Quorum-based authorization of requests associated with storage systems
An illustrative method includes detecting a request to perform a restricted operation with respect to a storage system; monitoring, in response to the request, for authorization events pertaining to the restricted operation and performed by a plurality of entities; detecting, while performing the monitoring, that a threshold plurality of the authorization events are performed by the plurality of entities; and directing, based on the detecting that the threshold plurality of authorization events are performed by the plurality of entities, the storage system to perform the restricted operation.
1 . A method comprising:
detecting, by a storage management system, a request to perform a restricted operation with respect to a storage system;
monitoring, by the storage management system in response to the request, for authorization events pertaining to the restricted operation and performed by a plurality of entities;
detecting, by the storage management system while performing the monitoring, that a threshold plurality of the authorization events are performed by the plurality of entities;
directing, by the storage management system based on the detecting that the threshold plurality of authorization events are performed by the plurality of entities, the storage system to perform the restricted operation;
determining, by the storage management system, that a protection group associated with the storage system is disabled;
determining, by the storage management system based on the determining that the protection group associated with the storage system is disabled, that the storage system is possibly being targeted by a security threat; and
performing, by the storage management system based on the determining that the storage system is possibly being targeted by the security threat, a remedial action, the performing the remedial action comprising:
converting a recovery dataset into a protected recovery dataset that cannot be deleted without a specific instruction provided by an authorized entity;
determining, after the performing the remedial action, that the storage system is no longer possibly being targeted by the security threat; and
converting, based on the determining that the storage system is no longer possibly being targeted by the security threat, the protected recovery dataset back into the recovery dataset.
2 . The method of claim 1 , wherein the detecting that the threshold plurality of authorization events are performed by the plurality of entities comprises determining that each entity included in the plurality of entities logs into a cloud service associated with the storage management system and performs, while logged into the cloud service, an identity authentication procedure.
3 . The method of claim 1 , wherein the storage management system is implemented by a computing system communicatively coupled to the storage system by way of a network.
4 . The method of claim 1 , wherein the restricted operation comprises an operation with respect to a recovery dataset configured to be used by the storage system to recover from a data corruption event within the storage system.
5 . The method of claim 4 , wherein the operation with respect to the recovery dataset is configured to perform at least one of a deletion of the recovery dataset, a modification of the recovery dataset, a modification of a policy associated with the recovery dataset, or a modification of a parameter included in a data protection parameter set associated with the recovery dataset.
6 . The method of claim 4 , wherein the data corruption event comprises an attack by a bad actor against the storage system.
7 . The method of claim 1 , wherein the restricted operation comprises a modification of a policy that governs one or more operations performed with respect to the storage system.
8 . The method of claim 7 , wherein the policy identifies the plurality of entities.
9 . The method of claim 1 , wherein the storage management system is implemented by a controller within the storage system.
10 . The method of claim 1 , wherein the directing the storage system to perform the restricted operation is further based on the threshold plurality of authorization events being performed within a predetermined amount of time.
11 . The method of claim 1 , wherein the detecting that the threshold plurality of the authorization events are performed by the plurality of entities comprises detecting that the threshold plurality of the authorization events are performed by a majority of entities included in a set of entities having authorization to perform the authorization events.
12 . The method of claim 1 , wherein the detecting that the threshold plurality of the authorization events are performed by the plurality of entities comprises detecting that a first set of authorization events are performed by a first minimum threshold number of entities included in a first set of entities and that a second set of authorization events are performed by a second minimum threshold number of entities included in a second set of entities.
13 . The method of claim 1 , wherein:
the restricted operation comprises transmitting data from the storage system to an additional storage system; and
the detecting that the threshold plurality of the authorization events are performed by the plurality of entities comprises detecting that a first authorization event is performed by a first entity associated with the storage system and that a second authorization event is performed by a second entity associated with the additional storage system.
14 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
detecting a request to perform a restricted operation with respect to a storage system;
monitoring, in response to the request, for authorization events pertaining to the restricted operation and performed by a plurality of entities;
detecting, while performing the monitoring, that a threshold plurality of the authorization events are performed by the plurality of entities;
directing, based on the detecting that the threshold plurality of authorization events are performed by the plurality of entities, the storage system to perform the restricted operation;
determining that a protection group associated with the storage system is disabled;
determining, based on the determining that the protection group associated with the storage system is disabled, that the storage system is possibly being targeted by a security threat; and
performing, based on the determining that the storage system is possibly being targeted by the security threat, a remedial action, the performing the remedial action comprising:
converting a recovery dataset into a protected recovery dataset that cannot be deleted without a specific instruction provided by an authorized entity;
determining, after the performing the remedial action, that the storage system is no longer possibly being targeted by the security threat; and
converting, based on the determining that the storage system is no longer possibly being targeted by the security threat, the protected recovery dataset back into the recovery dataset.
15 . The system of claim 14 , wherein the detecting that the threshold plurality of authorization events are performed by the plurality of entities comprises determining that each entity included in the plurality of entities logs into a cloud service and performs, while logged into the cloud service, an identity authentication procedure.
16 . The system of claim 14 , wherein the system is implemented by a computing system communicatively coupled to the storage system by way of a network.
17 . The system of claim 14 , wherein the restricted operation comprises an operation with respect to a recovery dataset configured to be used by the storage system to recover from a data corruption event within the storage system.
18 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
detecting a request to perform a restricted operation with respect to a storage system;
monitoring, in response to the request, for authorization events pertaining to the restricted operation and performed by a plurality of entities;
detecting, while performing the monitoring, that a threshold plurality of the authorization events are performed by the plurality of entities;
directing, based on the detecting that the threshold plurality of authorization events are performed by the plurality of entities, the storage system to perform the restricted operation;
determining that a protection group associated with the storage system is disabled;
determining, based on the determining that the protection group associated with the storage system is disabled, that the storage system is possibly being targeted by a security threat; and
performing, based on the determining that the storage system is possibly being targeted by the security threat, a remedial action, the performing the remedial action comprising:
converting a recovery dataset into a protected recovery dataset that cannot be deleted without a specific instruction provided by an authorized entity;
determining, after the performing the remedial action, that the storage system is no longer possibly being targeted by the security threat; and
converting, based on the determining that the storage system is no longer possibly being targeted by the security threat, the protected recovery dataset back into the recovery dataset.
19 . The computer program product of claim 18 , wherein the detecting that the threshold plurality of authorization events are performed by the plurality of entities comprises determining that each entity included in the plurality of entities logs into a cloud service associated with the storage management system and performs, while logged into the cloud service, an identity authentication procedure.