Encryption Switch Authenticates VMs for Cloud Storage Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a multi-tenant public cloud environment, existing security mechanisms for data at rest are inadequate, as they rely on cloud providers for access control, are vulnerable to rogue agents, and complicate virtual machine mobility, leading to concerns about unauthorized access and configuration difficulties.
Innovation Solution
An encryption switch with a Cloud Credentials Service and a Cloud Crypto Agent is used to authenticate virtual machines for access to logical units of storage, employing protocols like DH-CHAP and TLS, ensuring only authorized VMs can access data through certificate-based authentication, with credentials securely managed within the VM and moving with it across hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control mechanisms (file system, zoning, LUN masking) are used, then access control is provided, but security is compromised in multi-tenant environments due to reliance on cloud provider infrastructure and vulnerability to rogue agents
Solution Approach 1:
The patent introduces an encryption switch as an intermediary device between the storage array and client VMs. This encryption switch performs authentication and encryption operations, acting as a mediator that secures the storage access path. The encryption switch verifies client certificates and manages encryption keys, preventing rogue agents from accessing data even if they compromise the cloud provider's infrastructure.
Solution Approach 2:
The patent replaces traditional mechanical access control mechanisms (zoning, LUN masking) with cryptographic authentication mechanisms. Instead of relying on infrastructure-level access controls that can be compromised, the system uses certificate-based authentication and encryption to verify client identity and protect data at rest, substituting physical/mechanical security with cryptographic security.
2Adaptability or versatility
If LUN masking is configured to allow full set of WWPNs for VM mobility, then mobility is enabled, but security perimeter is increased and access control is weakened
Solution Approach 1:
The patent implements dynamic authentication where client VMs present their certificates during the authentication handshake. The encryption switch dynamically verifies the certificate and establishes encryption parameters specific to that client. This dynamic approach allows VMs to move freely while maintaining strong access control, as the authentication is performed at the point of access rather than through static LUN masking configurations.
3Reliability
If certificate-based authentication is implemented, then security is improved, but device complexity increases due to additional authentication protocols and certificate management
Solution Approach 1:
The patent merges authentication and encryption functions into a single integration. The encryption switch performs both authentication (verifying client certificates) and encryption (using the verified client's key) in a unified process. This merging reduces the need for separate authentication systems and simplifies the overall architecture compared to having distinct authentication and encryption layers.
Data Source
AI summary
In embodiments according to the present invention an encryption switch is used to authorize access to LUNs from client VMs present in the cloud provider network. The encryption switch includes responder side software for an authentication protocol and an agent in the client VM includes the requestor side of the authentication protocol. The certificate of the client is securely provided to the encryption switch, which associates the client VM with the LUN. The client private key is securely provided to the client VM, which retains it only non-persistently. The client VM requests LUN access and performs an authentication handshake with the encryption switch. If successful the client VM than has access to the LUN. As the original certificate is linked to the client, if the client is itself a VM, should the client be moved to a different host, the certificate moves with it and LUN accessibility is maintained.