Scalable and secure high-level storage access for cloud computing platforms

• US 8,997,096 B1
• Filed: 12/04/2012
• Issued: 03/31/2015
• Est. Priority Date: 06/29/2009
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Protopopov, Boris, Leschner, Jurgen
• Primary Examiner(s): Puente, Emerson
• Assistant Examiner(s): KIM, DONG U
• Application Number:
  US13/693,605
• Time in Patent Office: 847 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

An untrusted component exposing a high level storage object interface within an untrusted client virtual machine accepts application level storage object operations. Responsive to a storage object operation, the untrusted component passes a message through the underlying hypervisor to an associated trusted component. The trusted component processes the message by authenticating the client virtual machine and locating an internal mapping between the client virtual machine and an associated customer-specific set of backend storage resources to which the requested storage object operation is to be applied. The trusted component uses a trust relationship with the backend storage system to securely communicate the storage object operation to the backend storage system, and passes the operation results through the hypervisor back to the untrusted component in the source client virtual machine from which the storage object request originated.

Claims

1. A method comprising:

receiving a storage object operation by an untrusted component contained in a client virtual machine;

passing said storage object operation together with a digital signature associated with said client virtual machine through a hypervisor on which said client virtual machine is executing to a trusted component, wherein said trusted component is contained within an access point virtual machine;

processing said storage object operation by said trusted component, said processing including obtaining an identifier of said client virtual machine and determining a customer-specific set of backend storage resources associated with said client virtual machine based on said identifier of said client virtual machine, wherein said customer-specific backend storage resources are associated with an address for a backing store access point, and wherein said processing includes authenticating said client virtual machine based at least in part on said digital signature passed to said trusted component with said storage object operation;

passing said storage object operation from said trusted component to said address for said backing store access point; and

performing said storage object operation on said customer-specific set of backend storage resources.

2. The method of claim 1, wherein said address for said backing store access point comprises an IP address.

3. The method of claim 1, wherein said address for said backing store access point comprises a tuple.

4. The method of claim 1, wherein said address for said backing store access point comprises a root directory location.

5. The method of claim 1, wherein said digital signature associated with said client virtual machine comprises an HMAC (Hashed Message Authentication Codes).

6. The method of claim 1, wherein said digital signature associated with said client virtual machine is created at least in part based on a secret key shared by said client virtual machine and said trusted component.

7. A system comprising:

at least one processor and a non-transitory computer readable storage medium, said non-transitory computer readable storage medium having program code stored thereon, said program code comprising;

program code for receiving a storage object operation by an untrusted component contained in a client virtual machine;

program code for passing said storage object operation together with a digital signature associated with said client virtual machine through a hypervisor on which said client virtual machine is executing to a trusted component, wherein said trusted component is contained within an access point virtual machine;

program code for processing said storage object operation by said trusted component, said processing including obtaining an identifier of said client virtual machine and determining a customer-specific set of backend storage resources associated with said client virtual machine based on said identifier of said client virtual machine, wherein said customer-specific backend storage resources are associated with an address for a backing store access point, and wherein said processing includes authenticating said client virtual machine based at least in part on said digital signature passed to said trusted component with said storage object operation;

program code for passing said storage object operation from said trusted component to said address for said backing store access point; and

program code for performing said storage object operation on said customer-specific set of backend storage resources.

8. The system of claim 7, wherein said address for said backing store access point comprises an IP address.

9. The system of claim 7, wherein said address for said backing store access point comprises a tuple.

10. The system of claim 7, wherein said address for said backing store access point comprises a root directory location.

11. The system of claim 7, wherein said digital signature associated with said client virtual machine comprises an HMAC (Hashed Message Authentication Codes).

12. The system of claim 7, wherein said digital signature associated with said client virtual machine is created at least in part based on a secret key shared by said client virtual machine and said trusted component.

13. A computer program product comprising:

a non-transitory computer readable storage medium, said non-transitory computer readable storage medium having program code stored thereon, said program code comprising;

program code for receiving a storage object operation by an untrusted component contained in a client virtual machine;

program code for passing said storage object operation together with a digital signature associated with said client virtual machine through a hypervisor on which said client virtual machine is executing to a trusted component, wherein said trusted component is contained within an access point virtual machine;

program code for processing said storage object operation by said trusted component, said processing including obtaining an identifier of said client virtual machine and determining a customer-specific set of backend storage resources associated with said client virtual machine based on said identifier of said client virtual machine, wherein said customer-specific backend storage resources are associated with an address for a backing store access point, and wherein said processing includes authenticating said client virtual machine based at least in part on said digital signature passed to said trusted component with said storage object operation;

program code for passing said storage object operation from said trusted component to said address for said backing store access point; and

program code for performing said storage object operation on said customer-specific set of backend storage resources.

14. The computer program product of claim 13, wherein said address for said backing store access point comprises an IP address.

15. The computer program product of claim 13, wherein said address for said backing store access point comprises a tuple.

16. The computer program product of claim 13, wherein said address for said backing store access point comprises a root directory location.

17. The computer program product of claim 13, wherein said digital signature associated with said client virtual machine comprises an HMAC (Hashed Message Authentication Codes).

18. The computer program product of claim 13, wherein said digital signature associated with said client virtual machine is created at least in part based on a secret key shared by said client virtual machine and said trusted component.