Proxy Node Credential Verification for Shared Storage Security

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Data centers face security risks due to client nodes being vulnerable to online attacks, which can compromise security measures and allow malware to access shared storage systems, compromising data integrity.

Innovation Solution

Implementing proxy nodes between client nodes and shared storage systems, which are not directly controlled by operating systems or software on client nodes, to act as intermediaries for accessing storage, thereby reducing the vulnerability to online attacks and enhancing security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If client nodes directly access shared storage systems, then ease of operation is improved, but security reliability deteriorates due to vulnerability to online attacks and malware compromises

Engineering Contradiction:
Improveease of access to shared storageVSAvoidsecurity reliability
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

A proxy node is introduced as an intermediary between the client node and the shared storage system. The proxy node receives requests from the client node, verifies credentials against credential data stored in a data structure, and forwards authorized requests to the storage system. This mediator architecture maintains ease of operation for legitimate users while blocking malicious access attempts, thus resolving the security reliability issue without sacrificing operational convenience.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If security measures are implemented on client nodes, then security reliability is improved, but vulnerability to compromise increases due to targeted online attacks and malware

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidvulnerability to online attacks
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

Security verification functionality is extracted from the client node and relocated to the proxy node. The credential data and verification logic are stored and executed on the proxy node rather than on the client node. This extraction removes the security-critical components from the attack surface, making it difficult for malware on client nodes to compromise security measures while maintaining strong security reliability.

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If credential verification is performed at the storage system level, then security reliability is improved, but access efficiency deteriorates due to additional verification steps

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidaccess efficiency
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

Credential verification is performed in advance by the proxy node before requests are forwarded to the storage system. The proxy node maintains credential data in a data structure and verifies client credentials upfront, establishing authorization status before storage operations begin. This preliminary verification ensures security reliability while preventing repeated verification overhead during storage access operations, thus maintaining access efficiency.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS20240406172A1Techniques for verifying credentials when accessing shared storage
Publication Date: 2024.12.05 NVIDIA CORP
  • US20240406172A1 patent drawing
  • US20240406172A1 patent drawing
  • US20240406172A1 patent drawing

AI summary

In various embodiments, a filter application filtering requests to access a storage system. The filter application receives credential data from a scheduling server and a first request from a first compute node. The filter application determines that the first request is authorized based on a first user identifier associated with the first request, a first node identifier associated with at least one of the first compute node or the first request, and the credential data. The filter application causes a file server to perform at least one operation at a first location within the storage system in accordance with the first request.