Proxy Node Credential Verification for Shared Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers face security risks due to client nodes being vulnerable to online attacks, which can compromise security measures and allow malware to access shared storage systems, compromising data integrity.
Innovation Solution
Implementing proxy nodes between client nodes and shared storage systems, which are not directly controlled by operating systems or software on client nodes, to act as intermediaries for accessing storage, thereby reducing the vulnerability to online attacks and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If client nodes directly access shared storage systems, then ease of operation is improved, but security reliability deteriorates due to vulnerability to online attacks and malware compromises
Solution Approach 1:
A proxy node is introduced as an intermediary between the client node and the shared storage system. The proxy node receives requests from the client node, verifies credentials against credential data stored in a data structure, and forwards authorized requests to the storage system. This mediator architecture maintains ease of operation for legitimate users while blocking malicious access attempts, thus resolving the security reliability issue without sacrificing operational convenience.
2Reliability
If security measures are implemented on client nodes, then security reliability is improved, but vulnerability to compromise increases due to targeted online attacks and malware
Solution Approach 1:
Security verification functionality is extracted from the client node and relocated to the proxy node. The credential data and verification logic are stored and executed on the proxy node rather than on the client node. This extraction removes the security-critical components from the attack surface, making it difficult for malware on client nodes to compromise security measures while maintaining strong security reliability.
3Reliability
If credential verification is performed at the storage system level, then security reliability is improved, but access efficiency deteriorates due to additional verification steps
Solution Approach 1:
Credential verification is performed in advance by the proxy node before requests are forwarded to the storage system. The proxy node maintains credential data in a data structure and verifies client credentials upfront, establishing authorization status before storage operations begin. This preliminary verification ensures security reliability while preventing repeated verification overhead during storage access operations, thus maintaining access efficiency.
Data Source
AI summary
In various embodiments, a filter application filtering requests to access a storage system. The filter application receives credential data from a scheduling server and a first request from a first compute node. The filter application determines that the first request is authorized based on a first user identifier associated with the first request, a first node identifier associated with at least one of the first compute node or the first request, and the credential data. The filter application causes a file server to perform at least one operation at a first location within the storage system in accordance with the first request.


