Storage Controller Namespace Isolation for Multi-Tenant Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant virtualization environments, existing storage systems lack effective isolation and encryption mechanisms to protect data for each tenant, making them vulnerable to security attacks during access from host devices to storage devices.
Innovation Solution
A storage controller and system that employs a device security manager to set secure zones for each tenant, using access information including host memory addresses, namespace identifiers, and encryption keys to manage access and encryption operations, ensuring that only authorized tenants can access their designated data regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a shared storage system is used for multiple tenants, then storage resource utilization is improved, but data security and isolation for each tenant deteriorates
Solution Approach 1:
The storage system is segmented into multiple isolated namespaces, each assigned to a specific tenant. The device security manager creates separate address spaces and access control lists for each tenant, ensuring that data from different tenants is logically isolated while sharing the same physical storage resources. This resolves the contradiction by enabling both high resource utilization through sharing and strong security through segmentation.
Solution Approach 2:
Different security policies and encryption keys are applied to different tenants' data locally. Each tenant's namespace has its own access control list, address space mapping, and encryption parameters. This allows the system to maintain uniform resource sharing while applying differentiated security measures to each tenant's data, simultaneously achieving resource efficiency and data protection.
2Reliability
If access control mechanisms are implemented for each tenant, then data isolation is improved, but system complexity deteriorates
Solution Approach 1:
The device security manager serves multiple functions simultaneously: it manages address space mapping, maintains access control lists, handles namespace allocation, and enforces security policies. By consolidating these diverse security management tasks into a single universal component, the system achieves strong data isolation without proportionally increasing overall system complexity.
Solution Approach 2:
The device security manager acts as an intermediary layer between the host device and the storage medium. It intercepts and processes all access requests, performing security checks, address translations, and permission validations. This intermediary approach centralizes security logic and simplifies the overall system architecture by providing a single point of control for all security-related operations.
3Reliability
If encryption operations are performed for each tenant data, then data confidentiality is improved, but processing time deteriorates
Solution Approach 1:
Encryption keys and security parameters are pre-configured for each tenant's namespace during system initialization or tenant onboarding. The device security manager maintains pre-computed address space mappings and access control lists. This preliminary preparation eliminates the need for complex real-time key generation and permission checks during data access operations, reducing processing time while maintaining strong encryption-based confidentiality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A storage controller and a storage system comprising the same are provided. Provided is a device security manager configured to set a first device security zone to allow a first tenant to access first tenant data stored in a non-volatile memory, receive access information from a host device and writing the received access information in a mapping table, wherein the access information includes a first host memory address in which the first tenant data is stored in the host device, a first namespace identifier for identifying the first tenant data stored in the non-volatile memory, a first logic block address corresponding to the first namespace identifier, and an encryption key, encrypt the first tenant data by using the encryption key, and write the encrypted first tenant data in the first device security zone of the non-volatile memory.