Host Identity Validation via Encrypted Test Strings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In storage networks, host systems can be impersonated by spoofing entities using their identity, leading to unauthorized access and data security breaches, as the existing systems lack effective mechanisms to validate the authenticity of host systems.
Innovation Solution
Implementing a trusted host facility (THF) with cryptographic techniques, such as asymmetric key pairs, to establish and maintain trust between host systems and storage systems, using a hardware-encrypted module (HEM) or one-time programmable (OTP) cells to secure private keys and validate host identities through encrypted test strings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If host systems are allowed to access storage systems without validation, then ease of operation is improved, but security and reliability deteriorate due to impersonation risks
Solution Approach 1:
The storage system performs validation of the host system before allowing access to logical storage units. The host system is prompted to validate itself by reading a test string from the storage system, encrypting it with its private key, and sending the encrypted test string back. This preliminary validation action ensures that only authentic host systems can access data, preventing impersonation while maintaining operational security.
2Reliability
If cryptographic validation is implemented, then security and reliability are improved, but device complexity increases due to key management requirements
Solution Approach 1:
A trusted host facility (THF) is introduced as an intermediary component within the host system to manage cryptographic keys. The THF generates and stores private keys, and interfaces with the storage system using public keys. This intermediary structure separates the complexity of key management from the main host system operations, making the validation process more manageable while maintaining strong security through asymmetric cryptography.
Data Source
AI summary
Trust may be maintained between a storage system and a host system by the host system validating its identity to the storage system. The storage system may instruct the host system to validate itself by setting a validation flag on the storage system. The host system may be configured to determine whether the validation flag is set. If the host system determines that the validation flag is set, the host system then may read a test string from the storage system. The host system may encrypt the test string using a private key, and send the encrypted test string to the storage system. The storage system may decrypt the encrypted string using a public key it previously received from the host system. The decrypted test string then may be compared against the original test string generated by the storage system.