Shared Storage Proxy Access to Resist Malware Compromise
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers face security risks due to shared storage systems being vulnerable to online attacks, as malware can compromise security measures on client nodes, allowing unauthorized access and modification of data.
Innovation Solution
Implementing proxy nodes between client nodes and shared storage systems, which are not directly controlled by client operating systems, to indirectly access storage via these proxy nodes, reducing vulnerability to online attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If client nodes directly access shared storage systems, then storage access efficiency is improved, but security vulnerability increases as malware can compromise client nodes to read, modify, or delete data
Solution Approach 1:
The patent introduces a proxy node as an intermediary between client nodes and shared storage systems. The proxy node receives requests from client nodes, validates them against security policies, and forwards authorized requests to the storage system. This intermediary layer prevents direct access from potentially compromised client nodes while maintaining efficient storage access for legitimate users.
2Reliability
If security measures are implemented on client nodes, then data protection is improved, but system complexity increases due to multiple security layers and proxy nodes
Solution Approach 1:
The proxy node is designed to perform multiple functions: it acts as a security gateway for request validation, a data buffer for request/response handling, and a policy enforcement point for access control. By consolidating these functions into a single component rather than implementing separate security layers on each client node, the system achieves comprehensive data protection without proportionally increasing complexity.
3Object-affected harmful factors
If proxy nodes are introduced between client nodes and storage systems, then security against malware is improved, but storage access performance may deteriorate due to additional request routing steps
Solution Approach 1:
The proxy node performs security validation and policy checks in advance before requests reach the storage system. By pre-authenticating requests and pre-validating access rights at the proxy layer, the system avoids repeated security checks during data transfer, thereby maintaining fast access speeds while ensuring malware cannot circumvent security mechanisms.
Data Source
AI summary
In various embodiments, a proxy application processes requests to access a storage system. The proxy application receives a client request from a proxy driver executing on a client node. The client request is associated with a client buffer and a location within the storage system. The proxy application converts the client request to a proxy request that is associated with a proxy buffer and the same location within the storage system. The proxy application transmits the proxy request to a storage driver that is associated with the storage system. The storage driver causes a file server to perform at least one operation at the location in accordance with the proxy request.