Cloud-Managed Storage Authentication Using Private-Domain SPU Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based management of enterprise storage systems is vulnerable to attacks, as attackers can compromise data using stolen credentials without access to the private domain.
Innovation Solution
Implementing a multi-factor authentication system where data access and management operations are restricted to authorized clients within the private domain, using administrator credentials and proof of access to physical components, along with unique private keys for each component to verify signed messages, ensuring that only legitimate administrators can execute storage operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud-based management is implemented for enterprise storage systems, then remote expert management capability is improved, but system security is worsened due to vulnerability to attacks with stolen credentials
Solution Approach 1:
A trusted component within the private domain acts as an intermediary between the cloud management service and the storage system. This component verifies instructions from the cloud service before execution, preventing unauthorized operations even if cloud credentials are compromised. The intermediary mediates the communication flow, adding a security layer that resolves the contradiction between remote management convenience and system security.
Solution Approach 2:
The patent implements local verification capabilities within the private domain by deploying authenticated components that can independently validate cloud service instructions. This local quality enhancement ensures that security decisions are made at the appropriate location (within the private domain), rather than relying solely on remote cloud-based authentication, thereby maintaining security while enabling remote management.
2Reliability
If multi-factor authentication is implemented requiring access to private domain components, then data security is improved, but system complexity is worsened
Solution Approach 1:
The trusted component within the private domain automatically performs verification of cloud service instructions without requiring manual intervention from administrators. The system self-services the authentication process by having the trusted component continuously verify instruction authenticity, reducing operational complexity while maintaining strong security through automated multi-factor verification.
3Reliability
If instructions must be relayed through private domain components for verification, then unauthorized access is prevented, but operation speed is worsened due to additional verification steps
Solution Approach 1:
The trusted component within the private domain performs preliminary authentication and verification of cloud service instructions before they reach the storage system. By conducting verification in advance, the system ensures that only authenticated instructions are processed, preventing unauthorized access while optimizing execution speed by avoiding repeated verification during operation.
Data Source
AI summary
A cloud management system (180) only instructs a storage platform (100) in a private domain to implement an operation that reveals, modifies, or destroys data if an administrator (163) both provides valid credentials and is able to direct a services processing unit or SPU (120) in the private domain to send a message with valid contents and signature. An SPU (120) only performs operations that reveal, modify, or destroy data if signed instructions from the cloud management system (180) have originated or been relayed through a component (120) in the private domain. An attacker with access to the cloud management system (180) that does not also have access to a component (120) in the private domain is prevented from tampering with the storage platform (100).