Token-Based Authentication for Host Storage IO Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage systems lack secure and efficient mechanisms for authenticating host devices accessing shared storage arrays, particularly in environments with varying workloads and different IO patterns, where existing protocols may not provide adequate security features.
Innovation Solution
Implementing secure token-based communications using multi-pathing software, specifically the MPIO driver, which generates and incorporates authentication tokens into IO operations, ensuring that only authenticated host devices can execute operations on the storage system by matching tokens generated on both the host and storage array sides.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional storage access protocols are used, then communication between host devices and storage systems is maintained, but security against unauthorized access is insufficient
Solution Approach 1:
The system performs preliminary authentication by generating and embedding authentication tokens in IO operations before they reach the storage system. The host device generates a token based on seed information and current time, embeds it in the IO operation, and the storage system validates it before processing, preventing unauthorized access in advance
Solution Approach 2:
An authentication token acts as an intermediary between the host device and storage system. The token is generated by the host using seed information and time data, embedded in IO operations, and validated by the storage system against its own generated token, serving as a mediator that verifies authenticity without requiring direct trust between host and storage
2Reliability
If authentication tokens are generated and validated for each IO operation, then security is enhanced, but processing overhead increases
Solution Approach 1:
The host device autonomously generates authentication tokens using its own seed information and time data without requiring interaction with the storage system. The token generation is self-contained on the host side, and the storage system only performs validation by comparing against its own generated token, minimizing back-and-forth communication overhead
Solution Approach 2:
The authentication mechanism uses time-based parameters (current time and seed information) to generate dynamic tokens that change with each IO operation or time interval. This approach allows for secure authentication without requiring complex cryptographic handshakes, as the tokens are derived from easily accessible time and seed data
3Adaptability or versatility
If multiple host devices with varying workloads access the storage system, then system versatility is improved, but maintaining secure authentication across diverse configurations becomes more difficult
Solution Approach 1:
The authentication mechanism is designed to be universal across different host devices and storage systems. Each host device is provisioned with seed information during initialization, and both host and storage system independently generate tokens using the same algorithm based on seed and time data. This universal approach works across diverse configurations without requiring device-specific authentication logic
Solution Approach 2:
The authentication system is segmented into independent components: seed information provisioning, token generation on host side, token embedding in IO operations, and token validation on storage side. This segmentation allows each component to be implemented independently and scaled to accommodate multiple host devices with varying workloads and configurations
Data Source
AI summary
An apparatus comprises at least one processing device that is configured to control delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network. The at least one processing device is further configured to generate a plurality of authentication tokens over time utilizing seed information of the host device, and for each of one or more of the input-output operations, to incorporate a particular one of the authentication tokens into the input-output operation, to send the input-output operation to the storage system, and to receive an indication from the storage system, responsive to the input-output operation sent to the storage system, as to whether or not the authentication token incorporated into the input-output operation matches a corresponding authentication token generated by the storage system. The at least one processing device illustratively comprises at least a portion of the host device.