MPIO Driver Process Authorization for Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-virus techniques, typically implemented at a file system level, are ineffective in detecting security threats where hackers modify or add processes to access sensitive data in storage systems, as they cannot prevent unauthorized processes from accessing storage devices.
Innovation Solution
A multi-path layer with a multi-path input-output (MPIO) driver is configured to control IO operations by maintaining an access table that specifies permitted processes for each storage device, determining the process generating each IO operation, and selectively allowing or blocking access based on this information to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-virus techniques are implemented at file system level, then file-level security is provided, but they cannot detect or prevent unauthorized processes from accessing storage devices
Solution Approach 1:
The patent moves security checks from the file system level to the I/O operation level in the multi-path layer. By examining I/O operations before they reach the file system, the system can detect and block unauthorized processes at an earlier stage, preventing them from accessing storage devices entirely rather than relying on file-level permissions.
Solution Approach 2:
The system performs security verification in advance by checking process authorization against stored access control information before allowing I/O operations to proceed. This preliminary check occurs in the multi-path layer before data reaches the file system, proactively blocking malicious processes rather than reacting to file-level violations.
2Reliability
If the MPIO driver implements process-level access control by storing and checking process information for each storage device, then security against unauthorized access is improved, but system complexity increases
Solution Approach 1:
The MPIO driver automatically performs process identification and authorization checks using information already available in the I/O operation context. The system self-manages the security verification process by comparing process identifiers against stored access control tables without requiring external intervention for each I/O operation, reducing the perceived complexity despite the enhanced security functionality.
Solution Approach 2:
The MPIO driver combines multiple functions into a single component: it manages multi-path I/O operations, performs process identification, executes security verification, and controls access to storage devices. By consolidating these functions in the multi-path layer, the system achieves comprehensive security without adding separate complex security subsystems.
Data Source
AI summary
An apparatus comprises a host device configured to communicate over a network with a storage system comprising a plurality of storage devices. The host device is further configured to execute multiple processes that generate input-output (IO) operations for delivery to the storage system. The host device comprises a multi-path input-output (MPIO) driver configured to store for each of one or more of the storage devices information specifying one or more of the processes executing on the host device that are permitted to access that storage device, and for each of at least a subset of the IO operations, to determine the particular storage device to which the IO operation is directed, to identify the process that generated the IO operation, and to control delivery of the IO operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device.