Virtual Target Storage Resource Access Control via Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current NVMe target systems lack flexibility in managing storage resources, as they are functionally static and do not provide a dynamic way to authenticate and provision host access to storage resources, limiting scalability and efficiency in multi-host environments.

Innovation Solution

The implementation of programmable virtual target storage resources that use distributed discovery services to map virtual target storage resources to physical or virtual resources, enabling dynamic authentication and provisioning of access control lists for host nodes, allowing flexible allocation and management of storage resources across multiple hosts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If NVMe target systems use static functional architecture for managing storage resources, then system simplicity is maintained, but flexibility and scalability in multi-host environments deteriorate

Engineering Contradiction:

Improveflexibility in managing storage resourcesVSAvoidsystem architecture complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments the target system into multiple virtual target instances, each capable of independently managing storage resources. This segmentation allows the system to serve multiple hosts simultaneously with customized access controls and resource allocations, transforming a static monolithic architecture into a flexible multi-instance architecture that resolves the contradiction between simplicity and adaptability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces dynamic configuration capabilities where virtual target instances can be created, modified, and deleted based on host requirements. Access control lists and resource mappings are dynamically adjustable without requiring system reconfiguration, enabling the architecture to adapt to changing multi-host environment needs while maintaining operational simplicity through automated management.

Inventive Principle:

Principle #15Dynamics

2Speed

If direct connection between host nodes and target systems is implemented, then connection speed is improved, but access control and security management deteriorate

Engineering Contradiction:

Improveconnection speedVSAvoidaccess control management

Core Design Contradiction:

SpeedVSEase of operation

Solution Approach 1:

The patent introduces virtual target instances as intermediary layers between host nodes and the physical target system. These intermediaries maintain high-speed NVMe connections while implementing access control lists and authentication mechanisms, thus preserving connection speed while significantly improving access control management in multi-host environments.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If multiple host nodes access the same target system, then resource utilization is improved, but access control and authentication become more complex

Engineering Contradiction:

Improveresource utilizationVSAvoidauthentication and access control complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent divides the target system into multiple virtual target instances, each with its own access control list and authentication configuration. This segmentation allows multiple host nodes to access storage resources simultaneously through appropriately configured instances, improving resource utilization while keeping authentication and access control manageable through instance-level isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent creates virtual copies of target system interfaces that present identical functionality to multiple hosts. These virtual instances replicate the necessary access control and authentication mechanisms, allowing resource sharing while maintaining security through standardized copying of access control configurations across instances.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS11630783B2Management of accesses to target storage resources

Publication Date: 2023.04.18 INTEL CORP

AI summary

Provided are a computer product, method, and system to virtualize target system storage resources as virtual target storage resources. Target storage resources available at a target system are discovered over a network. A configuration is determined of virtual target storage resources mapping to the target storage resources for a host node. The configuration is registered with a virtual target. The configuration maps the virtual target storage resources to the target storage resources at the target system and an access control list of the host node allowed to access the virtual target storage resources. A query is received from the host node for the target storage resources the host node is permitted to access according to the access control list. Host discovery information is returned to the requesting host node indicating the virtual target storage resources the requesting host node is provisioned to access from the virtual target.