Data access control system and method for storage system

Abstract

The invention discloses a data access control system and method for a storage system. The data access control system for the storage system comprises four logical functional parts which include a security policy server, an application server and access security agent, a storage security gateway and a storage system. According to the data access control system and method for the storage system, security load information for data block access is generated according to a security policy, the security load of data is transmitted and stored, a protocol is analyzed so that the security load can be obtained, the legality of an access request is calculated and verified according to the security load, and whether data access is allowed or not is controlled. According to the data access control system for the storage system, due to the fact that the security load is added to a data access protocol layer of the storage system, the security load is analyzed through security agent software, data access control is conducted according to the security load, in this way, higher-intensity and higher fine security control over data access can be achieved in the true sense.

Description

technical field [0001] The invention relates to the field of information security in the information technology, in particular to the access control technology for data in the data storage system. Background technique [0002] In the cloud computing environment, the data storage system architecture has undergone great changes, facing more complex application and service scenarios, such as the application of storage virtualization technology and the emergence of cloud storage services, so that user data in the storage system often faces More threats from within the Internet and cloud computing systems. Traditional access control methods for data are mainly implemented at the application layer and service layer, which makes it difficult to resist the security threats brought by this open environment. [0003] The current security methods for data storage systems mainly include access control lists (ACLs), identity authentication, data encryption, and so on. There are some pr...

AI Technical Summary

Problems solved by technology

For example, once the ACL control list is tampered with on the application layer or the VLAN-based security configuration rules are set unreasonably, it is easy to cause data security risks.

Especially when the storage system is becoming more and more open, this kind of application layer security problem poses a greater security threat to the storage system, and the existing technology does not specifically consider reducing the risk

Secondly, this type of technology is often used for device-level authentication and control, and it is difficult to implement fine-grained and stricter security control on the data itself. Identity authentication with switch devices, ACL is based on the network layer to control the access IP address to realize the isolation of network traffic, and does not really control the access of the data operation itself

[0009] Technologies such as data encryption and decryption and IPsec are not widely used in storage systems due to relatively high application costs, complex management and configuration, and affect performance to a certain extent.

In terms of security, this type of technology also has limitations. For example, data encryption and decryption technology is a passive defense technology. Its security mainly depends on the management of keys and the authorization of users to use keys, so it also depends on the application layer. Security, if the encryption and decryption key management is not perfect or the authorization and authentication of the user by the application layer are breached, the data encryption and decryption will be useless

Images