Location control of cloud data stores
View Patent ↗Embodiments of the present invention utilize a data hash and an associated geotag for authentication of geolocation policies for data object storage in a cloud system. The geotag may be an alphanumeric identifier such as a city name, postal (ZIP) code, and/or latitude-longitude pair. Embodiments include a post-authenticate process, in which, after a data object is retrieved from a BMS, the geographic location of the source is confirmed to ensure the location policies have not been violated. Additionally, embodiments include a pre-authenticate process, in which, prior to storing a data object in a BMS, the geographic location of the BMS that is to receive the data object is confirmed to ensure the location policies will not be violated. Embodiments may use pre-authenticate, post-authenticate, or both pre-authenticate and post-authenticate, in order to implement and verify the location policies.
1. A computer-implemented method for confirming a physical storage location of data comprising:
writing a data object to a bare metal storage node, wherein the bare metal storage node comprises a processor, memory coupled to the processor, and the security chip, wherein the security chip is coupled to the processor;
computing a hash of the data object using the processor;
sending the hash to the security chip;
encrypting the hash and a geotag using the security chip to form an encrypted metadata block;
reading the data object and encrypted metadata block from the bare metal storage node;
decrypting the encrypted metadata block to decrypt the hash and the geotag;
computing a new hash for the data object;
comparing the new hash to the decrypted hash and signaling a first error if the new hash is unequal to the decrypted hash;
checking the geotag against a location policy and signaling a second error if the location policy is violated;
performing a pre-authentication prior to the writing of the data object to the bare metal storage node, wherein the pre-authentication comprises:
generating an instant nonce;
sending the instant nonce to the security chip;
encrypting the instant nonce and the geotag using the security chip to form a pre-write encrypted metadata block;
decrypting the pre-write encrypted metadata block to derive a decrypted instant nonce; and
comparing the generated instant nonce to the decrypted instant nonce and signaling a man-in-the-middle error if the generated instant nonce is unequal to the decrypted instant nonce.
2. The method of claim 1 , wherein computing a new hash for the data object comprises computing an md5 hash.
3. The method of claim 1 , wherein computing a new hash for the data object comprises computing a secure hash algorithm (SHA) hash.
4. The method of claim 1 , wherein checking the geotag comprises checking a latitude-longitude value against a predefined geographic region.
5. The method of claim 1 , wherein checking the geotag comprises checking an alphanumeric identifier against a list of approved alphanumeric identifiers.
6. The method of claim 1 , wherein decrypting the encrypted metadata block is performed using a public key.
7. A computer-implemented method for confirming a physical storage location of data comprising:
writing a data object to a bare metal storage node, wherein the bare metal storage node comprises a processor, memory coupled to the processor, and the security chip, wherein the security chip is coupled to the processor;
computing a hash of the data object using the processor;
sending the hash to the security chip;
encrypting the hash and a geotag using the security chip to form an encrypted metadata block;
reading the data object and encrypted metadata block from the bare metal storage node;
decrypting the encrypted metadata block to decrypt the hash and the geotag;
computing a new hash for the data object;
comparing the new hash to the decrypted hash and signaling a first error if the new hash is unequal to the decrypted hash;
checking the geotag against a location policy and signaling a second error if the location policy is violated;
performing a pre-authentication prior to the writing of the data object to the bare metal storage node, wherein the pre-authentication comprises:
generating an instant nonce;
sending the instant nonce to the security chip;
encrypting the instant nonce and the geotag using the security chip to form a pre-write encrypted metadata block;
decrypting the pre-write encrypted metadata block to derive a decrypted instant nonce; and
comparing the generated instant nonce to the decrypted instant nonce and signaling a man-in-the-middle error if the generated instant nonce is unequal to the decrypted instant nonce.
8. The method of claim 7 , wherein computing a new hash for the data object comprises computing an md5 hash.
9. The method of claim 7 , wherein computing a new hash for the data object comprises computing a secure hash algorithm (SHA) hash.
10. The method of claim 7 , wherein checking the geotag comprises checking a latitude-longitude value against a predefined geographic region.
11. The method of claim 7 , wherein checking the geotag comprises checking an alphanumeric identifier against a list of approved alphanumeric identifiers.
12. The method of claim 7 , wherein decrypting the pre-write encrypted metadata is performed using a public key.
13. The method of claim 12 , wherein encrypting the hash and the geotag using the security chip is performed using a private key.
14. A cloud storage system comprising:
a container node computer comprising a processor and memory;
a bare metal storage node (BMS) device, wherein the BMS device comprises:
a processor;
at least one storage device;
a memory coupled to the processor;
a security chip;
a bus coupling the security chip to the processor; wherein the container node memory contains instructions, that when executed by the processor of the container node computer, perform the steps of:
performing a pre-authenticate process, the pre-authenticate process comprising:
generating an instant nonce,
sending the instant nonce to the security chip,
encrypting the instant nonce and a geotag using the security chip to form a pre-write encrypted metadata block,
decrypting the pre-write encrypted metadata block to derive a decrypted instant nonce, and
comparing the generated instant nonce to the decrypted instant nonce and signaling a man-in-the-middle error if the generated instant nonce is unequal to the decrypted instant nonce;
retrieving a data object from the BMS device;
retrieving encrypted metadata for the data object, wherein the encrypted metadata comprises:
a stored hash for the data object; and
the geotag;
decrypting the encrypted metadata;
computing a new hash for the data object;
comparing the new hash to the stored hash and signaling a first error if the stored hash is unequal to the new hash; and
checking the geotag against a location policy and signaling a second error if the location policy is violated.
15. The system of claim 14 , wherein the security chip further comprises a geolocation module.
16. The system of claim 14 , wherein the at least one storage device includes a RAID system.
17. The system of claim 14 , wherein the instructions for computing a new hash for the data object comprises instructions for computing an md5 hash.
18. The system of claim 14 , wherein the instructions for computing a new hash for the data object comprises instructions for computing a secure hash algorithm (SHA) hash.