Maintaining trust on a data storage network
Trust may be maintained between a storage system and a host system by the host system validating its identity to the storage system. The storage system may instruct the host system to validate itself by setting a validation flag on the storage system. The host system may be configured to determine whether the validation flag is set. If the host system determines that the validation flag is set, the host system then may read a test string from the storage system. The host system may encrypt the test string using a private key, and send the encrypted test string to the storage system. The storage system may decrypt the encrypted string using a public key it previously received from the host system. The decrypted test string then may be compared against the original test string generated by the storage system.
1. A method of validating a host system to a storage system for a first logical storage unit on the storage system corresponding to the host system, comprising:
defining a verification security level for the first logical storage unit;
providing a data structure including a plurality of entries, each entry representing a logical storage unit of the storage system and specifying a host port with which the represented logical storage unit is enabled to communicate I/O over a storage port of the storage system;
storing the verification security level of the first logical storage unit in an entry of the data structure representing the first logical storage unit; and
validating the host system to the storage system for the first logical storage unit multiple times, wherein a frequency of the performance of the validation is based on the verification security level of the first logical storage unit, and wherein the validating includes:
the host system reading a test string from the storage system;
the host system encrypting the test string with a private key of the host system;
the host system sending the encrypted test string to the storage system; and
the storage system decrypting the test string using a public key of the host system.
2. The method of claim 1 , wherein the validating further includes:
prior to the host system reading the test string, the storage system generating the test string; and
determining whether the decrypted test string matches the generated test string.
3. The method of claim 2 , wherein the validating further includes:
when the decrypted test string matches the generated test string, allowing the host system to access data of the first logical storage unit on the storage system.
4. The method of claim 2 , wherein the validating further includes:
when the decrypted test string does not match the generated test string, preventing the host system from accessing data of the first logical storage unit on the storage system.
5. The method of claim 1 , further comprising:
setting a value for a parameter on the storage system to indicate to the host system to validate the host system to the storage system for the first logical storage unit; and
setting a value for a test string on the storage system,
wherein the validating further includes:
the host system determining the value of the parameter, and
the host system reading the test string in response to determining the value.
6. The method of claim 5 , wherein the host system periodically polls the storage system, at a frequency based on the verification security level of the first logical storage unit, to determine the value of the parameter.
7. A system comprising:
one or more processors;
a data structure including a plurality of entries, each entry representing a logical storage unit of the storage system and specifying a host port with which the represented logical storage unit is enabled to communicate I/O over a storage port of the storage system; and
memory comprising code stored thereon that, when executed, performs a method of validating a host system to a storage system for a first logical storage unit on the storage system corresponding to the host system, including:
defining a verification security level for the first logical storage unit;
storing the verification security level of the first logical storage unit in an entry of the data structure representing the first logical storage unit; and
validating the host system to the storage system for the first logical storage unit multiple times, wherein a frequency of the performance of the validation is based on the verification security level of the first logical storage unit, and wherein the validating includes:
the host system reading a test string from the storage system;
the host system encrypting the test string with a private key of the host system;
the host system sending the encrypted test string to the storage system; and
the storage system decrypting the test string using a public key of the host system.
8. The system of claim 7 , wherein the validating further includes:
prior to the host system reading the test string, the storage system generating the test string; and
determining whether the decrypted test string matches the generated test string.
9. The system of claim 8 , wherein the validating further includes:
when the decrypted test string does not match the generated test string, allowing the host system to access data of the first logical storage unit on the storage system.
10. The system of claim 8 , wherein the validating further includes:
when the decrypted test string matches the generated test string, preventing the host system from accessing data of the first logical storage unit on the storage system.
11. The system of claim 7 , wherein the method further comprises:
setting a value for a parameter on the storage system to indicate to the host system to validate the host system to the storage system for the first logical storage unit; and
setting a value for a test string on the storage system,
wherein the validating further includes:
the host system determining the value of the parameter, and
host system reading the test string in response to determining the value.
12. The system of claim 11 , wherein the host system periodically polls the storage system, at a frequency based on the verification security level of the first logical storage unit, to determine the value of the parameter.
13. One or more computer-readable non-transitory media having software stored thereon, the execution of which results in validating a host system to a storage system for a first logical storage unit on the storage system corresponding to the host system, the software comprising:
executable code that defines a verification security level for the first logical storage unit
executable code that accesses a data structure including a plurality of entries, each entry representing a logical storage unit of the storage system and specifying a host port with which the represented logical storage unit is enabled to communicate I/O over a storage port of the storage system; and
executable code that stores the verification security level of the first logical storage unit in an entry of the data structure representing the first logical storage unit; and
executable code that validates the host system to the storage system for the first logical storage unit multiple times, wherein a frequency of the performance of the validation is based on the verification security level of the first logical storage unit, including:
executable code that controls the host system to read a test string from the storage system;
executable code that controls the host system to encrypt the test string with a private key of the host system;
executable code that controls the host system to send the encrypted test string to the storage system; and
executable code that controls the storage system to decrypt the test string using a public key of the host.
14. The one or more computer-readable non-transitory media of claim 13 , the executable code that validates the host system to the storage system for the first logical storage unit further comprising:
executable code that, prior to the host system reading the test string, controls the storage system generating the test string; and
executable code that determines whether the decrypted test string matches the generated test string.
15. The one or more computer-readable non-transitory media of claim 14 , the executable code that validates the host system to the storage system for the first logical storage unit further comprising:
executable code that, when the decrypted test string matches the generated test string, allows the host system to access data of the first logical storage unit on the storage system.
16. The one or more computer-readable non-transitory media of claim 14 , the executable code that validates the host system to the storage system for the first logical storage unit further comprising:
executable code that, when the decrypted test string does not match the generated test string, prevents the host system from accessing data of the first logical storage unit on the storage system.
17. The one or more computer-readable non-transitory media of claim 13 , the software further comprising:
executable code that sets a value for a parameter on the storage system to indicate to the host system to validate the host system to the storage system for the first logical storage unit; and
executable code that sets a value for a test string on the storage system,
wherein the executable code that validates the host system to the storage system for the first logical storage unit further includes:
executable code that controls the host system determining the value of the parameter,
executable code that controls the host system reading the test string in response to determining the value.