Storage Isolation via I/O Authentication Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-tenant storage systems face challenges in ensuring the integrity and authenticity of input/output requests, leading to potential data corruption and compromise of storage resources due to compromised client computer systems, with existing methods like LUN masking and zoning being inadequate for resource utilization and security in cloud environments.
Innovation Solution
Implementing an authentication-based storage isolation system that uses a trusted third-party authentication system to generate and verify security tokens within input/output requests, ensuring the identity and integrity of requests through cryptographic keys or other secure authentication methods, thereby preventing unauthorized access and tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If LUN masking and zoning are used to restrict access to storage resources, then storage isolation between tenants is improved, but resource utilization and re-allocation efficiency deteriorate
Solution Approach 1:
The patent introduces an authentication system as an intermediary between client computer systems and storage resources. This authentication system verifies the identity of clients and the integrity of I/O requests using cryptographic authentication, allowing the MTSS to maintain strong security controls while dynamically allocating storage resources based on authenticated client identities, thus resolving the contradiction between isolation and resource utilization
Solution Approach 2:
The patent changes the authentication parameter from static identification (IP addresses, WWNs used in LUN masking and zoning) to dynamic cryptographic authentication tokens. This allows the system to maintain security while flexibly allocating storage resources to different authenticated clients, improving resource utilization without compromising storage isolation
2Reliability
If LUN masking and zoning are used to restrict access, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The patent replaces the mechanical/network-layer isolation mechanisms of LUN masking and zoning with cryptographic authentication at the application layer. Instead of physically or logically partitioning storage resources through complex masking and zoning configurations, the system uses authentication tokens to control access, significantly reducing configuration complexity while maintaining or improving security
3Reliability
If authentication is performed at the client computer system level, then request integrity is improved, but processing overhead increases
Solution Approach 1:
The patent performs authentication in advance by embedding authentication tokens in I/O requests before they reach the MTSS. The authentication system verifies these tokens efficiently, and once authenticated, the client's identity is cached for subsequent operations. This preliminary authentication approach ensures request integrity while minimizing processing time overhead during actual storage operations
Data Source
AI summary
Techniques are described for logically isolating data I/O requests from different operating systems (OSes) for a same multi-tenant storage system (MTSS). Techniques provide for OSes and the MTSS to obtain security tokens associated with the OSes. In an embodiment, an OS uses a security token to generate an authentication token based on the contents of a data input/output (I/O) request and sends the authentication token to the MTSS along with the data I/O request. When an MTSS receives such data I/O request, MTSS retrieves its own copy of the security token associated with the OS and generates its own authentication token based on the contents of the received data I/O request. If the authentication token generated by the MTSS matches the authentication token generated by the OS, then the data I/O request is successfully authenticated. Otherwise, if the authorization tokens fail to match, then the data I/O request has been compromised. For example, either the contents of data I/O request has been tampered with, or an entity other than the OS, has sent the data I/O request in the first place. Accordingly, the data I/O request may not be serviced by the MTSS.