075] The confidential tenant message management application on the TEE side establishes a secure, encrypted channel with the REE side to receive external authentication request messages from the REE's message broker. The message management application supports message scheduling, session management, and task management. Each time a request connection is established from the outside, a session context is generated, data packets are parsed, key message content is read, and the resource request is forwarded to the confidential tenant resource management application.

[0076] The confidential tenant resource management application, upon obtaining the confidential tenant administrator's identity, is responsible for creating, modifying, deleting, and querying tenant resources such as network logical interfaces, NAS shares, LUN resources, snapshots, management policies, and third-party link management (e.g., AD, LDAP) under the confidential tenant. Confidential tenant resource management also handles the creation, modification, deletion, and querying of security policies such as file system whitelists, certificate management, and user mapping. Confidential tenant resources are stored in an external distributed configuration database using the TEE cluster shared key PSK. Synchronized tenant data is shared by the master node to other nodes. In the storage cluster, when the cluster master node experiences hardware or software failure, the other nodes will re-elect a cluster master node through arbitration. The newly elected master node will then replicate the takeover of the confidential tenant resource change service, process the resource changes, and then synchronize with other nodes.

[0077] The confidential tenant resource management application supports adding several logical network interface types, distinguished by logical management interfaces and logical data interfaces. The management network interface is used for confidential tenant management login, supporting GUI / CLI / RESTful API interfaces, and allows firewall configuration of these interfaces. The logical data interface supports Network Storage Protocol (NFS) or other custom network storage protocols. The firewall enables corresponding firewall rules based on the tenant's protocol settings, and provides custom firewall rules for enabling and disabling firewall rules for specific logical interface types.

[0078] The confidential tenant resource management application also provides confidential tenant-level GUI and CLI views and supports RESTful API management. Resources visible only to confidential tenants can be managed within the confidential tenant view, as shown in the table below:

[0079]

[0080] The mount management application, based on different versions of the NFS protocol, has different implementation processes. When using NFSv3 and earlier versions, the client sends a mount access request upon its first mount attempt. After the REE-side NFS listening service checks the confidential tenant special identifier held in the extended field of the access header, the request is forwarded to the mount management application inside the TEE to process the file system mount request. If the mount request is determined to originate from an invalid IP address or to hold an incorrect mount credentials field, the mount management application rejects the mount attempt.

[0081] Because NFSv4 has restructured the protocol, integrating the mounting process into the main protocol, a separate mounting daemon or mounting protocol is no longer needed. Therefore, NFSv4 requires clients to configure an independent confidential tenant authentication extension library that meets the Remote Procedure Call Security-General Security Service (RPCSEC_GSS) protocol. This library configures a separate confidential tenant identifier in the access request and establishes a secure channel session with the TEE-side mounting management using Transport Layer Security (TLS) by reading the user-configured certificate. After the session connection is established, the handle can be obtained through corresponding lookup operations.

[0082] Exemplary apparatus and implementation

[0083] Figure 7 A schematic block diagram of an apparatus 700 for managing a network storage system according to an embodiment of the present disclosure is shown. The apparatus 700 may be implemented in example environment 200. The apparatus 700 includes a confidential tenant creation unit 710 and a permission management unit 720. The confidential tenant creation unit 710 is configured to create a confidential tenant and a corresponding confidential tenant administrator on the network storage system; the permission management unit 720 is configured to transfer the management permissions of the confidential tenant from the super administrator of the network storage system to the confidential tenant administrator, so that the confidential tenant is invisible to the super administrator.

[0084] In some embodiments, the confidential tenant administrator may be configured with authentication credentials, which may be deployed in the trusted execution environment of the network storage system, and the apparatus 700 may also include an identity verification unit configured to verify the identity of the confidential tenant administrator based on the authentication credentials.

[0085] In some embodiments, the apparatus 700 may further include a confidential tenant destruction unit configured to destroy a confidential tenant in response to the confidential tenant administrator failing to perform initial identity verification within a preset time threshold.

[0086] In some embodiments, the apparatus 700 may further include a lease clock unit configured to start a lease clock in response to an initial identity verification by a confidential tenant administrator. The lease clock is deployed in a trusted execution environment of the network storage system, wherein the confidential tenant is not visible to the super administrator if the lease clock has not expired.

[0087] In some embodiments, the lease clock unit can also be configured to terminate the confidential tenant administrator's management privileges over the confidential tenant in response to the expiration of the lease clock.

[0088] In some embodiments, the confidential tenant may also include a self-destruct configuration preset at creation, and the lease clock unit may also be configured to destroy the confidential tenant based on the preset self-destruct configuration.

[0089] In some embodiments, the apparatus 700 may further include a cluster shared key unit configured to generate a cluster shared key for a confidential tenant in a trusted execution environment of a network storage system; and to generate an authentication key for a hard disk in an encrypted storage pool based on the cluster shared key in response to the confidential tenant creating an encrypted storage pool, the authentication key being managed by a trusted application in the trusted execution environment.

[0090] In some embodiments, the cluster shared key unit may also be configured to distribute the cluster shared key from the primary storage node of the network storage system to the storage node to be joined in response to the presence of a storage node to be joined in the network storage system.

