Providing security in a cloud storage environment

• US 8,676,710 B2
• Filed: 04/11/2011
• Issued: 03/18/2014
• Est. Priority Date: 11/22/2010
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Arasanal, Rajashekhar Mallikarjun, Mane, Nandkumar Lalasaheb
• Primary Examiner(s): Nigh, James D
• Application Number:
  US13/083,628
• Publication Number:
  US 20120130874A1
• Time in Patent Office: 1,072 Days
• Field of Search: 705/50, 705/76, 705/77
• US Class Current: 705/50
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method of providing security as a service in a cloud storage environment includes storing, through a cloud manager of the cloud storage environment, a security level of access of a storage controller associated with a customer of the security as a service, and receiving a request from the customer to access security information of the storage controller associated therewith. The method also includes providing, through the cloud manager, security information of the storage controller associated with the customer in accordance with the request and the stored security level of access of the storage controller associated with the customer.

Claims

1. A method of providing security as a service in a cloud storage environment, comprising:

storing, through a cloud manager of the cloud storage environment, a security level of access of a storage controller associated with a customer of the security as a service, the cloud manager configured to provision storage in the cloud storage environment;

receiving a request from the customer to access security information of the storage controller associated therewith; and

providing, through the cloud manager, security information of the storage controller associated with the customer in accordance with the request and the stored security level of access of the storage controller associated with the customer,

wherein the cloud manager comprises one or more computers.

2. The method of claim 1, further comprising controlling access to the security information of the storage controller associated with the customer through verifying the security level of access thereof.

3. The method of claim 1, wherein the security information of the storage controller associated with the customer includes at least one of information associated with authenticating the customer, attestation confirmation of a computing platform on which data associated with the customer is configured to be stored, signature data of the storage controller associated with the computing platform attestation and at least one parameter other than the signature data of the storage controller.

4. The method of claim 2, wherein verifying the security level of access of the storage controller comprises:

authenticating the customer based on an identifier thereof; and

retrieving the security level of access associated with the customer from the cloud manager.

5. The method of claim 4, further comprising preventing access to the security information associated with the storage controller upon a failure of the authentication of the customer.

6. The method of claim 1, further comprising generating, through the cloud manager, a security service invoice to the customer based on the security information provided thereto.

7. The method of claim 6, further comprising:

retrieving preferred security information of the storage controller associated with the customer based on the security level of access associated therewith; and

decreasing an amount from the security service invoice when the security information provided to the customer fails to conform with the preferred security information.

8. The method of claim 1, further comprising providing at least one of network as a service, performance as a service, storage space as a service, cloud monitoring as a service, engineering support as a service, cloud auto-scaling as a service, and server utilization as a service to the customer, through the cloud manager, in addition to the security service.

9. The method of claim 3,

wherein information associated with authenticating the customer is obtained through one of a hardware based authentication scheme and a software based authentication scheme provided through the cloud manager, and

wherein the information associated with authenticating the customer includes a confirmation that the storage controller associated with the customer is secure.

10. The method of claim 3, wherein the signature data of the storage controller includes a list of hashes of at least one of a version of the Basic Input/Output System (BIOS) on the storage controller, a storage operating system version executing on the storage controller, a physical hardware identification attribute of the storage controller and a configuration information associated with the storage controller.

11. The method of claim 9, wherein the hardware based authentication scheme includes:

registering the storage controller with an authentication server configured to be set up in the cloud storage environment; and

authenticating the storage controller based on a communication protocol between a client device associated with the customer, the authentication server and the storage controller.

12. The method of claim 11, further comprising:

interfacing a secure microcontroller with the storage controller;

rendering a BIOS on the storage controller to be aware of a hardware associated with the secure microcontroller; and

communicating with the authentication server through an application configured to be aware of the hardware associated with the secure microcontroller during the registration and the authentication of the storage controller, the application being configured to communicate with the secure microcontroller and the BIOS on the storage controller through an appropriate device driver.

13. The method of claim 11, further comprising:

configuring the storage controller with a signature data of the authentication server, the authentication server also being configured to be interfaced with a secure microcontroller configured to store the signature data thereof; and

configuring the authentication server with the signature data of the storage controller

prior to registering the storage controller with the authentication server.

