US 9,852,284 B2 · Storage isolation using I/O authentication

Abstract

Techniques are described for logically isolating data I/O requests from different operating systems (OSes) for a same multi-tenant storage system (MTSS). Techniques provide for OSes and the MTSS to obtain security tokens associated with the OSes. In an embodiment, an OS uses a security token to generate an authentication token based on the contents of a data input/output (I/O) request and sends the authentication token to the MTSS along with the data I/O request. When an MTSS receives such data I/O request, MTSS retrieves its own copy of the security token associated with the OS and generates its own authentication token based on the contents of the received data I/O request. If the authentication token generated by the MTSS matches the authentication token generated by the OS, then the data I/O request is successfully authenticated. Otherwise, if the authorization tokens fail to match, then the data I/O request has been compromised. For example, either the contents of data I/O request has been tampered with, or an entity other than the OS, has sent the data I/O request in the first place. Accordingly, the data I/O request may not be serviced by the MTSS.

Claims20

Dependent claims

A computer-implemented method comprising:

a storage system processing a plurality of data input/output (I/O) requests on a persistent storage managed by the storage system, the processing comprising:
receiving, over a network, a data I/O request comprising a plurality of pairs of authentication tokens and operating system (OS) content, wherein an authentication token of each pair, of the plurality of pairs, is used for authenticating with the storage system a corresponding operating system that originated OS content of said each pair;
for said each pair of the plurality of pairs:
making a determination of validity of the authentication token for the corresponding operating system;
based on the determination of validity, identifying a next authentication token from a next pair, of the plurality of pairs, corresponding to a next operating system for authenticating with the storage system the next operating system, that originated next OS content of the next pair;
if at least one authentication token in the plurality of pairs is determined to be invalid, preventing the storage system from processing the data I/O request on the persistent storage;
and
if each authentication token in the plurality pairs is determined to be valid, processing the data I/O request on the persistent storage by the storage system.

5 more elements

One or more non-transitory computer-readable media storing instructions, wherein the instructions include instructions, which when executed by one or more hardware processors, cause:

a storage system processing a plurality of data input/output (I/O) requests on a persistent storage managed by the storage system, the processing comprising:
receiving, over a network, a data I/O request comprising a plurality of pairs of authentication tokens and operating system (OS) content, wherein an authentication token of each pair, of the plurality of pairs, is used for authenticating with the storage system a corresponding operating system that originated OS content of said each pair;
for said each pair of the plurality of pairs:
making a determination of validity of the authentication token for the corresponding operating system;
based on the determination of validity, identifying a next authentication token from a next pair, of the plurality of pairs, corresponding to a next operating system for authenticating with the storage system the next operating system, that originated next OS content of the next pair;
if at least one authentication token in the plurality of pairs is determined to be invalid, preventing the storage system from processing the data I/O request on the persistent storage;
and
if each authentication token in the plurality pairs is determined to be valid, processing the data I/O request on the persistent storage by the storage system.

5 more elements

Dependencies are inferred from the claim text.

Storage isolation using I/O authentication

Life of this patent

Storage isolation using I/O authentication

Life of this patent

Abstract

Claims20