SAN Access Control via Login Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control methods for storage appliances become complex and inefficient as the number of logical units and clients increases, requiring knowledge of client identities and frequent access checks, which complicates data access in storage area networks.
Innovation Solution
Implementing a controlled discovery mechanism that uses shared secrets for access to each logical unit, eliminating the need for client identification knowledge and reducing access checks to each command, thereby simplifying access control and reducing network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mapping techniques are used for access control, then access security is maintained, but system complexity increases as the number of logical units and clients increases
Solution Approach 1:
The patent extracts the access control decision-making process from the storage appliance and relocates it to the initiator. Instead of the storage appliance maintaining complex mapping tables of clients to logical units, the initiator now determines access rights locally based on target identifiers. This removes the complex mapping mechanism from the storage system while preserving access security through authentication protocols.
Solution Approach 2:
The patent inverts the traditional access control model by reversing who performs the access decision. Conventionally, the storage appliance decides whether to grant access based on client identity and mapping tables. The patent reverses this by having the initiator decide access based on target identifiers and authentication credentials, fundamentally changing the control flow and eliminating the need for complex storage-side mapping.
2Reliability
If mapping techniques are applied on a per command basis, then access control is enforced, but processing efficiency decreases
Solution Approach 1:
The patent implements preliminary authentication and access decision-making during the connection establishment phase rather than on every command. The initiator authenticates to targets and determines access rights upfront, storing this information for subsequent operations. This preliminary action eliminates the need for repeated access control checks on each command, significantly improving processing efficiency while maintaining security.
3Reliability
If the storage appliance stores mapping information for all clients, then access control is possible, but memory requirements and processing overhead increase
Solution Approach 1:
The patent extracts the client identification and mapping information requirements from the storage appliance. Instead of storing comprehensive mapping tables, the storage system only maintains target identifiers and authentication credentials. The initiator assumes responsibility for tracking access rights and client identities, dramatically reducing the storage appliance's memory requirements and processing overhead.
Data Source
AI summary
A method for accessing data in a storage area network is provided. The method initiates with receiving a request for a list of targets on the storage area network. All the targets on the storage area network are exposed to the requestor and authentication requiring a password is requested from the requestor to grant access to the targets on the storage are network. Access to the targets is granted if the password is acceptable, and access to the targets is refused if the password is unacceptable.