Storage Array Process Authentication Using SCSI Metadata Tags
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems lack effective mechanisms to protect data from unauthorized processes, allowing unprivileged applications or processes to access and manipulate storage arrays, which can lead to data corruption or malware propagation.
Innovation Solution
Implementing a storage array configuration system that utilizes application identifiers in metadata fields of command messages to verify the legitimacy of processes, ensuring only authorized applications can access and manipulate data, using SCSI protocol messages with App Tag fields to authenticate processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud computing systems allow multiple applications to access storage arrays, then system productivity and scalability are improved, but data security and protection from unauthorized processes deteriorates
Solution Approach 1:
The patent segments storage access rights by creating separate access control mechanisms for different applications. Each application is assigned unique identifiers and access permissions that are validated before data access, allowing multiple applications to coexist while preventing unauthorized access. This segmentation enables high productivity through multi-application support while maintaining data security through granular access control.
2Adaptability or versatility
If storage arrays accept commands from multiple processes, then device versatility and adaptability are improved, but the risk of malware propagation and data corruption increases
Solution Approach 1:
The patent implements preliminary validation actions before data access is permitted. Application identifiers are verified against authorized lists, and access permissions are validated in advance. This preliminary action ensures that only legitimate applications can access the storage array, preventing malware propagation while maintaining versatility for multiple authorized applications.
Solution Approach 2:
The patent introduces an intermediary validation layer between applications and the storage array. This intermediary mechanism (access control system) mediates all data access requests by verifying application identifiers and permissions before allowing access. This mediator enables device versatility for multiple applications while blocking harmful factors like malware that lack proper authentication.
3Reliability
If application identifiers are validated in metadata fields, then data protection from unauthorized access is improved, but command message processing complexity increases
Solution Approach 1:
The patent makes the metadata field universal by using it for multiple purposes: storing application identifiers, enabling authentication, and controlling access permissions. This multi-functional use of the metadata field provides strong data protection without requiring separate complex validation structures, thus limiting the increase in processing complexity.
4Reliability
If strict access control validation is implemented, then data security is improved, but system performance and command execution speed deteriorates
Solution Approach 1:
The patent performs access control validation as a preliminary action before data access is allowed. By validating application identifiers and permissions upfront, the system ensures security without requiring continuous complex validation during data transfer operations, thus maintaining command execution speed while improving data security.
Data Source
AI summary
A storage array is configured with an allowed process configuration. An allowed process may correspond to an application or process executed by a host computing system that may seek to access a volume of the storage array via a command descriptor block message or a corresponding block command message, which may comprise a data field and a metadata field. The host may embed a process identifier corresponding to a process seeking to access the storage array in the metadata field. The storage array may receive the block command message and determine whether the metadata field comprises a process identifier that is included in the allowed process configuration. If so, the storage array may perform the access command corresponding to the block command message. If not, the storage array may reject performing the access command. The storage array may report access commands that were performed or rejected.