Data Storage Gateway Security Offloading via BMC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based data storage systems face challenges in maintaining security while managing system efficiency and latency due to the high cost and bandwidth utilization of dedicated security functions.
Innovation Solution
Offload security functionality to a baseboard management controller (BMC) using a Redfish interface, enabling authentication and verification processes remotely, thereby reducing the need for local security functions in the data storage array enclosure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dedicated security function is implemented within the data storage system, then security is improved, but system cost and bandwidth utilization increase
Solution Approach 1:
The security functionality is extracted from the data storage system and relocated to a remote management system. The gateway acts as an intermediary that offloads authentication and authorization operations to the remote system, thereby removing the security processing burden from the storage system's bandwidth and resources while maintaining security functions.
Solution Approach 2:
A gateway is introduced as an intermediary component between the data storage system and the remote management system. The gateway handles security-related communication by forwarding authentication requests to the remote system and relaying results back, thereby protecting the storage system from direct security processing loads while enabling secure operations.
2Reliability
If a dedicated security function is implemented within the data storage system, then security is improved, but overall system efficiency decreases
Solution Approach 1:
Security processing operations are extracted from the data storage system and performed remotely. This allows the storage system to focus on its primary data operations while security functions are handled by specialized remote infrastructure, improving overall system efficiency by preventing security overhead from bottlenecking storage operations.
Solution Approach 2:
The remote management system provides self-service security capabilities that automatically handle authentication and authorization without requiring dedicated security hardware or software within the storage system itself. This automated, remote-handled approach improves efficiency by eliminating the need for local security processing resources.
3Reliability
If a dedicated security function is implemented within the data storage system, then security is improved, but latency increases
Solution Approach 1:
Authentication tokens are obtained in advance through preliminary authentication requests to the remote management system. Once authenticated, the gateway receives and caches authentication tokens that can be reused for subsequent operations, thereby reducing latency for repeated access operations while maintaining security verification.
Solution Approach 2:
Time-consuming security verification operations are extracted from the critical data access path and performed asynchronously through the gateway. The storage system can proceed with data operations while security verification is handled remotely, preventing security processing from becoming a latency bottleneck in the data access chain.
Data Source
AI summary
A method, computer program product, and computing system for offloading security functionality in a data storage system. An authentication request is received at a gateway of the data storage system from a client for establishing a trusted connection between the client and the data storage system. The gateway transfers the authentication request to a remote management system for processing by the remote management system. Upon approval of the authentication request, the gateway receives an authentication token from the remote management system and the gateway transfers the authentication token to the client for use in subsequent access requests to the data storage system.