System and method for securing access to hash-based storage systems
View Patent ↗Various methods and systems for securing access to hash-based storage systems are disclosed. One method involves receiving information to be stored in a storage system from a storage system client and then generating a key. The key identifies the information to be stored. The value of the key is dependent upon a secret value, which is associated with the storage system. The key is generated, at least in part, by applying a hash algorithm to the information to be stored. The key can then be returned the key to the storage system client. The storage system client can then use the key to retrieve the stored information.
1. A method comprising:
receiving information to be stored in a storage system, wherein
the information is received from a storage system client by a storage controller;
generating a combined value of the information and a secret value, wherein
the secret value is combined with each item of a plurality of items of information stored by the storage system,
the generating the combined value is performed according to a specified algorithm, and
the specified algorithm combines the information with the secret value, wherein
combining the information with the secret value modifies the information such that the combined value is produced and the combined value hashes to a different value than the information;
generating a key, wherein
the key identifies the information,
the key facilitates retrieval of the information by the storage system client,
the key is algorithmically dependent upon the secret value and the information,
the generating the key comprises the storage controller applying a hash algorithm to the combined value of the information and the secret value,
the secret value is unknown by the storage system client, and
the secret value is associated with the storage system;
generating mapping information to map the key to a corresponding location in the storage system;
storing the key and the information identified by the key in the storage system, wherein the information identified by the key is stored in the corresponding location,
as indicated by the mapping information;
returning the key to the storage system client in response to the generating the key,
wherein
the returning the key to the storage system client enables the storage system client to use the key to retrieve the information from the storage system, by virtue of the key being mapped to the corresponding location; and
subsequent to the returning the key, receiving a request from the storage system client to access the information, wherein
the request to access the information comprises the key.
2. The method of claim 1 , further comprising:
generating a random number upon initializing the storage system, wherein the secret value comprises the random number.
3. The method of claim 1 , further comprising:
returning the information to the storage system client, in response to receipt of the key.
4. The method of claim 1 , further comprising:
generating a second key, wherein
the generating the second key comprising applying the hash algorithm to the information,
the generating the second key excludes the secret value, and
the second key is generated concurrently with the key, and
a value of the second key is not based on the secret value.
5. The method of claim 4 , further comprising:
comparing one of the key and the second key to a list of keys; and
in response to the one of the key and the second key matching any key in the list of keys, comparing the other one of the key and the second key with the list of keys to identify whether a hash collision has occurred.
6. The method of claim 1 , wherein the combining is performed using HMAC.
7. The method of claim 1 , wherein the hash algorithm is one of a plurality of types of Secure Hash Algorithm (SHA) or one of a plurality of types of Research and Development in Advanced Communications Technologies in Europe (RACE) Integrity Primitives Evaluation Message Digest (RIPEMD) algorithms.
8. The method of claim 1 , further comprising:
modifying how the hash algorithm is applied to the information, based upon the secret value.
9. The method of claim 1 , further comprising:
detecting at least one of that the secret value has been compromised or the secret value has expired;
generating a second secret value associated with the storage system; and
replacing the secret value with the second secret value.
10. The method of claim 1 , wherein
the secret value is unique to the storage controller,
the secret value is generated, at least in part, by the storage controller, and
the secret value is unavailable to the storage system client.
11. The method of claim 1 , wherein
a plurality of secret values are associated with the storage system, and
each secret value of the plurality of secret values is associated with a respective storage system client of a plurality of storage system clients.
12. The method of claim 1 , further comprising:
dividing the information into a plurality of sub-units;
generating a respective intermediate value for each of the sub-units; and
combining the intermediate values, wherein
combining the intermediate values is performed according to a pre-specified algorithm.
