Cloud-based management of access to a data storage system on a local network
Systems and methods are disclosed for managing access between a data storage server and a client that are on the same local network. Access is managed using a cloud service that is remote from both the data storage server and the client requesting access to the server. The cloud-based management of local connections described herein simplifies the process of connecting to a data storage server on a local network from a client program or device. Connections are authorized based on the use of a local code. The local code is generated by the cloud service and includes a concatenation of a device identifier associated with the data storage server and a time-varying value, such as a timestamp.
1. A network-attached storage device (NAS) comprising:
a non-volatile memory module;
a wide area network interface;
a local network interface; and
control circuitry coupled to the non-volatile memory module, to the wide area network interface, and to the local network interface and configured to:
receive, from a client over the local network interface, a request to retrieve a local code comprising a code generated by a cloud service that authorizes access to the client over a local network;
send, to the cloud service over the wide area network interface, a request for the local code;
receive, from the cloud service over the wide area network interface, the local code, the local code comprising a concatenation of a device identifier associated with the NAS and a time-varying value;
send, to the client over the local network interface, the local code received from the cloud service; and
provide, to the client over the local network interface, access to files stored on the non-volatile memory module responsive to an indication of successful attachment from the cloud service.
2. The NAS of claim 1 , wherein the local code is encrypted using Advanced Encryption Standard (AES) encryption.
3. The NAS of claim 1 , wherein the control circuitry is further configured to send, to the cloud service, the device identifier associated with the NAS.
4. The NAS of claim 1 , wherein the control circuitry is further configured to send, to the cloud service, an internet protocol (IP) address of the NAS.
5. The NAS of claim 1 , wherein the time-varying value is a timestamp.
6. The NAS of claim 1 , wherein the control circuitry is further configured to determine that the request from the client was received over the local network interface.
7. A computing device comprising:
data storage means for storing computer executable instructions;
network interface means for connecting to a data storage server over a local network and to a cloud service over a wide area network; and
control means for controlling the data storage means and the network interface means and configured to, upon execution of the computer executable instructions:
send, to the data storage server using the network interface means, a request for a local code comprising a code generated by a cloud service that authorizes access to the data storage server over the local network;
receive, from the data storage server, the local code, the local code comprising a concatenation of a device identifier associated with the data storage server and a time-varying value;
send, to the cloud service over the wide area network, an attachment request with the local code; and
establish, responsive to an indication from the cloud service that the attachment request succeeded, a connection with the data storage server using the network interface means such that the computing device is provided access to files stored on the data storage server.
8. The computing device of claim 7 , wherein the control means is further configured to encrypt communication with the cloud service.
9. The computing device of claim 7 , wherein the time-varying value is a timestamp.
10. The computing device of claim 7 , wherein the control means is further configured to determine an internet protocol (IP) address of the data storage server on the local network.
11. A cloud service communicatively coupled over a wide area network to a data storage server and to a client device, the cloud service comprising:
a non-volatile memory module;
a network interface; and
control circuitry coupled to the non-volatile memory module and to the network interface and configured to:
receive, from the data storage server, a request for a local code comprising a code generated by the cloud service that authorizes access between the data storage server and the client device over a local network;
generate the local code based at least in part on a concatenation of a unique device identifier associated with the data storage server and a time-varying value;
send, to the data storage server, the generated local code;
receive, from the client device, an attachment request that includes an offered local code;
verify that the offered local code matches the generated local code; and
authorize a connection over a local network between the data storage server and the client device by sending an attachment success indication to the client device thereby allowing the client device access to files stored on the data storage server.
12. The cloud service of claim 11 , wherein the control circuitry is further configured to deny the attachment request responsive to the offered local code not matching the generated local code.
13. The cloud service of claim 11 , wherein the control circuitry is further configured to receive, from the data storage server, the unique device identifier associated with the data storage server.
14. The cloud service of claim 11 , wherein the control circuitry is further configured to encrypt the generated local code.
15. The cloud service of claim 14 , wherein the control circuitry is configured to encrypt the generated local code using a symmetric encryption algorithm.
16. The cloud service of claim 11 , wherein the time-varying value is a timestamp associated with the generation of the local code.
17. The cloud service of claim 11 , wherein the control circuitry is further configured to store the generated local code.
18. The cloud service of claim 11 , wherein the control circuitry is further configured to receive unique device identifiers from a plurality of data storage servers.
19. The cloud service of claim 18 , wherein the control circuitry is further configured to generate unique local codes for each of the plurality of data storage servers based at least in part on the unique device identifiers.
20. The cloud service of claim 11 , wherein the attachment request further includes an indication of a targeted data storage server.