Authenticated boot to protect storage system data by restricting image deployment
A boot image is modified to require authentication based on stable system values that are uniquely associated with a storage array. The stable system values may be used as a key to decrypt a password. The modified boot image will not allow booting to proceed without the decrypted password. The password cannot be decrypted based on different stable system values such as the stable system values of other storage arrays.
1. An apparatus comprising:
a storage array comprising:
a plurality of interconnected computing nodes that manage access to a plurality of data storage drives;
a boot image generator that creates a modified boot image for the storage array by retrieving stable system values, combining the stable system values via concatenation to generate concatenated stable system values, hashing the concatenated stable system values to generate a hash value that is uniquely associated with the storage array, using a portion of the hash value as a key to encrypt a password, and inserting the encrypted password into a boot image for the storage array; and
authentication code that performs authentication on an attempted boot from the modified boot image by retrieving the stable system values from the storage array, using the retrieved stable system values to generate the key, using the key to decrypt the encrypted password, and using the decrypted password to authenticate the attempted boot.
2. The apparatus of claim 1 wherein each of the stable system values is selected from the group comprising: a UUID (universally unique identifier), storage array serial number, MAC address, and guest container name.
3. The apparatus of claim 1 wherein the stable system values are persistently stored by the storage array, do not change, and, either alone or in combination, are uniquely associated with the storage array.
4. A method comprising:
with a storage array:
creating a modified boot image for the storage array by retrieving stable system values and combining the retrieved stable system values via concatenation to generate concatenated stable system values;
hashing the concatenated stable system values to generate a hash value that is uniquely associated with the storage array;
using a portion of the hash value as a key to encrypt a password;
inserting authentication code comprising the encrypted password into a boot image for the storage array; and
in response to an attempted boot from the modified boot image, the authentication code performing authentication on the attempted boot using the value by retrieving the stable system values from the storage array.
5. The method of claim 4 comprising generating the key from the stable system values in response to an attempted boot from the modified boot image.
6. The method of claim 5 comprising decrypting the password with the key and using the password for authentication.