Namespace Access Control for Shared Virtual-Machine Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices lack effective mechanisms to block malicious access attempts without valid authority, compromising data security when virtual machines share storage resources.
Innovation Solution
Implementing a security policy in the storage device that includes an access authority controller to verify the validity of access requests by decoding and comparing them against stored security information, aborting unauthorized access attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If storage device is shared by multiple hosts and virtual machines, then resource utilization and accessibility are improved, but security vulnerability increases due to lack of access authority control
Solution Approach 1:
The storage device is segmented into multiple namespaces, with each namespace having specific access authorities assigned to different virtual machines. The access authority controller segments the access control process by verifying VM identities and comparing them against stored security information for each namespace, enabling fine-grained security control while maintaining shared access capability.
Solution Approach 2:
An access authority controller is introduced as an intermediary component between the virtual machines and the storage namespaces. This controller receives access requests, decodes VM identities, compares them against stored security information, and determines whether to grant or deny access, thereby mediating security control in the shared storage environment.
2Reliability
If access authority control is implemented in storage device, then data security is improved, but device complexity increases due to additional control mechanisms
Solution Approach 1:
The access authority controller is designed as a universal security module that handles access control for multiple namespaces and virtual machines through a single standardized verification process. It performs multiple functions including identity decoding, security information storage, comparison operations, and access determination, thereby providing comprehensive security control without proportionally increasing complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A storage device for performing an access authority control and an operating method thereof are disclosed. The storage device including processing circuitry configured to store a plurality of security information associated with the plurality of namespaces in response to a command from the host, each of the security information including virtual machine information associated with a corresponding one of the plurality of virtual machines and unique information associated with the corresponding virtual machine, the virtual machine information including an identifier for the corresponding virtual machine, and the unique information including unique information uniquely set for the corresponding virtual machine, extract at least first information by decoding a data access request received from the host device, and abort processing of the data access request based on the security information and the extracted at least one first information.