14. A method of transacting a storage security service in a cloud storage environment comprising:

implementing, through a cloud manager of the cloud storage environment, security as a service in the cloud storage environment, the cloud manager being configured to provision storage in the cloud storage environment;

transmitting, to a customer of the security as a service, security information about a storage controller associated therewith in accordance with a security level of access provided thereto through the cloud manager; and

generating, through the cloud manager, an invoice associated with the security service to the customer on a basis of an amount of security information requested thereby in accordance with the security level of access and the security information transmitted thereto,

wherein the cloud manager comprises one or more computers.

15. The method of claim 14, wherein the security information about the storage controller associated with the customer includes at least one of information associated with authenticating the customer, attestation confirmation of a computing platform on which data associated with the customer is configured to be stored, signature data of the storage controller associated with the computing platform attestation and at least one parameter other than the signature data of the storage controller.

16. The method of claim 14, further comprising providing at least one of network as a service, performance as a service, storage space as a service, cloud monitoring as a service, engineering support as a service, cloud auto-scaling as a service, and server utilization as a service to the customer, through the cloud manager, as part of the service agreement, in addition to the security service.

17. The method of claim 15, wherein information associated with authenticating the customer is obtained through one of a hardware based authentication scheme and a software based authentication scheme provided through the service provider.

18. The method of claim 15, wherein the signature data of the storage controller includes a list of hashes of at least one of a version of the BIOS on the storage controller, a storage operating system version executing on the storage controller, a physical hardware identification attribute of the storage controller and a configuration information associated with the storage controller.

19. The method of claim 14, further comprising decreasing an amount from the security service invoice when the security information transmitted to the customer fails to correspond to the amount of security information requested by the customer in accordance with the security level of access.

20. The method of claim 17, wherein the hardware based authentication scheme includes:

registering the storage controller with an authentication server configured to be set up in the cloud storage environment; and

authenticating the storage controller based on a communication protocol between a client device associated with the customer, the authentication server and the storage controller.

21. A cloud storage environment providing security as a service, comprising:

a client device associated with a customer of the security as a service;

a storage controller configured to host at least one server associated with the customer; and

a cloud manager comprising one or more computers configured to provision storage associated with the client device in the cloud storage environment, the cloud manager further being configured to;

enable storage of a security level of access of the storage controller associated with the customer in a database associated therewith,

receive a request from the customer to access security information of the storage controller, and

provide security information of the storage controller associated with the customer in accordance with the request and the stored security level of access of the storage controller associated with the customer.

22. The cloud storage environment of claim 21, wherein the security information about the storage controller includes at least one of information associated with authenticating the customer, attestation confirmation of a computing platform on which data associated with the customer is configured to be stored, signature data of the storage controller associated with the computing platform attestation and at least one parameter other than the signature data of the storage controller.

23. The cloud storage environment of claim 21, wherein the cloud manager is further configured to generate a security service invoice to the customer based on the security information provided thereto.

24. The cloud storage environment of claim 23, wherein the cloud manager is further configured to:

retrieve preferred security information of the storage controller associated with the customer from the database based on the security level of access associated therewith, and

decrease an amount from the security service invoice when the security information provided to the customer fails to conform with the preferred security information.

25. The cloud storage environment of claim 22,

wherein the cloud manager is configured to enable procurement of information associated with authenticating the customer through one of a hardware based authentication scheme and a software based authentication scheme provided therethrough, and

wherein the information associated with authenticating the customer includes a confirmation that the storage controller associated with the customer is secure.

26. The cloud storage environment of claim 22, wherein the signature data of the storage controller includes a list of hashes of at least one of a version of the BIOS on the storage controller, a storage operating system version executing on the storage controller, a physical hardware identification attribute of the storage controller and a configuration information associated with the storage controller.

27. The cloud storage environment of claim 22, further comprising a computer network configured to enable communication between the client device and the cloud manager.

28. The cloud storage environment of claim 23,

wherein the storage controller comprises a secure microcontroller interfaced therewith to authenticate the computing platform, and

wherein the cloud storage environment further comprises an authentication server configured to register the storage controller and to authenticate the storage controller based on a communication protocol between the client device, the storage controller and the authentication server.