STORAGE SECURITY USING CRYPTOGRAPHIC SPLITTING

• US 20100154053A1
• Filed: 12/17/2008
• Published: 06/17/2010
• Est. Priority Date: 12/17/2008
• Status: Abandoned Application

• Current Assignee: Albert French, David Dodgson, Edward Chin, Joseph Neill, Ralph Farina, Robert Johnson, Scott Summers
• Original Assignee: Albert French, David Dodgson, Edward Chin, Joseph Neill, Ralph Farina, Robert Johnson, Scott Summers
• Inventors: Johnson, Robert, Summers, Scott, Farina, Ralph, Dodgson, David, Chin, Edward, French, Albert, Neill, Joseph
• Application Number:
  US12/336,562
• Publication Number:
  US 20100154053A1
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

Methods and systems for presenting a virtual disk to a client device are disclosed. One method includes receiving client credentials from a client device, the client credentials including a client identifier. The method also includes authenticating the client device at a secure storage device. The method further includes determining a volume is associated with the client device based upon the client identifier, the volume associated with a plurality of shares stored on a corresponding plurality of physical storage devices. The method also includes, upon determining the volume is associated with the client device, presenting the volume to the client device.

Claims

1. A method of presenting a virtual disk to a client device, the method comprising:

receiving client credentials from a client device, the client credentials including a client identifier;

authenticating the client device at a secure storage device;

determining a volume is associated with the client device based upon the client identifier, the volume associated with a plurality of shares stored on a corresponding plurality of physical storage devices; and

upon determining the volume is associated with the client device, presenting the volume to the client device.

2. The method of claim 1, wherein at least one of the plurality of physical storage devices contains data accessible to users unassociated with the volume.

3. The method of claim 1, further comprising receiving second client credentials from a second client device, the second client credentials including a second client identifier;

4. The method of claim 1, wherein the client identifier is a world wide name of a host bus adapter on the client device.

5. The method of claim 1, wherein authenticating the client device includes determining security rights of the client device, wherein the security rights are selected from a group of administrative access rights.

6. The method of claim 1, further comprising:

receiving, in conjunction with a subsequent data request from the client device relating to a volume, information about the client device including the client identifier;

comparing the client identifier to a list of client identifiers associated with client devices authorized to access the volume; and

based on comparing the client identifier, responding to the data request.

7. The method of claim 6, wherein comparing the client identifier comprises determining that the client identifier is included in the list of client identifiers.

8. The method of claim 1, further comprising periodically receiving an unlock message from the client device.

9. The method of claim 8, further comprising, upon failing to receive the unlock message, ceasing to allow access to data associated with the volume to the client device.

10. The method of claim 8, further comprising, upon failing to receive the unlock message, continuing to display status information regarding the volume to the client device.

11. The method of claim 8, wherein the unlock message includes a session key useable for communication between the client device and the secure storage appliance.

12. The method of claim 1, wherein presenting the volume to the client device includes providing access to data stored in the plurality of shares associated with the volume.

13. The method of claim 1, further comprising establishing a secure connection between the client device and the secure storage appliance.

14. A secure storage appliance comprising a programmable circuit configured to execute program instructions which, when executed, configure the secure storage appliance to:

receive client credentials from a client device, the client credentials including a client identifier;

authenticate the client device at a secure storage device;

determine a volume is associated with the client device based upon the client identifier, the volume associated with a plurality of shares stored on a corresponding plurality of physical storage devices; and

upon determining the volume is associated with the client device, present the volume to the client device.

15. The secure storage appliance of claim 14, wherein the client identifier identifies a communication interface of the client device.

16. The secure storage appliance of claim 15, wherein the communication interface is a Fibre Channel interface.

17. The secure storage appliance of claim 14, wherein the client identifier includes a host bus adapter world wide number.

18. The secure storage appliance of claim 14, wherein the programmable circuit is further programmed to, upon failing to receive the unlock message, cease to allow access to data associated with the volume to the client device.

19. A method of presenting a virtual disk to a client device, the method comprising:

receiving client credentials from a client device, the client credentials including a client identifier;

authenticating the client device at a secure storage device;

determining a volume is associated with the client device based upon the client identifier, the volume associated with a plurality of shares stored on a corresponding plurality of physical storage devices; and

upon determining the volume is associated with the client device, presenting the volume to the client device;

receiving client credentials from a second client device, the client credentials including a second client identifier;

authenticating the second client device at a secure storage device;

determining a second volume is associated with the second client device based upon the second client identifier, the second volume associated with a second plurality of shares stored on a corresponding second plurality of physical storage devices, wherein at least one physical storage device stores one of each of the first and second plurality of shares; and

upon determining the second volume is associated with the second client device, presenting the second volume to the second client device.

20. The method of claim 19, wherein the second volume remains inaccessible to the client device and the volume remains inaccessible to the second client device.

21. The method of claim 19, further comprising determining the volume is also associated with the second client device based upon the second client identifier, and upon determining the volume is associated with the second client device, presenting the volume to the second client device.