# US 9,882,913 B1 · Delivering authorization and authentication for a user of a storage array from a cloud

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,882,913 B1
- Document ID: US9882913B1
- Status: Granted
- Kind: B1
- Application number: 15/000,822
- Filed: 2016-01-19
- Granted: 2018-01-30
- Earliest claimed: 2015-05-29
- Assignees: Pure Storage, Inc.
- Applicants: Pure Storage, Inc.
- Inventors: Benjamin P. Borowiec; Jimmy T. Hu; Ethan L. Miller; Terence W. Noonan; Constantine P. Sapuntzakis; Neil A. Vachharajani; Daquan Zuo
- Web page: https://patentgrep.com/patent/US9882913B1

## CPC

- H04L 63/102: {Entity profiles}
- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3247: {involving digital signatures}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- G06F 9/46: Multiprogramming arrangements
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption
- H04L 2209/72: Signcrypting, i.e. digital signing and encrypting simultaneously
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Providing authorization and authentication in a cloud for a user of a storage array includes: receiving, by a cloud-based security module from a client-side array services module, user credentials; authenticating, by the cloud-based security module, the user credentials; identifying, by the cloud-based security module, authorized access privileges defining one or more storage array services accessible by the user; generating, by the cloud-based security module, a token representing the authentication of the user credentials and the authorized access privileges; and providing, by the cloud-based security module to the client-side array services module, the token.

## Claims

### Claim 1

A method of delivering authorization and authentication for a user of a storage array from a cloud, the method comprising:
identifying, by a cloud-based security module, authorized access privileges defining one or more storage array services accessible by the user;
generating, by the cloud-based security module, a token representing the authentication of user credentials and the authorized access privileges, including:
generating a digital signature of data representing the authorized access privileges, including:
hashing data representing the authorized access privileges;
encrypting the hashed data using a public key of a storage array access module, wherein the encrypted hashed data includes the digital signature; and
providing, by the cloud-based security module to the client-side array services module, the token, including sending, as the token to the storage array access module, the data representing the authorized access privileges with the digital signature.

### Claim 2 (depends on 1)

The method of claim 1, wherein the cloud-based security module comprises a cloud identity provider (‘IDP’).

### Claim 3 (depends on 1)

The method of claim 1, wherein the cloud-based security module comprises a component of a cloud-based storage array services provider.

### Claim 4 (depends on 1)

The method of claim 1, wherein the cloud-based security module comprises a lightweight directory access protocol directory service.

### Claim 5 (depends on 1)

The method of claim 1, wherein:
access privileges are further defined in the storage array access module for a plurality of users; and
the storage array access module is configured to determine whether to grant an access request by the user in dependence upon the token and the access privileges defined in the storage array access module.

### Claim 6 (depends on 1)

The method of claim 1, wherein access privileges are defined in the cloud-based security module for a plurality of users with an association of each user with one of a plurality of profiles, each profile specifying access privileges for users associated with the profile.

### Claim 7 (depends on 6)

The method of claim 6, wherein the plurality of profiles comprise:
a read-only profile specifying, for users associated with the read only profile, read-only access privileges;
a modify profile specifying, for users associated with the modify profile, read and modify access privileges; and
an administrator profile specifying, for users associated with the administrator profile, all available access privileges.

### Claim 8 (depends on 6)

The method of claim 6, wherein the plurality of profiles comprise at least one storage-array specific profile specifying access privileges for a single storage array and multi-array profiles specifying access privileges for a plurality of storage arrays.

### Claim 9

An apparatus for delivering authorization and authentication for a user of a storage array from a cloud, the apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:
identifying, by a cloud-based security module, authorized access privileges defining one or more storage array services accessible by the user;
generating, by the cloud-based security module, a token representing the authentication of user credentials and the authorized access privileges, including:
hashing data representing the authorized access privileges;
encrypting the hashed data using a public key of a storage array access module, wherein the encrypted hashed data includes the digital signature; and
providing, by the cloud-based security module to the client-side array services module, the token, including sending, as the token to the storage array access module, the data representing the authorized access privileges with the digital signature.

### Claim 10 (depends on 9)

The apparatus of claim 9, wherein the cloud-based security module comprises a cloud identity provider (‘IDP’).

### Claim 11 (depends on 9)

The apparatus of claim 9, wherein the cloud-based security module comprises a component of a cloud-based storage array services provider.

### Claim 12 (depends on 9)

The apparatus of claim 9, wherein:
access privileges are further defined in the storage array access module for a plurality of users; and
the storage array access module is configured to determine whether to grant an access request by the user in dependence upon the token and the access privileges defined in the storage array access module.

### Claim 13 (depends on 9)

The apparatus of claim 9, wherein access privileges are defined in the cloud-based security module for a plurality of users with an association of each user with one of a plurality of profiles, each profile specifying access privileges for users associated with the profile.

### Claim 14 (depends on 13)

The apparatus of claim 13, wherein the plurality of profiles comprise:
a read-only profile specifying, for users associated with the read only profile, read-only access privileges;
a modify profile specifying, for users associated with the modify profile, read and modify access privileges; and
an administrator profile specifying, for users associated with the administrator profile, all available access privileges.

### Claim 15 (depends on 13)

The apparatus of claim 13, wherein the plurality of profiles comprise at least one storage-array specific profile specifying access privileges for a single storage array and multi-array profiles specifying access privileges for a plurality of storage arrays.

### Claim 16

A computer program product for delivering authorization and authentication for a user of a storage array from a cloud, the computer program product disposed upon a non-transitory computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out the steps of:
identifying, by a cloud-based security module, authorized access privileges defining one or more storage array services accessible by the user;
generating, by the cloud-based security module, a token representing the authentication of user credentials and the authorized access privileges, including:
hashing data representing the authorized access privileges;
encrypting the hashed data using a public key of a storage array access module, wherein the encrypted hashed data includes the digital signature; and
providing, by the cloud-based security module to the client-side array services module, the token, including sending, as the token to the storage array access module, the data representing the authorized access privileges with the digital signature.

### Claim 17 (depends on 16)

The computer program product of claim 16, wherein the cloud-based security module comprises a cloud identity provider (IDP′).

### Claim 18 (depends on 16)

The computer program product of claim 16, wherein the cloud-based security module comprises a component of a cloud-based storage array services provider.

### Claim 19 (depends on 16)

The computer program product of claim 16, wherein access privileges are defined in the cloud-based security module for a plurality of users with an association of each user with one of a plurality of profiles, each profile specifying access privileges for users associated with the profile.