Secure storage access using third party capability tokens

A device, comprising:

• a processor;
• and
• a memory comprising program instructions configured to:
• negotiate a plurality of revocable token identifiers with a storage device;
• in response to receiving from a client an access request for one or more blocks in a specific storage volume, issue to the client an access token comprising;
• one of the revocable token identifiers for the requested one or more blocks, and
• a token for the specific volume,
• such that the access token is a layered token granting access permission at both the volume-level and the block-level to the one or more blocks of data within the specific volume;
• and
• wherein the storage device is configured to in response to receiving from the client a storage request including the issued access token, grant the storage request if the access token includes the token for the specific volume and one of the revocable token identifiers.

A non-transitory computer accessible medium, comprising program instructions configured to implement:

• (emphasis added)
• receiving from a storage device one or more revocable token identifiers;
• in response to receiving from a client an access request for one or more blocks in a specific storage volume, issue to the client an access token comprising;
• one of the revocable token identifiers for the requested one or more blocks, and
• a token for the specific volume,
• such that the access token is a layered token granting access permission to the specific blocks or one or more ranges of blocks of data within the specific volume;
• and
• wherein the storage device is configured to in response to receiving from the client a storage request including the issued access token, grant the storage request if the access token includes the token for the specific volume and one of the revocable token identifiers.

A system, comprising one or more devices configured to implement:

• negotiating a plurality of revocable token identifiers with an access server;
• receiving from the storage device one or more revocable token identifiers;
• in response to receiving from a client an access request for one or more blocks in a specific storage volume, issuing to the client an access token comprising:
• one of the revocable token identifiers for the requested one or more blocks, and
• a token for the specific volume,
• such that the access token is a layered token granting access permission to the specific volume and to one or more specific blocks or one or more ranges of blocks of data within the specific volume;
• and
• in response to receiving from the client a storage request including the issued access token, granting the storage request if the access token includes the token for the specific volume and one of the revocable token identifiers.