Granted Patent B2

US 11,651,066 · App. 17/143,560 · Granted May 16, 2023

Inventors: Efi Levi (Beer Sheva, IL); Boris Giterman (Beer Sheva, IL); Arieh Don (Newton, MA)

Assignee: EMC IP Holding Company LLC

G06F21/45G06F1/12H04L63/0846H04L67/10

Abstract

Claims (66)

1. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

wherein the at least one processing device is configured:

to control delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network;

to generate a plurality of authentication tokens over time utilizing seed information of the host device; and

for each of one or more of the input-output operations:

to incorporate a particular one of the authentication tokens into the input-output operation;

to send the input-output operation to the storage system; and

to receive an indication from the storage system, responsive to the input-output operation sent to the storage system, as to whether or not the authentication token incorporated into the input-output operation matches a corresponding authentication token generated by the storage system;

wherein the at least one processing device is further configured, responsive to receipt of an indication from the storage system that the authentication token incorporated into the input-output operation does not match the corresponding authentication token generated by the storage system, to send at least one synchronization command to the storage system; and

wherein the at least one processing device implements a multi-path input-output driver of the host device, the multi-path input-output driver being configured to control the delivery of input-output operations from the host device to the storage system over selected ones of the plurality of paths through the network, the multi-path input-output driver being further configured to obtain a given one of the input-output operations and to incorporate the particular one of the authentication tokens into the given input-output operation.

2. The apparatus of claim 1 wherein the at least one processing device comprises at least a portion of the host device.

3. The apparatus of claim 1 wherein generating a plurality of authentication tokens over time utilizing seed information of the host device comprises generating a series of time-based passcodes utilizing the seed information and time information of the host device.

4. The apparatus of claim 1 wherein generating a plurality of authentication tokens over time utilizing seed information of the host device comprises generating a series of event-based passcodes utilizing the seed information and event counter information of the host device.

5. The apparatus of claim 1 wherein generating a plurality of authentication tokens over time utilizing seed information of the host device comprises:

generating a first plurality of authentication tokens over time for a first application executing on the host device, utilizing first seed information of the host device; and

generating a second plurality of authentication tokens over time for a second application executing on the host device, utilizing second seed information of the host device.

6. The apparatus of claim 1 wherein incorporating a particular one of the authentication tokens into the input-output operation comprises:

identifying a particular one of a plurality of applications, executing on the host device, that generated the input-output operation;

determining a current authentication token for the particular application; and

incorporating the current authentication token for the particular application into the input-output operation.

7. The apparatus of claim 1 wherein the seed information of the host device is stored in one or more data structures of the storage system and utilized by the storage system in generating the corresponding authentication token for comparison with the authentication token incorporated into the input-output operation sent to the storage system.

8. The apparatus of claim 1 wherein generating a plurality of authentication tokens over time utilizing seed information of the host device further comprises, for each of a plurality of time periods:

determining current time information in the host device;

combining the current time information with the seed information; and

hashing a result of the combining to generate a current one of the authentication tokens as the particular one of the authentication tokens to be incorporated into the input-output operation.

9. The apparatus of claim 1 wherein incorporating a particular one of the authentication tokens into the input-output operation comprises generating at least one of a read command and a write command that includes at least a portion of the authentication token.

10. The apparatus of claim 1 wherein receiving an indication from the storage system as to whether or not the authentication token incorporated into the input-output operation matches a corresponding authentication token generated by the storage system comprises receiving a notification from the storage system that the input-output operation has been executed by the storage system, wherein said notification is indicative of a match between the authentication tokens.

11. The apparatus of claim 1 wherein receiving an indication from the storage system as to whether or not the authentication token incorporated into the input-output operation matches a corresponding authentication token generated by the storage system comprises receiving a notification from the storage system that the input-output operation has not been executed by the storage system, wherein said notification is indicative of an absence of a match between the authentication tokens.