13. A non-transitory computer readable storage medium comprising program instructions executable to:
receive information to be stored in a storage system, wherein
the information is received from a storage system client;
generate a combined value of the information and a secret value, wherein
the secret value is combined with each item of a plurality of items of information stored by the storage system,
generating the combined value is performed according to a specified algorithm, and
the specified algorithm combines the information with the secret value, wherein
combining the information with the secret value modifies the information such that the combined value is produced and the combined value hashes to a different value than the information;
generate a key, wherein
the key identifies the information,
the key facilitates retrieval of the information by the storage system client,
the key is algorithmically dependent upon the secret value and the information,
the generating the key comprises applying a hash algorithm to the combined value of the information and the secret value,
the secret value is unknown by the storage system client, and
the secret value is associated with the storage system;
generate mapping information to map the key to a corresponding location in the storage system;
store the key and the information identified by the key in the storage system,
wherein
the information identified by the key is stored in the corresponding location, as indicated by the mapping information;
return the key to the storage system client in response to the generating the key, wherein
returning the key to the storage system client enables the storage system client to use the key to retrieve the information from the storage system, by virtue of the key being mapped to the corresponding location; and
subsequent to the returning the key, receive a request from the storage system client to access the information, wherein
the request to access the information comprises the key.
14. The non-transitory computer readable storage medium of claim 13 , wherein the program instructions are further executable to:
return the information to the storage system client, in response to receipt of the key.
15. The non-transitory computer readable storage medium of claim 13 , wherein the program instructions are further executable to:
modify how the hash algorithm is applied to the information, based upon the secret value.
16. A storage system controller comprising:
an interface configured to
receive a request to store information in a storage system from a storage system client,
generate mapping information to map a key to a corresponding location in the storage system,
store the key and the information identified by the key in the storage system,
wherein
the information identified by the key is stored in the corresponding location, as indicated by the mapping information;
return the key to the storage system client, wherein returning the key to the storage system client enables the storage system client to use the key to retrieve the information from the storage system, by virtue of the key being mapped to the corresponding location, and
subsequent to the returning the key, receive a request from the storage system client to access the information, wherein
the request to access the information comprises the key; and
an algorithm module coupled to the interface and configured to
generate a combined value of the information and a secret value, wherein
the secret value is combined with each item of a plurality of items of information stored by the storage system,
generating the combined value is performed according to a specified algorithm, and
the specified algorithm combines the information with the secret value, wherein
combining the information with the secret value modifies the information such that the combined value is produced and the combined value hashes to a different value than the information; and
generate the key, wherein
the key identifies the information,
the key facilitates retrieval of the information by the storage system client,
the key is algorithmically dependent upon the secret value associated with the storage system controller and the information,
generating the key comprises the storage controller applying a hash algorithm to the combined value of the information and the secret value,
the secret value is unknown by the storage system client, and
the algorithm module is configured to apply a hash algorithm to the combined value of the information and the secret value in order to generate the key.
17. The storage system controller of claim 16 , wherein the storage system controller is configured to return the information to the storage system client, in response to receipt of the key from the storage system client.
18. The storage system controller of claim 16 , wherein the algorithm module is configured to modify how the hash algorithm is applied to the information, based upon the secret value.
19. A system comprising:
a storage system, wherein the storage system is configured to store information and a key identifying the information;
means for generating mapping information to map the key to a corresponding location in the storage system;
means for storing the key and the information identified by the key in the storage system, wherein
the information identified by the key is stored in the corresponding location, as indicated by the mapping information;
means for receiving the information to be stored in the storage system and returning
the key to a storage system client, wherein
the information is received from the storage system client, and
returning the key to the storage system client enables the storage system client to use the key to retrieve the information from the storage system, by virtue of the key being mapped to the corresponding location;
means for receiving, subsequent to the returning the key, a request from the storage system client to access the information, wherein
the request to access the information comprises the key;
means for generating a combined value of the information and a secret value, wherein
the secret value is combined with each item of a plurality of items of information stored by the storage system,
generating the combined value is performed according to a specified algorithm, and
the specified algorithm combines the information with the secret value, wherein
combining the information with the secret value modifies the information such that the combined value is produced and the combined value hashes to a different value than the information; and
means for generating the key, wherein
the key identifies the information,
the key facilitates retrieval of the information by the storage system client,
the key is algorithmically dependent upon the secret value and the information,
generating the key comprises applying a hash algorithm to the combined value of the information and the secret value,
the secret value is unknown by the storage system client, and
the secret value is associated with the storage system.