[0091] In some embodiments, the cluster shared key unit can also be configured to decouple trusted applications and certificate authorities by the trusted execution environment of the network storage system using the communication channels of the rich execution environment of the network storage system; determine a session key based on the device certificate in the trusted execution environment; send a key synchronization request from the storage node to be joined to the master storage node of the network storage system based on a secure communication channel established through the authentication certificate of the trusted application; and have the master storage node of the network storage system encrypt the cluster shared key based on the session key and send it to the storage node to be joined.

[0092] In some embodiments, a confidential tenant may include a unique resource identifier, and the apparatus 700 may also include a confidential tenant identification unit configured to forward a mount request message to the trusted execution environment of the network storage system for processing in response to detecting that the extended field of the mount request message includes a resource identifier on the rich execution environment side of the network storage system.

[0093] Figure 8 A schematic block diagram of an example device 800 that can be used to implement embodiments of the present disclosure is shown. As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 802 or loaded from storage unit 806 into random access memory (RAM) 803. Various programs and data required for the operation of device 800 may also be stored in RAM 803. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0094] Multiple components in device 800 are connected to I / O interface 805, including: input unit 806, such as a touchscreen, keyboard, mouse, etc.; output unit 807, such as various types of displays (e.g., interactive displays, such as touchscreens), speakers, etc.; storage unit 808, such as a disk, optical disk, etc.; and communication unit 809, such as a network interface card (NIC), modem, wireless transceiver, etc. Communication unit 809 allows device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0095] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as method 300. For example, in some embodiments, method 300 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of method 300 described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform method 300 by any other suitable means (e.g., by means of firmware).

[0096] This disclosure can be a method, apparatus, system, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of this disclosure.

[0097] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0098] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0099] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0100] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0101] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0102] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0103] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0104] Various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical applications, or improvements to the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for managing a network storage system, comprising: Create a confidential tenant and a confidential tenant administrator corresponding to the confidential tenant on the network storage system; as well as The management privileges of the confidential tenant are transferred from the super administrator of the network storage system to the confidential tenant administrator, so that the confidential tenant is not visible to the super administrator.

2. The method of claim 1, wherein the confidential tenant administrator is configured with authentication credentials, the authentication credentials are deployed in the trusted execution environment of the network storage system, and the method further comprises: The identity of the confidential tenant administrator is verified based on the authentication credentials.

3. The method according to claim 1, further comprising: If the confidential tenant administrator fails to perform initial identity verification within a preset time threshold, the confidential tenant is destroyed.

4. The method according to claim 1, further comprising: In response to the confidential tenant administrator performing an initial identity verification, a lease time clock is started. The lease time clock is deployed in the trusted execution environment of the network storage system, wherein the confidential tenant is not visible to the super administrator if the lease time clock has not expired.

5. The method according to claim 4, further comprising: In response to the expiration of the lease clock, the confidential tenant administrator's management privileges over the confidential tenant are terminated.

6. The method according to claim 5, wherein the confidential tenant further includes a self-destruct configuration preset at creation, and terminating the confidential tenant administrator's management privileges over the confidential tenant includes: Based on the preset self-destruct configuration, the confidential tenant is destroyed.

7. The method according to claim 1, further comprising: Generate the cluster-shared key for the confidential tenant in the trusted execution environment of the network storage system; as well as In response to the confidential tenant creating an encrypted storage pool, an authentication key for the hard disks in the encrypted storage pool is generated based on the cluster shared key, and the authentication key is managed by a trusted application in the trusted execution environment.

8. The method according to claim 7, further comprising: In response to the presence of a storage node to be added in the network storage system, the primary storage node of the network storage system distributes the cluster shared key to the storage node to be added.

9. The method of claim 8, wherein distributing the cluster shared key from the primary storage node of the network storage system to the storage nodes to be joined comprises: The trusted execution environment of the network storage system utilizes the communication channels of the rich execution environment of the network storage system to decouple trusted applications and certificate authorities; Determine the session key based on the device certificate in the trusted execution environment; Based on the secure communication channel established through the authentication certificate of the trusted application, the storage node to be added sends a key synchronization request to the main storage node of the network storage system; as well as The primary storage node of the network storage system encrypts the cluster shared key based on the session key and sends it to the storage node to be joined.

10. The method of claim 1, wherein the confidential tenant includes a unique resource identifier, and the method further comprises: In response to the detection that the extended field of the mount request message includes the resource identifier on the rich execution environment side of the network storage system, the mount request message is forwarded to the trusted execution environment of the network storage system for processing.

11. An apparatus for managing a network storage system, comprising: The confidential tenant creation unit is configured to create a confidential tenant and a confidential tenant administrator corresponding to the confidential tenant on the network storage system. as well as The access control unit is configured to transfer the management permissions of the confidential tenant from the super administrator of the network storage system to the confidential tenant administrator, so that the confidential tenant is not visible to the super administrator.

12. An electronic device, comprising: processor; as well as A memory storing one or more computer instructions, which, when executed by the processor, cause the electronic device to perform the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having stored thereon one or more computer instructions, wherein the one or more computer instructions are executed by a processor to cause the processor to perform the method according to any one of claims 1 to 10.

14. A computer program product comprising machine-executable instructions that, when executed by a device, cause the device to perform the method according to any one of claims 1 to 10.

Images