CAPI Adapter Block Extent Authorization Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for block device authorization in Coherent Accelerator Processor Interface (CAPI) adapters lack effective mechanisms for block extent granularity authorization and deauthorization, leading to potential unauthorized access to data, especially in multi-tenant server systems where proprietary data from different competitors may be at risk.
Innovation Solution
A method and system that enables block extent granularity authorization and deauthorization processing for CAPI adapters by using a Delete Authorizations command sent by the Application Client through Client CAPI Server Registers, which validates the requesting client's authorization and deletes authorizations for specific extents and commands, utilizing CAPI Child Authorization Handles, Extent Start LBA, and number of Blocks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If CAPI technology is used to bypass OS/FS for direct application-to-adapter communication, then I/O operation efficiency is improved, but authentication and authorization security is worsened
Solution Approach 1:
The patent segments the storage address space into multiple extents, each with independent authorization handles. This allows fine-grained control where different applications can access different extents without needing OS involvement, maintaining both efficiency and security through per-extent authorization rather than system-wide access.
Solution Approach 2:
The patent introduces authorization handles as intermediary tokens that carry authorization information between applications and the adapter. These handles act as mediators that enable direct communication while maintaining security, as the adapter validates the authorization handles before granting access to specific extents.
2Reliability
If traditional OS/FS authentication is used, then data security is improved, but I/O operation complexity and host CPU involvement is increased
Solution Approach 1:
The patent performs authorization setup in advance by creating authorization handles that pre-encode access rights for specific extents. This preliminary action shifts the authentication burden from the host CPU during I/O operations to a pre-configured adapter mechanism, reducing operational complexity while maintaining security.
Solution Approach 2:
The adapter performs its own authorization validation using the authorization handles provided in commands, eliminating the need for continuous host CPU intervention in authentication. The adapter serves itself by validating authorization information directly, reducing host involvement and operational complexity.
3Ease of manufacture
If block device authorization is implemented at LUN level, then implementation simplicity is improved, but authorization granularity and data security is worsened
Solution Approach 1:
The patent divides the storage device into multiple extents at the block level, each capable of having its own authorization handle. This segmentation enables fine-grained authorization where individual blocks or groups of blocks can be independently controlled, providing both simplicity in implementation through a unified adapter mechanism and enhanced security through granular control.
Data Source
AI summary
A method, system and computer program product are provided for implementing block extent granularity authorization and deauthorization processing for a Coherent Accelerator Processor Interface (CAPI) adapter. The Application Client, such as an Application Child Client sends a Delete Authorizations command to the CAPI Adapter via the Client CAPI Server Registers assigned to the specific Application Client. The CAPI Adapter deletes the Authorizations in all Lists in the Delete Authorizations command.