Storage Array Access Security via Digital Signature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for managing storage services are vulnerable to compromise by untrustworthy host bus adapters (HBAs), which can lead to exposure of sensitive information to malicious entities.
Innovation Solution
The system implements a method where hosts verify the authenticity of responses from storage arrays using digital signatures and hash values, ensuring that only trusted responses are used for accessing storage services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hosts communicate with storage arrays using host bus adapters without verification, then storage services are easily accessible, but the system becomes vulnerable to compromise by untrustworthy HBAs and exposure of sensitive information
Solution Approach 1:
The system performs preliminary authentication actions by verifying digital signatures and hash values of responses from storage arrays before the host uses them. This preliminary verification ensures that only authenticated and un tampered responses are processed, preventing compromise by untrustworthy HBAs while maintaining a relatively simple overall architecture.
Solution Approach 2:
The patent introduces digital signatures and hash values as intermediary verification mechanisms between the storage array and the host. These cryptographic intermediaries enable the host to verify the authenticity and integrity of responses without requiring direct trust in the HBA, thus enhancing security while keeping the system architecture manageable.
2Reliability
If the system implements verification of responses using digital signatures and hash values, then the security against compromised HBAs is improved, but the processing time and computational overhead increase
Solution Approach 1:
The system performs verification of critical authentication elements (digital signatures and hash values) rather than exhaustive verification of all data. This partial verification approach provides sufficient security against compromised HBAs while minimizing the time and computational overhead associated with full verification processes.
3Object-affected harmful factors
If hosts verify authenticity of storage array responses, then sensitive information is protected from unauthorized access, but the ease of operation for accessing storage services is reduced
Solution Approach 1:
The host performs self-verification of response authenticity using digital signatures and hash values included in the responses. This self-service authentication mechanism protects sensitive information from malicious entities while maintaining ease of operation, as the verification process is automatically integrated into the existing storage service access workflow without requiring additional user actions or complex procedures.
Data Source
AI summary
Methods and systems for securing access of storage array services are disclosed. The storage array services may be secured by responding to an inquiry from the host bus adapter of a host with a payload. The contents of the payload may require authentication by the host to enable access to the storage array. The contents of the payload may include one or more messages and a digital signature. The digital signature may be signed with a private key from the storage array and verified with a public key from the host. The messages may be authenticated using the digital signature and/or other messages in the payload. Should the any of the contents of the payload be unable to be authenticated by the host, the host bus adapter may be remediated for hardware errors of malicious activity.