12. The apparatus of claim 1 wherein the authentication token incorporated into the input-output operation is determined to match the corresponding authentication token generated by the storage system responsive to an exact match between the authentication tokens.

13. The apparatus of claim 1 wherein the authentication token incorporated into the input-output operation is determined to match the corresponding authentication token generated by the storage system responsive to an approximate match between the authentication tokens within a specified time window.

14. The apparatus of claim 1 wherein the at least one synchronization command comprises information utilized to synchronize time clocks between the host device and the storage system.

15. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code, when executed by at least one processing device comprising a processor coupled to a memory, causes the at least one processing device:

to control delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network;

to generate a plurality of authentication tokens over time utilizing seed information of the host device; and

for each of one or more of the input-output operations:

to incorporate a particular one of the authentication tokens into the input-output operation;

to send the input-output operation to the storage system; and

to receive an indication from the storage system, responsive to the input-output operation sent to the storage system, as to whether or not the authentication token incorporated into the input-output operation matches a corresponding authentication token generated by the storage system;

wherein the program code, when executed by the at least one processing device, further causes the at least one processing device, responsive to receipt of an indication from the storage system that the authentication token incorporated into the input-output operation does not match the corresponding authentication token generated by the storage system, to send at least one synchronization command to the storage system; and

wherein the at least one processing device implements a multi-path input-output driver of the host device, the multi-path input-output driver being configured to control the delivery of input-output operations from the host device to the storage system over selected ones of the plurality of paths through the network, the multi-path input-output driver being further configured to obtain a given one of the input-output operations and to incorporate the particular one of the authentication tokens into the given input-output operation.

16. The computer program product of claim 15 wherein generating a plurality of authentication tokens over time utilizing seed information of the host device comprises:

generating a first plurality of authentication tokens over time for a first application executing on the host device, utilizing first seed information of the host device; and

generating a second plurality of authentication tokens over time for a second application executing on the host device, utilizing second seed information of the host device.

17. The computer program product of claim 15 wherein incorporating a particular one of the authentication tokens into the input-output operation comprises:

identifying a particular one of a plurality of applications, executing on the host device, that generated the input-output operation;

determining a current authentication token for the particular application; and

incorporating the current authentication token for the particular application into the input-output operation.

18. A method comprising:

controlling delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network;

generating a plurality of authentication tokens over time utilizing seed information of the host device; and

for each of one or more of the input-output operations:

incorporating a particular one of the authentication tokens into the input-output operation;

sending the input-output operation to the storage system; and

receiving an indication from the storage system, responsive to the input-output operation sent to the storage system, as to whether or not the authentication token incorporated into the input-output operation matches a corresponding authentication token generated by the storage system;

the method further comprising:

responsive to receipt of an indication from the storage system that the authentication token incorporated into the input-output operation does not match the corresponding authentication token generated by the storage system, sending at least one synchronization command to the storage system;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory; and

wherein the at least one processing device implements a multi-path input-output driver of the host device, the multi-path input-output driver being configured to control the delivery of input-output operations from the host device to the storage system over selected ones of the plurality of paths through the network, the multi-path input-output driver being further configured to obtain a given one of the input-output operations and to incorporate the particular one of the authentication tokens into the given input-output operation.

19. The method of claim 18 wherein generating a plurality of authentication tokens over time utilizing seed information of the host device comprises:

generating a first plurality of authentication tokens over time for a first application executing on the host device, utilizing first seed information of the host device; and

generating a second plurality of authentication tokens over time for a second application executing on the host device, utilizing second seed information of the host device.

20. The method of claim 18 wherein incorporating a particular one of the authentication tokens into the input-output operation comprises:

identifying a particular one of a plurality of applications, executing on the host device, that generated the input-output operation;

determining a current authentication token for the particular application; and

incorporating the current authentication token for the particular application into the input-output operation.

Assignments (9)

Continuity (1)

Cited By (4)

US 12,517,682 US 12,518,018 US 12,608,158 US 12,670,120