Storage Manager Server Client Access Control via Trusted Addressing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls struggle to effectively manage and control client access to storage management servers, particularly in ensuring secure sessions while isolating clients from unauthorized access, especially when dealing with potentially untrustworthy client-provided addressing information.
Innovation Solution
Implementing a client address management database within the server that distinguishes between trusted and untrusted clients by using trusted administrative-provided addressing information to initiate sessions, thereby preventing unauthorized access and ensuring secure communication across firewalls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a firewall isolates a storage management server from clients, then network security is improved, but client access control becomes more difficult
Solution Approach 1:
The server performs preliminary action by proactively initiating sessions with clients using trusted addressing information stored in the database, rather than waiting for client connections. This allows the firewall-isolated server to maintain security isolation while establishing controlled communication channels before potential threats can manifest.
Solution Approach 2:
The patent introduces an intermediary mechanism where the server uses trusted addressing information (such as MAC addresses or IP addresses) as a mediator to establish sessions through the firewall. This intermediary approach allows the server to authenticate and control client access without requiring direct trust between the isolated server and external clients, resolving the contradiction between security isolation and access control.
2Ease of operation
If the server uses client-provided addressing information to initiate sessions, then ease of connection is improved, but security is worsened due to potential untrustworthy information
Solution Approach 1:
The patent extracts the trusted addressing information from the potentially untrustworthy client-provided data and stores it separately in the database under the server's control. By taking out the critical authentication data from the client's control, the server can use it to initiate secure sessions without being vulnerable to spoofing or malicious information, thus maintaining both connection ease and security.
Solution Approach 2:
Instead of the client providing addressing information that the server must trust (traditional client-initiated approach), the patent inverts the approach by having the server use pre-stored trusted addressing information to initiate sessions with clients. This inversion shifts the trust burden from the client to the server's own authentication mechanism, ensuring security while maintaining connection capability.
3Reliability
If the server initiates sessions with clients using trusted addressing information, then session security is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal database structure that serves multiple functions: storing client information, maintaining trusted addressing information, and managing session initiation. By consolidating these functions into a single multi-functional component, the system achieves improved session security without proportionally increasing device complexity, as the database handles authentication, client management, and session control uniformly.
Data Source
AI summary
Provided are a method, system, and article of manufacture, wherein in certain embodiments a request is received to initiate a session. A determination is made whether the session should be initiated with addressing information provided by a client. The session is initiated with trusted addressing information corresponding to the client, in response to determining that the session should not be initiated with the addressing information provided by the client.