Network Identity Authentication for Multi-Tenant Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional multi-tenant data storage systems lack effective security and isolation mechanisms, allowing unauthorized access when a hacker obtains administrator credentials, as they do not restrict access based on network identities, leading to potential data breaches and unauthorized configuration changes.
Innovation Solution
Implementing a network identity-based authentication and authorization mechanism that requires users to establish a connection through a predetermined network identity associated with a specific tenant-unit, stored in the SMT registry namespace, ensuring that only authorized access is granted by matching the logged-in network identity with the assigned identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional credential-based authentication is used, then ease of operation is improved, but security is worsened because hackers can access the system once they obtain administrator credentials
Solution Approach 1:
The authentication process is segmented into two independent verification stages: first verifying the user's login credentials (username/password), and second verifying the network identity (IP address) of the connecting device. Both verifications must succeed for access to be granted. This segmentation prevents hackers from using stolen credentials alone to gain access, as they cannot replicate the legitimate network identity.
Solution Approach 2:
The network identity (IP address) acts as an intermediary verification layer between the user's credentials and system access. Even with valid credentials, the system mediates access by checking whether the connection originates from an authorized network identity. This intermediary mechanism adds a security barrier that credentials alone cannot bypass.
2Productivity
If multi-tenant storage is implemented, then productivity is improved by sharing storage resources, but security is worsened due to insufficient isolation mechanisms between tenants
Solution Approach 1:
Each tenant-unit is assigned a unique, predetermined network identity that applies specifically to that tenant's data and access requirements. This local quality approach ensures that security rules are customized per tenant rather than applying uniform restrictions, allowing each tenant to have their own isolated access control policies while sharing the same storage infrastructure.
Solution Approach 2:
The system segments network access control by creating distinct network identity mappings for each tenant-unit. The SMT registry namespace maintains separate authentication rules for different tenants, ensuring that even though storage resources are shared, access control is segmented and isolated at the network identity level, preventing cross-tenant unauthorized access.
3Reliability
If network identity-based authentication is implemented, then security is improved by denying unauthorized access, but device complexity is worsened due to additional authentication requirements
Solution Approach 1:
The system automatically performs network identity verification by comparing the source IP address of incoming connections against the predetermined network identities stored in the SMT registry namespace. This self-service automation eliminates the need for manual intervention in the authentication process, reducing operational complexity despite the enhanced security checks. The system autonomously enforces the dual verification without requiring additional user actions.
Data Source
AI summary
In one embodiment, a request is received from a remote device of a user for configuring a tenant-unit of a storage system via a secure connection session. A secure multi-tenancy (SMT) module determines a first network identity associated with the secure connection session. The SMT module examines an SMT registry namespace associated with the tenant-unit of the tenant to determine a second network identity that has been assigned to the tenant-unit. The first network identity is compared with the second network identity. The request is allowed to configure the tenant-unit in response to determining that the first and second network identities match; otherwise, the request is denied.