Electrical computers and digital processing systems: memory – Storage accessing and control – Shared memory area
Reexamination Certificate
2001-03-15
2003-09-16
Nguyen, Hiep T. (Department: 2187)
Electrical computers and digital processing systems: memory
Storage accessing and control
Shared memory area
C711S148000, C711S149000, C711S153000, C710S316000, C709S224000, C709S225000, C370S392000, C370S394000
Reexamination Certificate
active
06622220
ABSTRACT:
FIELD OF THE INVENTION
The present invention relates generally to networks of computers and, more particularly, to storage devices attached to such networks commonly referred to as network attached storage devices, and even more particularly to the security of such devices.
BACKGROUND OF THE INVENTION
As computers and computer systems have become more and more capable of performing increasingly complicated tasks, the data which they create, the data upon which their tasks depend, and the data which they wish to store has also increased resulting in an expanded need for more data storage space. The advent of network access to this data complicates the situation as now there is a need for shared data storage space with an associated need for the stored data to be secure from those not having appropriate authorization.
In order to provide this shared storage space, network attached storage (NAS) devices have provided a rapidly emerging new technology for workstations and servers. A network attached storage device is a self-contained, intelligent storage appliance that attaches directly to a local area network (LAN) and transfers data typically over network standard protocols such as Transmission Control Protocol/Internet Protocol (TCP/IP) or Internet Packet Exchange (IPX) also typically using industry standard file sharing protocols such as Server Message Block (SMB), Common Internet File System (CIFS), Network Control Protocol (NCP), Apple File Protocol AFP, Network File System (NFS), or Hypertext Transfer Protocol (HTTP). The current, modern technology typically uses commodity hard-disks and custom controllers to create file systems which are self-configuring so that they appear automatically on the network.
In those environments wherein service providers host servers from multiple customers on their network, and each customers' server stores and accesses data stored on a shared network attached storage device, richer security mechanisms are needed to ensure privacy. In these environments, since the customers control their own servers, they are inherently insecure and untrustworthy from the service provider's standpoint. This, coupled with the fact that current file access protocols base their security on server IP address settings, creates an environment wherein one customer could modify their server to impersonate another customer's server and gain access to the latter's data. This situation would be a serious, unacceptable breach in security. Thus, there exists an unacceptable potential security problem that needs to be eliminated.
One solution to this potential security problem is to forbid the sharing of network attached storage devices among customers. This solution would eliminate the potential security problem, but has the down side that it is much more expensive, as each customer must then have its own dedicated, network attached storage device. Another technique that has been used in attempting to eliminate the security problems associated with network attached storage devices is to setup a trusted third party for security authentication and verification. Examples of this would be to use a Sun NIS server, or Microsoft Domain Controller. These solutions, however, are intrusive on the customer's security setup, which is generally impractical. They also push the security burden back onto the customer which is undesirable.
Thus, in a multi-customer, network environment where data security is very important, there is a need for means to significantly improving the security of storage devices attached to the network.
SUMMARY OF THE INVENTION
The present patent document relates to novel methods for controlling secure access to storage devices attached to computer system networks. Network attached storage (NAS) systems are inherently insecure. Previous methods for controlling such access have relied upon Internet Protocol (IP) source address checking at the beginning of a series of file system transactions. There are several problems with this approach to security in a multi-client environment. It is possible for clients to change the IP addresses on their systems, thus “impersonating” other clients' systems and obtaining access to data that they do not have permission to access. In addition, after an initial client identity check many quanta of data can be exchanged before the client identity is re-verified, thus opening the door for client spoofing. This exacerbates the problem described above.
Embodiments disclosed in the present patent document eliminate these potential security problems by not trusting the customer's server IP address, but rather utilizing trusted network elements to identify which customer is making a storage request at the network attached storage device. Such a security enhanced network attached storage device (SENAS) either (1) uses the network element's provided identity, not the customer server's provided identity, or (2) uses the client supplied identity but validated by the network element when determining what access rights will be granted. That is in order to insure security, an immutable tag is associated with each physical client. The security enhanced storage device recognizes this tag and bases access to the data stored on it based on this tag. This solution has the advantages that (1) it is secure, (2) it allows the service provider to lower their cost by sharing NAS devices between customers, and (3) it does not impact the customer's own security settings or practices among their own servers.
In representative embodiments, methods disclosed in the present patent document allow network-connected client systems or groups of such systems to access data storage devices over the network in a highly secure fashion. Systems not having the appropriate permission are excluded from access. Characteristics of such a network attached storage device include the following: (1) Clients can only access the data they have been given permission to access, based on a combination of access control lists and physical system interconnects. Typically a given client is given access to only their data and no other client's data. However, embodiments disclosed herein allow multiple specific clients to have access to the same data. (2) Client data access permissions in representative embodiments are stored and managed on the security-enhanced network attached storage device and are not accessible by clients, thereby improving data security. (4) Client Access permissions can be checked on a per-IP-packet basis, so that all data transfers can be validated before they occur, thus also, improving data security. (5) In representative embodiments, security-enhanced network attached devices are not intrusive to the client, i.e., the only changes required to software systems is to the file server not to the client. Thus, changes required to the system are transparent to the client. Clients interact with security-enhanced network attached devices in essentially the same manner with which they interact with traditional network-based file systems. (6) In addition, new individual client systems can be automatically given access to appropriate storage by adding them to the client grouping without having to update an access control list which is maintained in the security-enhanced network attached storage device.
Embodiments disclosed use port-based VLANs which cannot be subverted by users attached at client nodes. By contrast, tag-based VLANs typically involve the client network interface card in creation of the tag in the IP stream. And it would, therefore, be possible for a client to subvert a tag-based VLAN by adjusting the network interface card. However, tag-based VLANs could still be used provided (1) that the network device validates that the identity is correct at the port level which could be accomplished, for example, by checking that the packet from a particular port has the correct tag associated with it or (2) that the network assigns the tag in which case the tag cannot be subverted.
Other aspects and advanta
Hochmuth Roland M
Martin Robert P
Thunquest Gary L.
Yoshida Stuart
Hewlett--Packard Development Company, L.P.
Nguyen Hiep T.
LandOfFree
Security-enhanced network attached storage device does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Security-enhanced network attached storage device, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Security-enhanced network attached storage device will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3034227