CAPI Adapter Extent Granularity Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for block device authorization outside of an Operating System (OS)/File System (FS) lack an effective mechanism to securely manage data access in Coherent Accelerator Processor Interface (CAPI) adapters, leading to potential unauthorized access to sensitive data.
Innovation Solution
Implementing a block extent granularity authorization model using an authorization table and file system authorization function within the CAPI adapter, which authenticates data access at an extent granularity and prevents unauthorized access by utilizing a CAPI server register space to define client authorization for specific ranges of Logical Block Addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If CAPI adapter bypasses OS/FS for direct data access, then I/O operation efficiency is improved, but data access security deteriorates
Solution Approach 1:
The patent introduces an intermediary authorization mechanism between the CAPI adapter and the data storage system. The adapter includes an authorization table that mediates access requests, verifying client credentials and permissions before allowing data access. This intermediary layer maintains the high-speed direct access path while inserting security verification, resolving the contradiction between efficiency and security.
Solution Approach 2:
The patent segments the storage access control into multiple levels: client-level authorization (identifying individual clients), extent-level authorization (dividing storage into manageable segments with specific permissions), and function-level authorization (controlling specific operations). This segmentation allows fine-grained security control without blocking the entire I/O path, maintaining efficiency while enhancing security.
2Reliability
If traditional OS/FS authorization is used, then data access security is maintained, but host CPU resource consumption increases
Solution Approach 1:
The CAPI adapter performs self-service authorization by incorporating the authorization table and authentication logic directly within the adapter hardware. The adapter independently verifies client credentials and access permissions without requiring continuous CPU intervention. This self-service capability maintains strong security while significantly reducing host CPU resource consumption compared to traditional OS/FS-based authorization.
3Device complexity
If block device authorization is implemented at LUN level, then authorization coverage is simplified, but data protection granularity deteriorates
Solution Approach 1:
The patent applies segmentation by dividing the storage address space into extents, which are smaller units than entire LUNs. Each extent can be independently authorized, allowing fine-grained data protection. This segmentation maintains manageable complexity through a hierarchical authorization structure while providing the precise granularity needed for selective data protection.
Data Source
AI summary
A method, system and computer program product are provided for implementing block extent granularity authorization model processing in Coherent Accelerator Processor Interface (CAPI) adapters. The CAPI adapter includes an authorization table and a file system authorization function to authenticate data access for a client at an extent granularity and to prevent an application from accessing unauthorized data in the CAPI adapter. Each authorization table entry provides for the CAPI client, a CAPI client identification (ID), a CAPI server register space assigning resource ownership to the CAPI client with a CAPI set of allowed functions.