Bare-Metal Storage Network Isolation via MUX-VLAN and ACLs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud platforms, bare-metals in a storage network can intercept data intended for another bare-metal, leading to security risks and data leakage, particularly in multi-tenant scenarios where secure connections are challenging to establish.
Innovation Solution
A bare-metal connection storage method and system that separates bare-metals using multiplex virtual local area networks (MUX-VLAN) and access control lists (ACLs) to prevent interconnections between them, ensuring each bare-metal communicates only with the storage device, and implementing CHAP authentication for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bare-metals are connected to the storage device in a storage network, then data access is enabled, but data interception and leakage occur
Solution Approach 1:
The patent applies segmentation by dividing the storage network into separate virtual channels for different bare-metals using VLAN tagging and MUX-VLAN technology. Each bare-metal is assigned to a specific VLAN, creating isolated data paths that prevent cross-tenant data interception while maintaining storage access capabilities.
Solution Approach 2:
The patent introduces an intermediary mechanism through the MUX-VLAN switching layer between bare-metals and the storage device. This intermediary selectively forwards packets based on VLAN identifiers, allowing each bare-metal to access the storage device through its designated virtual channel while blocking access for other bare-metals.
2Adaptability or versatility
If multiple bare-metals share the same storage network, then resource sharing is achieved, but security isolation is compromised
Solution Approach 1:
The patent segments the shared storage network into multiple isolated virtual networks using VLANs. Each tenant's bare-metals are confined to their own VLAN, enabling multi-tenancy while maintaining strict security isolation. The physical storage device remains shared, but the logical access paths are separately segmented.
Solution Approach 2:
The patent adds a virtual dimension to the physical storage network by introducing VLAN tags and MUX-VLAN identifiers. This dimensional extension allows multiple bare-metals to coexist in the same physical network infrastructure while being logically separated through additional identification layers, achieving both sharing and isolation.
3Reliability
If VLAN and subnet separation is implemented, then data isolation is improved, but network complexity increases
Solution Approach 1:
The patent makes the MUX-VLAN switching mechanism universal by implementing it at the existing network switch layer, which handles both traditional switching and VLAN-based isolation functions. This multi-functional approach avoids adding separate dedicated isolation hardware, reducing overall system complexity while maintaining effective data isolation.
Data Source
AI summary
A bare-metal connection storage method includes establishing a storage network, where the storage network includes a plurality of bare-metals, an access switch, a core switch, and a storage device. The plurality of bare-metals are coupled to the access switch, the access switch is coupled to the core switch, and the core switch is coupled to the storage device. The method configures the storage network, so that each of the plurality of bare-metals is coupled to the storage device.