Two-Factor Authentication for Storage Control Path Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage systems are vulnerable to unauthorized access through compromised control paths, leading to potential data loss and corruption, with existing solutions being either costly or difficult to implement effectively.
Innovation Solution
Implementing two-factor authentication for control commands issued over the control path, using a pass code generated based on user-specific criteria, to ensure secure execution of commands on selected data storage entities, such as logical devices or snapshots, thereby preventing unauthorized access and data corruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two-factor authentication with pass codes is implemented for control commands, then security against unauthorized access is improved, but device complexity and ease of operation worsen
Solution Approach 1:
The authentication mechanism is segmented into distinct components: pass code generation (performed by the host system) and pass code validation (performed by the storage system). This segmentation allows each component to be optimized independently - the host generates pass codes based on its security policies, while the storage system only needs to validate them, reducing overall system complexity.
Solution Approach 2:
The pass code acts as an intermediary element between the host system and storage system authentication processes. Instead of requiring direct complex mutual authentication protocols, the host-generated pass code serves as a simplified mediator that carries authentication information through the control path, reducing the complexity of direct system-to-system verification.
2Reliability
If two-factor authentication with pass codes is implemented for control commands, then security against unauthorized access is improved, but ease of operation worsens
Solution Approach 1:
The pass code is generated in advance by the host system before the actual control command is executed. This preliminary generation of authentication credentials allows the subsequent command execution to proceed smoothly without requiring complex real-time authentication interactions, improving ease of operation while maintaining security.
Solution Approach 2:
The host system autonomously generates and manages its own pass codes based on its internal security policies and timing information. This self-service approach eliminates the need for the storage system to manage or generate pass codes, simplifying the storage system's operation while maintaining strong authentication capabilities.
3Reliability
If pass code validation is performed for each control command, then data integrity is improved, but productivity worsens due to additional processing time
Solution Approach 1:
The system applies pass code validation selectively - only for control commands that modify storage system operations, rather than for all possible commands. This partial application of authentication validation maintains data integrity for critical operations while minimizing the impact on overall system productivity by avoiding unnecessary validation overhead for routine operations.
Data Source
AI summary
Techniques are described providing secure authentication of control commands executed on a data storage system. A pass code may be generated in accordance with criteria in response to successful two-factor authentication of a user identifier. Providing a valid generated passcode may be required with a control command in order for a data storage system to execute the control command. The control command may be one of a subset of possible control command that may be performed with respect to storage entities, such as logical devices and snapshots thereof. In another embodiment, rather than providing a pass code, the two factor authentication information and user identifier may be provided with the control command whereby successful completion of two-factor authentication of the user identifier and two factor authentication information may be required in order to execute the control command.