Programmable Hardware Access Control for Multi-Tenant Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data storage systems face inefficiencies in managing access requests from multiple tenants with overlapping client IDs, leading to processing bottlenecks and security challenges in multi-tenancy environments.
Innovation Solution
A file system server apparatus with programmable hardware-implemented chips processes access requests by determining client and interface IDs, allowing or denying requests based on permitted ID sets, and utilizing autoinquiry and autoresponse mechanisms to enhance request processing efficiency and IOPS performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional software-based processing is used for access requests, then security checking can be performed, but processing efficiency and IOPS performance deteriorate due to CPU involvement
Solution Approach 1:
The patent replaces software-based CPU processing with hardware-based processing using programmable logic devices (FPGAs or ASICs). The access control logic is implemented in hardware circuits that can evaluate client IDs and interface IDs against permitted/prohibited ID sets without involving the main CPU, thereby maintaining security while dramatically improving processing throughput and IOPS performance.
Solution Approach 2:
The patent introduces a dedicated hardware processing unit as an intermediary between the network interface and the main CPU. This intermediary handles access control decisions by checking ID sets in hardware, filtering out prohibited requests before they reach the CPU, thus improving overall system efficiency while maintaining security enforcement.
2Productivity
If hardware-based processing is implemented, then processing efficiency improves, but device complexity increases
Solution Approach 1:
The patent designs the hardware processing unit with universal functionality to handle multiple types of access control operations. The same hardware circuit can evaluate different ID sets (client IDs, interface IDs, network IDs) against various permitted/prohibited combinations, making the hardware investment versatile and reducing the need for multiple specialized processing units.
Solution Approach 2:
The patent segments the access control function into a separate hardware module independent from the main CPU and storage subsystem. This segmentation allows the hardware unit to operate in parallel, handling ID verification without blocking other CPU tasks, thereby improving efficiency while containing complexity in a modular, manageable component.
3Reliability
If ID set evaluation is performed for every request, then security is maintained, but processing time increases
Solution Approach 1:
The patent performs preliminary organization of ID sets in hardware structures (such as lookup tables or associative memory) before requests arrive. Permitted and prohibited ID sets are pre-loaded and structured for rapid comparison, enabling the hardware unit to evaluate multiple IDs in parallel and quickly determine whether a request should be allowed or blocked, thus maintaining security while minimizing processing time.
Data Source
AI summary
The apparatus comprises a plurality of interfaces, each interface having an associated interface ID; and a hardware-side processing device including at least one programmable hardware-implemented chip configured to process request packets, which are received from host computers and relate to access requests to one or more file system managed by the apparatus, and to generate response packets for the processed request packets; wherein, for a request packet which is received from a first host computer, at least one programmable hardware-implemented chip is configured to: determine the client ID being associated with the first host computer, determine the interface ID being associated with the first interface, determine whether the determined client ID and interface ID represent a permitted ID set or a prohibited ID set, and refrain from processing the received request packet if the determined client ID and interface ID represent a prohibited ID set.