Object Storage IP-Based Multifactor Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage systems lack effective mechanisms for securely managing access to data in object storage, particularly in scenarios where unauthorized access attempts involve spoofed IP addresses and credentials.
Innovation Solution
A data storage device that employs multifactor authorization based on associations between destination IP addresses, credentials, and requestor IP addresses, utilizing advertised IP addresses, UUID mappings, and a version-controlled cache to enhance security and reduce computational burdens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multifactor authorization is implemented based on destination IP address associations, then data security is improved, but device complexity increases
Solution Approach 1:
The system pre-establishes associations between destination IP addresses and data portions before access requests occur. This preliminary configuration enables rapid authorization decisions during data access without complex real-time analysis, resolving the contradiction by preparing security rules in advance.
Solution Approach 2:
The patent introduces an intermediary authorization mechanism that sits between the data storage and access points. This intermediary layer evaluates IP address associations and makes authorization decisions, simplifying the overall system architecture while maintaining high security standards.
2Reliability
If multifactor authorization with IP address verification is implemented, then unauthorized access prevention is improved, but computational requirements increase
Solution Approach 1:
IP address associations and authorization rules are pre-computed and stored before actual data access requests. This eliminates the need for complex real-time computational verification, reducing energy consumption during data access while maintaining strong unauthorized access prevention.
Solution Approach 2:
The system uses cached copies of authorization decisions and IP address associations rather than recomputing them for each access request. This copying approach significantly reduces computational energy requirements while maintaining security effectiveness.
3Ease of operation
If passive IP address information is leveraged for authorization, then user burden is reduced, but measurement precision requirements increase
Solution Approach 1:
The system automatically performs IP address verification and authorization checks without requiring user intervention or input. Users simply access data using their credentials, and the system handles the complex IP address matching in the background, reducing user burden while maintaining precise measurement through automated processes.
Data Source
AI summary
A data storage device includes advertised internet protocol (IP) addresses, a logical data storage, and a resource request processor. The logical data storage includes an object storage. The resource request processor obtains a data access request that includes a destination IP address and that requests a portion of data stored in the object storage. The resource request processor makes a determination to allow access to the portion of the data based on a multifactor authorization. The multifactor authorization is based, at least in part, on an association between the destination IP address and the portion of the data. In response to the determination, resource request processor provides the portion of the data to a requestor specified in the data access request.