Cache-Free Security Handling in Protection Storage Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current protection storage systems, such as those using the Data Domain Operating System (DDOS), face challenges in managing security information updates across distributed components, including caching consistency issues, locking performance penalties, and inefficient chain propagation of updates, which compromise security and isolation requirements in multi-tenancy environments.
Innovation Solution
Implementing a protection storage operating system that eliminates caching, locking, and chain propagation by allowing each component to maintain independent security information and build fresh sets for every operation, using locking-free algorithms and eliminating chain propagation to ensure security information freshness and correctness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If caching security information is implemented in distributed components, then access speed is improved, but cache consistency problems arise across the network
Solution Approach 1:
The patent extracts the caching mechanism entirely from the system. Instead of maintaining caches in distributed components, the invention uses on-demand fetching of security information from the object store, eliminating cache consistency problems while maintaining security information availability.
Solution Approach 2:
The patent introduces an intermediary mechanism where security information is stored centrally in the object store and fetched on-demand. This intermediary approach allows distributed components to access security information without maintaining local caches, ensuring consistency while enabling fast access through efficient retrieval mechanisms.
2Reliability
If locking mechanisms are used for security information updates, then correctness is ensured, but prohibitive performance penalties are introduced
Solution Approach 1:
The patent extracts the locking mechanism from the security information update process. By using version numbers and conditional update logic, the system ensures correctness without requiring locks, thereby avoiding performance penalties while maintaining data integrity.
Solution Approach 2:
The patent implements self-service update validation where each component checks version numbers and update conditions independently before applying security information updates. This self-validation mechanism ensures correctness without centralized locking, enabling parallel updates and maintaining high performance.
3Reliability
If chain propagation of updates is implemented, then security information freshness is maintained, but delays and correctness requirements are introduced
Solution Approach 1:
The patent extracts the chain propagation mechanism and replaces it with version number-based validation. Components independently verify security information freshness by checking version numbers, eliminating propagation delays while ensuring all components have current security information.
Solution Approach 2:
The patent implements preliminary version number assignment when security information is created or updated in the object store. This preliminary action allows components to verify freshness without waiting for propagation, as the version number inherently indicates the current state of security information.
4Productivity
If security information is cached in distributed components, then access efficiency is improved, but cache consistency problems and update complexities arise
Solution Approach 1:
The patent removes the caching layer entirely, accessing security information directly from the object store when needed. This extraction eliminates cache consistency problems and update complexities while maintaining access efficiency through direct retrieval and efficient storage formats.
Data Source
AI summary
A native protection storage operating system (PSOS) process receives a request specifying an operation having security related implications for elements in the PSOS having a first set of components handling data transfer operations and a second set of components handling configuration operations. A security component stores an identifier of the requester and a security related information element locally within a storage location of the first or second set of components, and accesses, upon receiving the request, the security related information element and requester identifier to match other elements of the network impacted by the request, and performs a security condition specific check to determine whether or not the request is to be allowed or denied. The native process eliminates a need for caching, locking, and chain propagation of the security related information through the PSOS.