NFS Mount Point Cryptographic Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing NFS protocols expose backup metadata and images to unauthorized access, posing security risks as competitors can easily access sensitive data via the well-implemented NFS protocol.
Innovation Solution
A method that uses a shared secret as part of the mount point to provide controlled access to NFS shares by generating cryptographic values k1 and k2, where k1 is embedded in the path to secure access and k2 is used for secure unmounting, ensuring only authorized users can access and disconnect from the NFS share.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If NFS protocol is used to share backup data, then data accessibility and ease of operation are improved, but security and protection from unauthorized access deteriorate
Solution Approach 1:
The patent segments the backup data into two separate NFS exports: one containing only the backup catalog (metadata) and another containing only the backup images (data). This segmentation ensures that even if one export is compromised, the other remains protected, and neither export alone provides complete access to the backup system. The segmentation is implemented by creating distinct directory structures and NFS share configurations.
Solution Approach 2:
The patent introduces an intermediary mechanism - a special authentication directory with restricted access controls that acts as a gateway between the NFS client and the backup data. This intermediary enforces additional security checks and requires specific authentication credentials, preventing unauthorized direct access to the backup catalog and images while maintaining legitimate access paths.
2Ease of operation
If backup metadata and images are exposed via NFS protocol, then ease of operation for authorized users is improved, but security risks increase as competitors can easily access sensitive data
Solution Approach 1:
The patent divides the backup data structure into separate NFS exports - one for catalog metadata and another for backup images. This segmentation ensures that authorized users need appropriate credentials for each segment, while competitors would need to compromise both segments simultaneously to gain complete access, significantly increasing the security barrier.
Solution Approach 2:
The patent applies different access control policies and authentication mechanisms to different parts of the backup system. The catalog export uses one set of security parameters while the images export uses another, allowing tailored security measures for each data type. This local quality approach maintains operational ease for authorized users with proper credentials while imposing stricter security where needed.
Data Source
AI summary
Providing authentication of users accessing an NFS shared file system. A shared secret is used as a component of the mount point used to access the NFS share. Upon receiving a request to access to the data in the NFS share, the process creates at least one cryptographic value and then creates a path to the mount point which incorporates the cryptographic value. The process then creates the mount point at the path, e.g., /PATH:k1, where k1 is the cryptographic value. Creation of the mount point is preferably performed using NFS protocol semantics, without requiring any changes to the NFS protocol semantics. A second cryptographic value, k2, may be used for unmounting the mount point.