Emc IP Holding Company LLC

Emc Corporation

Subhasish Chakraborty

Hongyu Zhang

Terry Gene Hahn

Ravi V Chitloor

Richa Saraf

Ephraim Dror

Uday Jonnala

David Lin

Thomas Alan Bean

Shufeng Huang

Rodney Edward Radford

Shruthi Herale

Catherine E Agbaw

Manish Chhabra

Sunil Prabhakar

David Alexander Darling

Xiaoyin Hu

A data storage device includes advertised internet protocol (IP) addresses, a logical data storage, and a resource request processor. The logical data storage includes an object storage. The resource request processor obtains a data access request that includes a destination IP address and that requests a portion of data stored in the object storage. The resource request processor makes a determination to allow access to the portion of the data based on a multifactor authorization. The multifactor authorization is based, at least in part, on an association between the destination IP address and the portion of the data. In response to the determination, resource request processor provides the portion of the data to a requestor specified in the data access request.

System and method for local data IP based network security for preventing data breach attempts in a multi-tenant protection storage deployment

In one embodiment, a request is received from a remote device of a user for configuring a tenant-unit of a storage system via a secure connection session. A secure multi-tenancy (SMT) module determines a first network identity associated with the secure connection session. The SMT module examines an SMT registry namespace associated with the tenant-unit of the tenant to determine a second network identity that has been assigned to the tenant-unit. The first network identity is compared with the second network identity. The request is allowed to configure the tenant-unit in response to determining that the first and second network identities match; otherwise, the request is denied.

System and method for tenant network identity-based authentication and authorization for administrative access in a protection storage system

A first request is received from a first user to access a first file system management objects (FSMOs) of a first tenant unit (TU), the first TU being one of a plurality of TUs. The first FSMO is one of a plurality of FSMOs, each FSMO containing namespace information of a particular tenant. In response to the first request, it is determined whether the first user is authorized to access the first FSMO, including identifying TUs that are associated with the first user, determining whether the first TU is included in the TUs, and if so, determining whether the first FSMO is included in FSMOs associated with the first TU. In response to determining that the first FSMO is included in a set of one or more FSMOs that are associated with the first TU, the first user to access the first FSMO is allowed.

System and method for secure multi-tenancy in datadomain operating system (DDOS), a purpose built backup appliance (PBBA) operating system

A request is received from a first agent, the request having a filesystem namespace and an operation identifier (ID) identifying one or more operations to be performed within the file system namespace. In response to the request, a security unit is identified based on a first agent ID identifying the first agent. It is determined whether the security unit contains an operation set ID corresponding to the operation ID of the request. It is determined whether the security unit contains information identifying a set of one or more file system management object (FSMOs) associated with the requested filesystem namespace. The one or more operations are allowed to be performed on the one or more FSMOs, in response to determining that the security unit contains information matching the operation ID of the request and the filesystem namespace of the first request.

System and method for creating security slices with storage system resources and related operations relevant in software defined/as-a-service models, on a purpose built backup appliance (PBBA)/protection storage appliance natively

A method for replicating data from a plurality of storage systems to a target storage system. The method implemented at the target storage system receives a replication request to replicate data from a source storage system to the target storage system, where the target storage system stores data replicated from the plurality of source storage systems. In response to the replication request, the target storage system identifies a replication resource limit associated with the data to be replicated from the source storage system. The target storage system then determines whether a replication resource requested by the replication request has exceeded the replication resource limit. The target storage system thus allows the replication resource to replicate data from the source storage system, in response to the replication resource not exceeding the replication resource limit.

System and methods for replication resource management in asymmetric secure multi-tenancy deployments in protection storage

A data storage device includes egress ports, a logical data storage, and a packet processor. The local data storage includes resources allocated to multiple tenants. The packet processor obtains packets that include data stored in the resources of the logical data storage. The obtained packets are addressed to a packet destination. The packet processor selects an egress port of the egress ports based on mappings between the data and the multiple tenants. The packet processor sends the packets via the selected egress port.

System and method for physical data packets isolation for different tenants in a multi-tenant protection storage environment

A request is received from a client device of a user for configuring a tenant of a multi-tenant storage system, the multi-tenant storage system storing data for different tenants. An entity identifier (ID) identifying an entity to be associated exclusively with the tenant is obtained from the request. A lookup operation is performed based on the entity in an SMT registry namespace cache stored in a memory to locate an entry that matches the entity. If no matching entry is found, the request is allowed. If a matching entry is found, a first tenant ID obtained from the request is compared with a second tenant ID stored in the matching entry. The request to configure the tenant is allowed if the first tenant ID matches the second tenant ID. The request is denied if the first tenant ID does not match the second tenant ID.

System and method for ensuring per tenant mutual exclusion of data and administrative entities with low latency and high scale

According to one embodiment, a request is received from a remote device of a user for performing a data management operation from source data represented by a source data management object (DMO) to destination data represented by a destination DMO. A first security mode associated with a source tenant-unit corresponding to the source DMO and a second security mode associated with a destination tenant-unit corresponding to the destination DMO are determined. It is determined whether the user is a system administrator for a storage system corresponding to the source data or the destination data, and whether the user is a tenant administrator for a tenant associated with the source data or the destination data. It is determined whether the data management operation should be allowed based on the first and second security modes.

System and method for security mode-based authorization for data management operations in a multi-tenant protection storage system

Exemplary methods include receiving a message from an agent requesting to perform a first set of operations on a first set of storage namespaces mapped to a first set of file system management objects (FSMOs) in the PBBA. The methods include determining whether to allow or deny the first set of operations based on information stored in a plurality of security units, each security unit comprising of an operation set identifier (ID), a set of FSMO IDs, and an agent ID, wherein the agent ID identifies an agent that is allowed to perform a set of operations identified by the operation set ID on a set of FSMOs in the PBBA identified by the set of FSMO IDs, and in response to determining to allow the first set of operations, performing the first set of operations.

System and method for creating a security slices with storage system resources and related operations relevant in software defined/as-a-service models, on a purpose built backup appliance (PBBA)/protection storage appliance natively

Exemplary methods for providing secure multi-tenancy in a Purpose Built Backup Appliance include creating a set of tenant-units (TUs), associating file system management objects (FSMOs) and users with the TUs. The methods further include maintaining a protocol config-metadata store based on the association of the FSMOs and users with the TUs. In one embodiment, in response to a first request from a first user to access a first FSMO of a first TU, the methods include determining whether the first user is authorized to access the first FSMO based on information of the protocol config-metadata store, and in response to the protocol config-metadata store indicating the first user is authorized to access the first FSMO, allowing the first user to access the first FSMO.

System and method for secure multi-tenancy in an operating system of a storage system

A native protection storage operating system (PSOS) process receives a request specifying an operation having security related implications for elements in the PSOS having a first set of components handling data transfer operations and a second set of components handling configuration operations. A security component stores an identifier of the requester and a security related information element locally within a storage location of the first or second set of components, and accesses, upon receiving the request, the security related information element and requester identifier to match other elements of the network impacted by the request, and performs a security condition specific check to determine whether or not the request is to be allowed or denied. The native process eliminates a need for caching, locking, and chain propagation of the security related information through the PSOS.

Growing community of inventors

Livermore, CA, United States of America

Subhasish Chakraborty