# US 10,454,930 B2 · System and method for local data IP based network security for preventing data breach attempts in a multi-tenant protection storage deployment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,930 B2 - Document ID: US10454930B2 - Status: Granted - Kind: B2 - Application number: 15/650,600 - Filed: 2017-07-14 - Published: 2019-01-17 - Granted: 2019-10-22 - Earliest claimed: 2017-07-14 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Subhasish Chakraborty; Terry Gene Hahn; Hongyu Zhang; Rodney Edward Radford; Catherine E. Agbaw; Manish Chhabra - Web page: https://patentgrep.com/patent/US10454930B2 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 16/172: Caching, prefetching or hoarding of files - G06F 21/31: User authentication - G06F 21/44: Program or device authentication - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/104: {Grouping of entities} - G06F 12/0875: with dedicated cache, e.g. instruction or stack - G06F 12/1458: {by checking the subject access rights} - H04L 61/5061: Pools of addresses - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A data storage device includes advertised internet protocol (IP) addresses, a logical data storage, and a resource request processor. The logical data storage includes an object storage. The resource request processor obtains a data access request that includes a destination IP address and that requests a portion of data stored in the object storage. The resource request processor makes a determination to allow access to the portion of the data based on a multifactor authorization. The multifactor authorization is based, at least in part, on an association between the destination IP address and the portion of the data. In response to the determination, resource request processor provides the portion of the data to a requestor specified in the data access request. ## Claims ### Claim 1 A data storage device, comprising: persistent storage that stores: a plurality of advertised internet protocol (IP) addresses that are advertised by the data storage device each associated with different portions of data stored in an object storage, and the object storage; and a processor programmed to: obtain a data access request, comprising a destination IP address, that requests a portion of data stored in the object storage, perform a multifactor authorization, comprising: matching the destination IP address to one of the plurality of advertised IP addresses, to obtain a matched advertised IP address; and making a first determination that the matched advertised IP address is associated with the portion of data, wherein the first determination comprises: obtaining a universally unique identifier (UUID) associated with the matched advertised IP address, using an entry of a version controlled cache that is associated with the matched advertised IP address; matching a first namespace identifier, associated with the portion of data, to a second namespace identifier, of a set of namespace identifiers associated with the UUID; and make a second determination to allow access to the portion of data based on the multifactor authorization. ### Claim 2 (depends on 1) The data storage device of claim 1, wherein obtaining the UUID comprises: performing a comparison between a first version number specified by the entry of the version controlled cache to a second version number specified by a version controlled set of advertised IP address mappings; updating the entry of the version controlled cache based on the comparison; and using a UUID specified by the version controlled set of advertised IP address mappings as the obtained UUID. ### Claim 3 (depends on 1) The data storage device of claim 1, wherein the UUID comprises information that enables the portion of data to be obtained from the object storage. ### Claim 4 (depends on 1) The data storage device of claim 1, wherein obtaining the first namespace identifier associated with the portion of data comprises matching a credential included in the data access request to a first tenant resources of a plurality of tenant resources, wherein the first tenant resources of the plurality of tenant resources specify a first plurality of namespaces. ### Claim 5 (depends on 4) The data storage device of claim 4, wherein a second tenant resources of the plurality of tenant resources specify a second plurality of namespaces. ### Claim 6 (depends on 5) The data storage device of claim 5, wherein a first namespace of the first plurality of namespaces comprises a first set of UUIDs, wherein a second namespace of the second plurality of namespaces comprises a second set of UUIDs, wherein a UUID of the first set of UUIDs is the same as a UUID of the second set of UUIDs. ### Claim 7 (depends on 1) The data storage device of claim 1, wherein the multifactor authorization further comprises: matching a credential included in the request to a credential associated with the portion of data. ### Claim 8 (depends on 7) The data storage device of claim 7, wherein the multifactor authorization further comprises: matching an IP address of a requestor to a requestor IP address associated with the portion of data. ### Claim 9 (depends on 1) The data storage device of claim 1, wherein the data comprises: first data associated with a first tenant; second data associated with a second tenant; and third data associated with both of the first tenant and the second tenant. ### Claim 10 (depends on 9) The data storage device of claim 9, wherein the data access request comprises a credential associated with one selected from a group consisting of the first tenant and the second tenant. ### Claim 11 (depends on 1) The data storage device of claim 1, wherein the plurality of advertised IP addresses cause network traffic addressed to any of the plurality of IP addresses to be sent to the data storage device. ### Claim 12 A method of operating a data storage device, comprising: advertising, by the data storage device, a plurality of advertised internet protocol (IP) addresses each associated with different portions of data stored in an object storage stored in persistent storage; obtaining, by the data storage device, a data access request, comprising a destination IP address, that requests a portion of data stored in the object storage; perform a multifactor authorization, comprising: matching the destination IP address to one of the plurality of advertised IP addresses, to obtain a matched advertised IP address; and making a first determination that the matched advertised IP address is associated with the portion of data, wherein the first determination comprises: obtaining a universally unique identifier (UUID) associated with the matched advertised IP address, using an entry of a version controlled cache that is associated with the matched advertised IP address; matching a first namespace identifier, associated with the portion of data, to a second namespace identifier, of a set of namespace identifiers associated with the UUID; and make a second determination to allow access to the portion of data based on the multifactor authorization. ### Claim 13 (depends on 12) The method of claim 12, wherein obtaining the UUID comprises: performing a comparison, by the data storage device, between a first version number specified by the entry of the version controlled cache to a second version number specified by a version controlled set of advertised IP address mappings; and updating, by the data storage device, the entry of the version controlled cache based on the comparison. ### Claim 14 A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for operating a data storage device, the method comprising: advertising, by the data storage device, a plurality of advertised internet protocol (IP) addresses each associated with different portions of data stored in an object storage stored in persistent storage; obtaining, by the data storage device, a data access request, comprising a destination IP address, that requests a portion of data stored in the object storage, perform a multifactor authorization, comprising: matching the destination IP address to one of the plurality of advertised IP addresses, to obtain a matched advertised IP address; and making a first determination that the matched advertised IP address is associated with the portion of data, wherein the first determination comprises: obtaining a universally unique identifier (UUID) associated with the matched advertised IP address, using an entry of a version controlled cache that is associated with the matched advertised IP address; matching a first namespace identifier, associated with the portion of data, to a second namespace identifier, of a set of namespace identifiers associated with the UUID; and make a second determination to allow access to the portion of data based on the multifactor authorization.