Fiber Channel Command Tokens for Storage Array Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication and authorization techniques in Fibre Channel Protocol (FCP) and Small Computer System Interface (SCSI) communication lack robust security measures, allowing unauthorized devices to spoof legitimate host bus adapters (HBAs), leading to potential data manipulation and security vulnerabilities.
Innovation Solution
Embedding authentication tokens, such as Json Web Tokens (JWTs), directly within command messages to authenticate and authorize commands at the storage array level, eliminating the need for a separate authentication server and ensuring each command is validated for authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used in FCP/SCSI communication, then device complexity is reduced, but security reliability deteriorates allowing unauthorized spoofing
Solution Approach 1:
The patent merges authentication and authorization functions directly into the storage array device, eliminating the need for external authentication servers. The authentication token is embedded within the existing FCP/SCSI command structure, combining security functionality with the data transfer protocol without requiring separate communication channels or additional hardware components.
Solution Approach 2:
The storage array performs self-authentication by validating authentication tokens embedded in incoming commands. The system serves its own authentication needs by maintaining authorized device identifiers and comparing them against tokens presented by connecting devices, eliminating dependence on external authentication infrastructure.
2Reliability
If authentication tokens are embedded in each command message, then security reliability improves, but data transfer speed deteriorates due to validation overhead
Solution Approach 1:
Authentication tokens are validated at the beginning of each command processing cycle, before the actual data transfer operation. This preliminary authentication ensures security compliance is checked in advance, allowing subsequent data transfer operations to proceed without repeated validation overhead for each data block.
Solution Approach 2:
The authentication token embedded in the command message serves multiple functions simultaneously: it authenticates the source device, authorizes the specific command operation, and provides session validation. This multi-functionality consolidates multiple security checks into a single validation process, minimizing performance overhead.
3Reliability
If multi-factor authentication is implemented at the storage array level, then security reliability improves, but device complexity increases
Solution Approach 1:
The patent combines multiple authentication factors (device identifier, command-specific authorization, and session validation) into a single integrated authentication token structure. This token is embedded within the existing FCP/SCSI command format, merging multi-factor authentication functionality with the data transfer protocol without requiring separate authentication hardware or complex external verification systems.
Data Source
AI summary
An identifier, such as a worldwide name, corresponding to a host computing device, or corresponding to a host bus adapter corresponding to the host computing device, may be transmitted to a storage array to configure the storage array to be accessed by the host computing device. The host may request a token from the array. The host may embed the token into a token block of a command message that is transmitted to the storage array requesting access to the array. Before performing an action corresponding to the command message, the storage array may verify that the token is a valid token and thus that the host computing device that transmitted the command message is a host computing device that has been authorized to access the storage array. If the storage array determines that the token is valid the storage array may perform an action corresponding to the command message.