Storage Access Control Using Dual Security Protocols During Upgrades
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional storage systems lack robust authentication and authorization protocols, leading to limited functionality and the need for costly system shutdowns during upgrades to enhance security, which disrupts user access to existing volumes.
Innovation Solution
Implementing an API-level access control method with ownership objects and a 'guest' role for anonymous users, allowing seamless integration and continued access during upgrades, while managing access rights through an authentication and authorization module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If storage systems implement the same access management as gatekeepers, then security is improved, but system shutdown and reboot is required which causes loss of access and operational disruption
Solution Approach 1:
The system performs preliminary actions by creating a guest role and configuring access control lists before the security upgrade is completed. This allows users without tokens to already have access permissions in place before the upgrade, preventing service interruption. The ACLs are pre-configured to include the guest role, so when the upgrade occurs, access management is already prepared and no shutdown is needed.
Solution Approach 2:
The guest role acts as an intermediary between authenticated users and the storage system resources. By introducing this intermediate access level, the system can maintain access for users during the security upgrade process. The guest role mediates access control decisions, allowing the system to transition to a more secure state without completely blocking existing access patterns.
2Adaptability or versatility
If storage systems implement robust authentication and authorization protocols, then access control capability is improved, but device complexity increases
Solution Approach 1:
The access control system is segmented into distinct components: an authentication module that validates tokens, an authorization module that determines permissions, and a guest role that handles anonymous access. This segmentation allows each component to be independently managed and optimized, reducing overall system complexity while maintaining robust access control capabilities.
Solution Approach 2:
The access control system is designed to be universal by supporting multiple access scenarios through a single framework. The same authentication and authorization modules handle both authenticated users with tokens and anonymous users without tokens. The system can manage volume access, file access, and advanced operations like snapshotting and migration through the same access control mechanism, reducing the need for separate systems for different functions.
Data Source
AI summary
An example storage system concurrently uses, during a transition state, two different security protocols to control access to resources of the storage system. A first security protocol controls access to the resources of the storage system for a first set of access requests that include a token identifier. A second security protocol controls access to the resources of the storage system for a second set of access requests that do not include a token identifier.