Cloud-Authenticated Storage Array Management via Local Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage array management systems face security concerns due to the need for two-way communication with cloud services providers, which can compromise security if the cloud provider is compromised, and require complex authentication and authorization processes across wide and local area networks.
Innovation Solution
A system where a client-side array services module receives authentication tokens from a cloud-based security module over a wide area network and manages storage arrays solely through local area network communications, using these tokens with management instructions to perform storage array management tasks, thereby isolating communication within the local area network and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two-way communication with cloud services providers is implemented for storage array management, then authentication and authorization capabilities are improved, but security risk increases due to potential cloud provider compromise
Solution Approach 1:
The system divides authentication and authorization functions into two separate components: a cloud-based security module that handles only authentication (verifying credentials and issuing tokens), and a local array services module that handles authorization (managing storage arrays using received tokens). This segmentation isolates the critical authentication function to a secure cloud environment while keeping authorization local, reducing the security surface exposed to cloud provider risks.
Solution Approach 2:
The patent introduces tokens as an intermediary mechanism between the cloud-based security module and the local array services module. The token serves as a secure credential that proves authentication without requiring continuous communication with the cloud provider. This intermediary allows the local module to verify authority independently, eliminating the need for two-way communication and reducing security risks associated with cloud provider compromise.
2Reliability
If cloud-based security module is used for authentication, then authentication security is improved, but communication complexity increases due to wide area network requirements
Solution Approach 1:
The system performs authentication in advance through the cloud-based security module before local storage array management begins. The cloud module verifies credentials and issues tokens beforehand, allowing the local array services module to operate independently using these pre-validated tokens. This preliminary authentication action eliminates the need for continuous cloud communication during local management operations, reducing communication complexity while maintaining security.
3Adaptability or versatility
If continuous cloud communication is maintained for storage array management, then centralized control is improved, but security exposure increases due to wide area network vulnerabilities
Solution Approach 1:
The system creates a copy of the authentication credential in the form of a token that is issued by the cloud-based security module and then used locally by the array services module. This token copy contains all necessary authorization information without requiring connection to the original cloud system. The local module can manage storage arrays using this token copy, maintaining centralized control authority while eliminating continuous wide area network communication and associated security exposures.
Data Source
AI summary
Managing a storage system, including: receiving, over a first network, user credentials associated with an access request to a storage system; sending, over a second network to a cloud-based security module, the user credentials; receiving, over the second network from the cloud-based security module, a token representing that the user credentials were successfully authenticated by the cloud-based security module; and sending, over the first network to the storage system, the token with a management instruction, wherein the storage system is not coupled for data communications to the cloud-based security module.