Host Access Control Agent for Secure Raw Storage I/O
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage systems face performance degradation due to file server intervention in frequent I/O operations and lack granular security, especially in geographically distributed storage grids where traditional access control mechanisms are vulnerable to hacking.
Innovation Solution
An access control agent is deployed at the host device to filter and validate user requests at a granular level, using access control information from a coupled source to ensure only authorized access to shared storage, thereby preventing malicious access while allowing direct host access to raw storage devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file servers control host access to storage devices, then security and access control are improved, but storage performance deteriorates due to reduced I/O speed and increased latency
Solution Approach 1:
The patent segments access control into two layers: file-level access control handled by the file server and block-level access control handled by the storage array. This segmentation allows hosts to perform direct block I/O operations to storage devices without file server intervention, improving performance while maintaining security through the file server's ability to control which blocks are accessible.
Solution Approach 2:
The patent introduces a block device mapper as an intermediary component that sits between the host and the storage array. This mapper translates host I/O requests into storage array commands while enforcing access control policies, thereby mediating between the performance requirements of direct host access and the security requirements of file-level access control.
2Productivity
If direct host access to raw storage devices is permitted, then storage performance is improved, but security deteriorates due to increased potential for malicious data access
Solution Approach 1:
The patent implements preliminary access control by establishing file-level access control policies before hosts can access storage blocks. The file server pre-authenticates hosts and determines which blocks they can access, creating a security barrier before direct block I/O operations occur. This preliminary action ensures that even though hosts have direct storage access, they can only reach authorized blocks.
Solution Approach 2:
The patent changes the parameter of access control granularity from traditional file-level only to a combination of file-level and block-level control. By modifying how access control is implemented (using block device mappers and LUN masking), the system enables direct host access while maintaining security through multi-parameter access control validation.
3Ease of operation
If LUN masking is used for access control, then host-level security is implemented, but granular data protection deteriorates because all LUN data becomes accessible to authorized hosts
Solution Approach 1:
The patent segments the access control hierarchy into multiple levels: file system level, block device level, and physical LUN level. This segmentation allows simultaneous implementation of host-level LUN masking for ease of operation and fine-grained block-level access control for data protection granularity. Each segment operates at a different level of abstraction, providing both simplicity and precision.
Solution Approach 2:
The patent adds another dimension to access control by introducing block-level control alongside traditional host-level LUN masking. Instead of relying solely on the host-level dimension, the system adds a block-level dimension that provides finer granularity. This multi-dimensional approach allows hosts to be authorized at the LUN level while individual blocks within those LUNs can have more restrictive access controls.
4Device complexity
If traditional WWN/LUN masking security constructs are used, then host authentication is simplified, but security deteriorates in geographically distributed storage grids vulnerable to hacking
Solution Approach 1:
The patent introduces file servers and block device mappers as intermediary components between hosts and storage arrays. These intermediaries enforce access control policies and validate host authorization before allowing direct block I/O operations. This intermediary layer adds security validation without significantly increasing authentication complexity, as the file server already manages host authentication and the mapper enforces block-level policies.
Solution Approach 2:
The patent implements preliminary security validation by requiring file servers to authenticate hosts and determine block access rights before hosts can perform direct I/O operations. This preliminary authentication and authorization step occurs before the actual data access, ensuring that even in geographically distributed environments, hosts must be properly authorized to access specific blocks, thereby preventing hacking and malicious access.
Data Source
AI summary
An access control agent is advantageously deployed at a host device to prevent malicious use of a storage system by unauthorized hosts and users. In one embodiment the access control agent is disposed in a processing path between the application and the storage device. An application is mounted as an image file by a loop device to provide a virtual file system. The virtual file system is populated with access control information for each block of the file. Application I/O requests are mapped to physical blocks of the storage by the loop device, and the access control information is used to filter the access requests to preclude unauthorized requests from being forwarded to the storage client (and consequently the storage devices). With such an arrangement, access rights can be determined at I/O accesses, file and block granularity for each user.