Storage Controller Session Key Enforcement for Container Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current generation container ecosystems face data security vulnerabilities when multiple software containers are executed across data storage devices, as once a zone is unlocked, it can be accessed by unauthorized processes through spoofing or imitation, leading to potential data breaches.
Innovation Solution
A data storage system with a controller circuit and non-volatile memory (NVM) allocates a unique session key to each software container, valid for a predetermined time period, which is used to authorize access commands, ensuring that only valid tokens can transfer data between the NVM and host devices, and maintains an internal session log for auditing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple software containers are executed across data storage devices, then productivity is improved through concurrent container execution, but security reliability deteriorates due to spoofing and imitation attacks on unlocked zones
Solution Approach 1:
The patent segments the storage device into multiple zones, with each zone dedicated to a specific software container. This segmentation isolates container data and access paths, preventing spoofing attacks from affecting other containers. Each zone has its own access control list (ACL) and session key validation, ensuring that even if one zone is compromised, others remain secure while all containers can execute concurrently.
Solution Approach 2:
The patent introduces an intermediary session key mechanism that mediates between the host device and storage device for each container. The session key, derived from container credentials and validated by the storage device controller, acts as a secure intermediary that authenticates access commands. This intermediary layer prevents direct spoofing attacks while allowing multiple containers to access the storage device simultaneously with proper authorization.
2Reliability
If session keys are validated at storage device controller level, then security reliability is improved through robust access control, but device complexity increases due to additional validation circuitry and session logging
Solution Approach 1:
The patent implements preliminary action by pre-establishing session keys and access control lists (ACLs) before container execution begins. The container manager circuit generates session keys based on container credentials and configures zone-specific ACLs in advance. This preliminary configuration allows the storage device controller to perform simple validation operations during runtime without complex real-time key generation or authentication protocols, reducing operational complexity while maintaining strong security.
Solution Approach 2:
The storage device controller performs self-service by autonomously validating session keys and enforcing access control decisions without requiring continuous external authentication. The controller maintains internal session state and zone mappings, allowing it to independently verify access commands against pre-configured ACLs and session keys. This self-service capability reduces the complexity of external authentication infrastructure while providing robust security enforcement at the storage device level.
Data Source
AI summary
Method and apparatus for managing software containers in a computer network. A data storage device has a non-volatile memory (NVM) and a controller circuit. A portion of the NVM is allocated for use during deployment of a software container during which an application in the software container is executed by a processor of a virtual machine (VM) hypervisor. A unique session key is generated for the software container, and a token derived from the session key is supplied with each host access command issued to the data storage device during the deployment of the software container. The controller circuit validates each received host access command by determining the session key is valid and that a predetermined time period since deployment has not expired. The controller circuit is further configured to store in a session log a listing of all data blocks accessed in the NVM during the session.