CAPI Adapter Extent Granularity Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for block device authorization in Coherent Accelerator Processor Interface (CAPI) adapters lack effective granularity, leading to unauthorized access and inefficient CPU usage in performing IO operations.
Innovation Solution
Implementing block extent granularity authorization processing by an Application Client requesting authorization from a system processor file system, which validates and assigns authorization handles for each extent, enabling secure and efficient access to block device resources through a CAPI Authorization manager and adapter.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If block device authorization uses out-of-band techniques such as zoning at block device or LUN granularity level, then authorization coverage is provided, but authorization granularity is too coarse and CPU overhead is high
Solution Approach 1:
The patent segments the block device into smaller units called extents, which are then used as the basis for fine-grained authorization. Each extent represents a specific range of blocks within a LUN, allowing authorization decisions to be made at the extent level rather than at the coarse LUN or device level. This segmentation enables precise control over which portions of storage can be accessed by different applications.
Solution Approach 2:
The patent implements local quality by assigning different authorization attributes to different extents within the same LUN. Each extent can have its own authorization handle that specifies which applications are permitted to access it. This allows different regions of the storage device to have different security policies and access controls tailored to local requirements.
2Productivity
If applications can build Read/Write commands directly to IOA bypassing OS/FS, then IO operation efficiency is improved, but security authentication is lost
Solution Approach 1:
The patent implements preliminary action by establishing extent-level authorization handles before applications can access storage resources. The file system determines the location of each extent comprising a file and requests authorization to each extent from the CAPI authorization manager in advance. This pre-established authorization framework allows applications to bypass the OS/FS authentication layer while maintaining security through pre-configured extent-level permissions.
Solution Approach 2:
The patent introduces an intermediary authorization mechanism that operates between the application and the storage device. The CAPI authorization manager and extent authorization handles serve as intermediaries that verify access permissions without requiring full OS/FS authentication. This intermediary layer enables direct application-to-device communication while maintaining security through extent-based authorization validation.
3Reliability
If traditional OS/FS authentication is used, then security is maintained, but CPU overhead for authentication increases
Solution Approach 1:
The patent extracts the authentication function from the traditional OS/FS path and relocates it to the CAPI authorization manager. By separating the authorization decision-making process from the main OS authentication stack, the system can validate extent authorization handles directly at the CAPI layer, eliminating the need for repeated OS/FS authentication checks and reducing CPU overhead while maintaining security.
Data Source
AI summary
A method, system and computer program product are provided for implementing block extent granularity authorization processing for a Coherent Accelerator Processor Interface (CAPI) adapter. An Application Client requests authorization to a File from a system processor file system. The file system validates the request, determines the location of each Extent that comprises the File, and requests authorization to each Extent from a System CAPI Authorization manager. The System CAPI Authorization manager requests the CAPI Client manager to assign a Child Client ID and CAPI Server Register range to the requesting Application Client and requests a previously authorized CAPI Parent Client to authorize the Child ID to the list of Extents. The CAPI Parent Client sends a Create Authorizations command to the CAPI Adapter via the Parent's CAPI Server Registers. The CAPI Adapter validates the Parent Authorization Handle and CPI Server Register range for the specific Extent/Command/Resource, and creates an Authorization List by assigning a new Child Authorization Handle for each requested, validated Extent/Command/Resource. The Authorization List and the Child Client ID are returned to the File System.