NVMe-oF Authentication via Centralized Verification Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing NVMe-oF authentication systems face security issues due to the need for authenticator devices to store secrets of all responder devices, leading to potential compromises and management challenges that limit scalability.
Innovation Solution
A centralized authentication verification engine is introduced that verifies responses from NVMe host devices using their stored secrets, allowing each NVMe entity to be provisioned with only its associated secret, and establishing secure communication channels without relying on shared secrets or public key certificates, thus enabling scalable and manageable authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authenticator devices store secrets of all responder devices, then authentication verification can be performed, but security risk increases and scalability is limited
Solution Approach 1:
The patent extracts the secret storage function from the authenticator device and places it solely in the responder device. The authenticator device no longer stores any secrets, instead receiving authentication data from the responder device and performing verification without having the secrets locally. This extraction eliminates the security risk of secret compromise in authenticators while maintaining authentication capability.
Solution Approach 2:
The patent introduces authentication data as an intermediary mechanism. The responder device generates authentication data based on its stored secret and a challenge, then transmits this data to the authenticator device. The authentication data serves as a mediator that allows verification without requiring the authenticator to store the actual secret, thus resolving the contradiction between verification capability and security risk.
2Reliability
If authenticator devices store secrets of all responder devices, then authentication can be verified, but management complexity increases and scalability is limited
Solution Approach 1:
The patent extracts the secret storage responsibility from the authenticator device and concentrates it solely in the responder device. This extraction simplifies the authenticator's management burden, as it no longer needs to securely store, manage, or update secrets for multiple responder devices. The authenticator only needs to handle challenge generation and authentication data verification, significantly reducing management complexity.
Solution Approach 2:
The patent segments the authentication function into distinct components: the responder device holds the secret and generates authentication data, while the authenticator device receives challenges and verifies authentication data. This segmentation allows each device to have a simplified, focused role, improving scalability and reducing management complexity compared to the traditional model where authenticators must manage all secrets.
3Object-affected harmful factors
If each NVMe entity is provisioned with only its associated secret, then security is enhanced and scalability improves, but authentication verification becomes more complex
Solution Approach 1:
The patent introduces authentication data as an intermediary that bridges the gap between simplified secret storage and verification capability. The responder device uses its single stored secret to generate authentication data in response to a challenge, and the authenticator device verifies this authentication data without needing the secret. This intermediary mechanism allows each entity to hold only its own secret while maintaining verification capability.
Solution Approach 2:
The patent implements preliminary action by having the responder device pre-compute and store only its own secret, and pre-establish the capability to generate authentication data when challenged. The authenticator device is pre-configured with verification algorithms. This preliminary setup eliminates the need for complex runtime secret management while enabling straightforward verification processes.
Data Source
AI summary
An NVMe-oF authentication system includes an authentication verification entity coupled to an NVMe subsystem that is coupled to an NVMe host device. The NVMe subsystem transmits a first challenge to the NVMe host device and, in response, receives a first challenge reply from the NVME host device. The NVMe subsystem then generates a first authentication verification request communication that includes a first response that was provided in the first challenge reply by the NVMe host device using a first instance of a first secret that is stored in the NVMe host device, and transmits the first authentication verification request communication to the authentication verification entity. The authentication verification entity receives the first authentication verification request communication, verifies the first response using a second instance of the first secret that is stored in the authentication verification entity and, in response, transmits a first authentication verification response communication to the NVMe subsystem.