Securing storage control path against unauthorized access
Techniques are described providing secure authentication of control commands executed on a data storage system. A pass code may be generated in accordance with criteria in response to successful two-factor authentication of a user identifier. Providing a valid generated passcode may be required with a control command in order for a data storage system to execute the control command. The control command may be one of a subset of possible control command that may be performed with respect to storage entities, such as logical devices and snapshots thereof. In another embodiment, rather than providing a pass code, the two factor authentication information and user identifier may be provided with the control command whereby successful completion of two-factor authentication of the user identifier and two factor authentication information may be required in order to execute the control command.
1. A method of processing control commands comprising:
receiving first information identifying a first portion of one or more control commands for a second portion of one or more data storage entities, wherein each of the control commands in the first portion is an allowable control command for each of the data storage entities of the second portion;
providing a user identifier and authentication information to a pass code provider;
authenticating the user identifier using the authentication information;
in response to successfully completing said authenticating, generating, by the pass code provider, a pass code used with issuing control commands to at least a first data storage entity of the second portion, wherein said generating uses one or more criteria to generate the pass code and the one or more criteria includes at least one attribute of the first data storage entity;
sending a request to a data storage system over a control path, the request including the pass code and a control command of the first portion;
performing first processing on the data storage system that validates the pass code for use with the control command; and
responsive to successfully validating the pass code, executing the control command.
2. The method of claim 1 , wherein the first portion identifies a subset of allowable control commands.
3. The method of claim 2 , wherein the second portion identifies a subset of one or more data storage entities defined in a data storage system configuration.
4. The method of claim 3 , wherein the second portion identifies a subset of defined logical devices and associated snapshots, and wherein the first portion identifies one or more control commands issued to modify a state associated with any logical device or any snapshot of the second portion.
5. The method of claim 3 , wherein the second portion identifies a subset of defined logical devices and associated snapshots, and wherein the first portion identifies one or more control commands issued to delete any logical device or any snapshot of the second portion.
6. The method of claim 1 , further comprising:
defining one or more policies each identifying a first subset of control commands;
defining a second subset of data storage system entities; and
associating the second subset of data storage system entities with a first of the one or more policies, wherein said associating indicates that each control command identified in said first policy requires a valid pass code to be provided in order for said each control command to be executed by the data storage system.
7. The method of claim 1 , wherein the one or more criteria includes any one or more of: an identifier or serial number of the data storage system, a logical device identifier, a snapshot identifier, a string denoting a date and time, and a network location of the data storage system.
8. The method of claim 7 , wherein the first processing performed by the data storage system that validates the pass code comprises:
determining a computed pass code in accordance with the one or more criteria;
comparing the computed pass code to the pass code received over the control path in the request;
if the computed pass code matches the pass code received, determining that the pass code received has been successfully validated; and
if the computed pass code does not match the pass code received, determining that the pass code received has not been successfully validated.
9. The method of claim 1 , wherein the authentication information is two-factor authentication information and said authentication performs two-factor authentication processing to authenticate the user identifier.
10. The method of claim 9 , wherein the two-factor authentication information includes a user password and a random number generated as part of a random number sequence having a seed value associated with the user identifier.
11. The method of claim 10 , wherein a hardware token or fob generates random numbers of the random number sequence at various points in time and displays each of the generated random numbers on the hardware token or fob at a different one of the various points in time.
12. The method of claim 11 , wherein the hardware token or fob generates a new random number at each occurrence of a fixed time interval.
13. The method of claim 1 , wherein the pass code is valid for any of: performing a specified number of control commands of the first portion, performing any number of control commands of the first portion in a defined time period, and performing any number of control commands before a defined expiration time.
14. The method of claim 1 , wherein the pass code is a hash value generated using a cryptographic hash function having one or more inputs determined in accordance with the one or more criteria.
15. A system comprising:
a processor; and
a memory comprising code stored thereon that, when executed, performs a method of processing control commands comprising:
receiving first information identifying a first portion of one or more control commands for a second portion of one or more data storage entities, wherein each of the control commands in the first portion is an allowable control command for each of the data storage entities of the second portion;
providing a user identifier and authentication information to a pass code provider;
authenticating the user identifier using the authentication information;
in response to successfully completing said authenticating, generating, by the pass code provider, a pass code used with issuing control commands to at least a first data storage entity of the second portion, wherein said generating uses one or more criteria to generate the pass code and the one or more criteria includes at least one attribute of the first data storage entity;
sending a request to a data storage system over a control path, the request including the pass code and a control command of the first portion;
performing first processing on the data storage system that validates the pass code for use with the control command; and
responsive to successfully validating the pass code, executing the control command.
16. The system of claim 15 , wherein the first portion identifies a subset of allowable control commands.
17. The system of claim 16 , wherein the second portion identifies a subset of one or more data storage entities defined in a data storage system configuration.
18. The system of claim 17 , wherein the second portion identifies a subset of defined logical devices and associated snapshots, and wherein the first portion identifies one or more control commands issued to modify a state associated with any logical device or any snapshot of the second portion.
19. A non-transitory computer readable medium comprising code stored thereon that, when executed, performs a method of processing control commands comprising: receiving first information identifying a first portion of one or more control commands for a second portion of one or more data storage entities, wherein each of the control commands in the first portion is an allowable control command for each of the data storage entities of the second portion; providing a user identifier and authentication information to a pass code provider; authenticating the user identifier using the authentication information; in response to successfully completing said authenticating, generating, by the pass code provider, a pass code used with issuing control commands to at least a first data storage entity of the second portion, wherein said generating uses one or more criteria to generate the pass code and the one or more criteria includes at least one attribute of the first data storage entity; sending a request to a data storage system over a control path, the request including the pass code and a control command of the first portion; performing first processing on the data storage system that validates the pass code for use with the control command; and responsive to successfully validating the pass code, executing the control command.