Secure storage access utilizing multi-path layer of host device to identify processes executed on the host device with authorization to access data of a storage system
An apparatus comprises a host device configured to communicate over a network with a storage system comprising a plurality of storage devices. The host device is further configured to execute multiple processes that generate input-output (IO) operations for delivery to the storage system. The host device comprises a multi-path input-output (MPIO) driver configured to store for each of one or more of the storage devices information specifying one or more of the processes executing on the host device that are permitted to access that storage device, and for each of at least a subset of the IO operations, to determine the particular storage device to which the IO operation is directed, to identify the process that generated the IO operation, and to control delivery of the IO operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device.
1. An apparatus comprising:
a host device configured to communicate over a network with a storage system comprising a plurality of storage devices;
the host device being further configured to execute multiple processes that generate input-output operations for delivery to the storage system;
the host device comprising:
a multi-path input-output driver configured to control delivery of the input-output operations to the storage system over selected ones of a plurality of paths through the network;
wherein the multi-path input-output driver is further configured:
to store for each of one or more of the storage devices information specifying one or more of the processes executing on the host device that are permitted to access that storage device; and
for each of at least a subset of the input-output operations:
to determine the particular storage device to which the input-output operation is directed;
to identify the process that generated the input-output operation; and
to control delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device;
wherein the stored information comprises an access table and wherein the access table comprises a plurality of entries for different ones of the storage devices with each such entry comprising identifying information of at least one process permitted to access the corresponding storage device.
2. The apparatus of claim 1 further comprising one or more additional host devices each configured to communicate over the network with the storage system and wherein each additional host device comprises a multi-path input-output driver configured to control delivery of input-output operations from that host device to the storage system over selected ones of a plurality of paths through the network.
3. The apparatus of claim 1 wherein the storage devices comprise respective logical storage volumes of the storage system.
4. The apparatus of claim 1 wherein the identifying information comprises at least one of a process name and a process identifier for the process permitted to access the corresponding storage device.
5. The apparatus of claim 1 wherein at least a portion of the access table is generated by the multi-path input-output driver and is sent by the multi-path input-output driver to the storage system for storage therein.
6. The apparatus of claim 1 wherein the multi-path input-output driver is configured to generate at least portions of an initial version of the access table responsive to at least one of a boot of the host device and an install of one or more applications, the multi-path input-output driver populating the access table with process identifiers at runtime, and wherein a subsequent update to the access table performed in conjunction with an application restart is implemented at least in part as a user-ordered action.
7. The apparatus of claim 1 wherein controlling delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device comprises preventing delivery of the input-output operation to the storage system responsive to the stored information indicating that the identified process is not permitted to access the particular storage device.
8. The apparatus of claim 1 wherein controlling delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device comprises at least one of:
diverting the input-output operation to a designated temporary location responsive to the stored information indicating that the identified process is not permitted to access the particular storage device; and
triggering an alert to the host device responsive to the stored information indicating that the identified process is not permitted to access the particular storage device.
9. The apparatus of claim 1 wherein controlling delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device comprises permitting delivery of the input-output operation to the storage system responsive to the stored information indicating that the identified process is permitted to access the particular storage device.
10. The apparatus of claim 1 wherein one or more of the storage devices are marked as having respective entries in the stored information.
11. The apparatus of claim 10 wherein marking of the storage devices comprises sending one or more predetermined commands to the storage system.
12. The apparatus of claim 1 wherein responsive to a reboot of the host device, the multi-path input-output driver is further configured:
to compare a first version of the access table stored in the host device with a second version of the access table stored in the storage system; and
to trigger an alert to the host device if the first and second versions of the access table do not match one another.
13. The apparatus of claim 1 wherein the multi-path input-output driver is further configured to add an application tag to the input-output operation so as to permit the storage system to perform a validity check on the input-output operation.
14. A method comprising:
executing in a host device multiple processes that generate input-output operations for delivery to a storage system comprising a plurality of storage devices;
implementing a multi-path input-output driver in the host device, the multi-path input-output driver controlling delivery of the input-output operations from the host device to the storage system over selected ones of a plurality of paths through the network; and
configuring the multi-path input-output driver to perform steps of:
storing for each of one or more of the storage devices of the storage system information specifying one or more of the processes executing on the host device that are permitted to access that storage device; and
for each of at least a subset of the input-output operations:
determining the particular storage device to which the input-output operation is directed;
identifying the process that generated the input-output operation; and
controlling delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device;
wherein the stored information comprises an access table and wherein the access table comprises a plurality of entries for different ones of the storage devices with each such entry comprising at least one identifier of a process permitted to access the corresponding storage device.
15. The method of claim 14 wherein controlling delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device comprises at least one of:
preventing delivery of the input-output operation to the storage system responsive to the stored information indicating that the identified process is not permitted to access the particular storage device; and
permitting delivery of the input-output operation to the storage system responsive to the stored information indicating that the identified process is permitted to access the particular storage device.
16. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code, when executed by a host device configured to communicate over a network with a storage system comprising a plurality of storage devices, causes the host device:
to execute multiple processes that generate input-output operations for delivery to the storage system;
to implement a multi-path input-output driver in the host device, the multi-path input-output driver controlling delivery of the input-output operations from the host device to the storage system over selected ones of a plurality of paths through the network; and
to configure the multi-path input-output driver to perform steps of:
storing for each of one or more of the storage devices of the storage system information specifying one or more of the processes executing on the host device that are permitted to access that storage device; and
for each of at least a subset of the input-output operations:
determining the particular storage device to which the input-output operation is directed;
identifying the process that generated the input-output operation; and
controlling delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device;
wherein the stored information comprises an access table and wherein the access table comprises a plurality of entries for different ones of the storage devices with each such entry comprising at least one identifier of a process permitted to access the corresponding storage device.
17. The computer program product of claim 16 wherein controlling delivery of the input-output operation based at least in part on whether or not the stored information indicates that the identified process is permitted to access the particular storage device comprises at least one of:
preventing delivery of the input-output operation to the storage system responsive to the stored information indicating that the identified process is not permitted to access the particular storage device; and
permitting delivery of the input-output operation to the storage system responsive to the stored information indicating that the identified process is permitted to access the particular storage device.
18. The method of claim 14 wherein the identifying information comprises at least one of a process name and a process identifier for the process permitted to access the corresponding storage device.
19. The method of claim 14 wherein at least a portion of the access table is generated by the multi-path input-output driver and is sent by the multi-path input-output driver to the storage system for storage therein.
20. The method of claim 14 wherein responsive to a reboot of the host device, the multi-path input-output driver is further configured to perform the steps of:
comparing a first version of the access table stored in the host device with a second version of the access table stored in the storage system; and
triggering an alert to the host device if the first and second versions of the access table do not match one another.