RU194502U1 - Data storage device - Google Patents

Abstract

The utility model relates to the field of data storage systems and, in particular, to the field of multi-protocol data storage devices supporting file and block access protocols. The technical result of the utility model is to provide two-factor authentication to increase the security of access to the interface of the control module and monitor the hardware platform of the data storage device. The data storage device comprises a controller, N HDD connected to the controller inputs / outputs, and a web server is additionally introduced into it, the first input / output of which is connected by a bus to the first input / output of the controller, the Navy controller, the first input / output of which is connected to the third by a bus input / output of the web server, and the second input / output - with the second input / output of the controller; sensors whose input / output is connected to the third input / output of the IUD controller; a power controller, the input / output of which is connected to the fourth input / output of the IUD controller; identification devices, the outputs of which are connected to the second input of the web server. 1 s.p. f-ly, 1 ill.

Description

The utility model relates to the field of data storage systems and, in particular, to the field of multi-protocol data storage devices supporting file and block access protocols.

A multi-protocol data storage device is known that implements integrated support for file and block access protocols (RF patent No. 2302034). A data storage system is a computer with an information storage service operating on it, which is based on the organization of information on rewritable read-only memory devices, for example, memory blocks, tapes or disks. A storage system is typically installed in a storage area network (SAN) environment or in a network attached storage (NAS) environment. The data storage system (SHD) used in the NAS environment can be implemented as a file server having an operating system, which, in turn, supports a file system through which the logical organization of information in the form of a hierarchical structure of directories and files (for example, on disks). Each “disk” file can be a set of data structures, for example, blocks on a disk, configured to store information, for example, the file data itself. In turn, the directory may be a special format file that stores information about other files and directories.

Also known is an external data storage system (patent No. 2383952).

In general, storage consists of hard disks (HDDs), an input / output controller, and a combining system. Drives, as a rule, support "hot swapping", that is, they can be connected and disconnected on the fly, without turning off the drive. This makes it possible to replace a failed hard drive without any troubles for the user. The primary and backup drive power supplies have enhanced reliability and are also hot-swappable.

The disk storage controller is its center. He is responsible for input / output of data within the system and to external channels, as well as for the organization of storage and access to information. Storage controllers typically use SCSI, Fiber Channel, or Ethernet to communicate with the outside world. Depending on the purpose of the system, the controllers can implement different logic of work and apply various data exchange protocols. They provide data for users' systems at the block level, like hard drives, or file services via NFS, CIFS, and Network File System, Common Internet File System like file systems. Such a controller typically supports standard RAID levels to increase system performance and provide fault tolerance.

The closest technical solution is the device described in http://ko.com.ua/sistemy_hraneniya_dannyh_nachalnogo_urovnya_14866?site=mobile - prototype.

This data storage device comprises a controller, N HDDs connected to the controller by inputs / outputs.

The technical result of the utility model is to provide two-factor authentication to increase the security of access to the interface of the control module and monitor the hardware platform of the data storage device.

The technical result is achieved by the fact that in a data storage device containing a controller, N HDD connected to the controller I / O, a web server is additionally introduced, the first input / output of which is connected by a bus to the first input / output of the controller, the Navy controller, the first input / output which is connected by a bus to the third input / output of the web server, and the second input / output - to the second input / output of the controller; sensors whose input / output is connected to the third input / output of the IUD controller; a power controller, the input / output of which is connected to the fourth input / output of the IUD controller; identification devices, the outputs of which are connected to the second input of the web server.

Comparison with the prototype shows that the inventive device is characterized by the presence of new units and their connections between them. Thus, the claimed device meets the criterion of "novelty."

A comparison of the proposed solution with other technical solutions shows that the listed elements used in the blocks are known, however, their introduction in this connection with the other elements leads to the solution of a new problem of uninterrupted power supply of the data storage system. This confirms the conformity of the technical solution to the criterion of "significant differences".

In FIG. 1 shows a general block diagram of the proposed device, which includes N hard drives (HDD) 1, controller 2, web server 3, controller IUD 4, power controller 5, sensors 6, identification devices 7.

The device operates as follows.

One of the components of the data storage device is the Navy 4 controller, designed for autonomous monitoring and control of functions built directly into the hardware and firmware of server platforms. Main functions:

Monitoring the hardware platform of the prototype;

 Remote prototype control

Connection of virtual devices;

Delegation of devices of a remote workstation to a prototype;

Journaling

Inventory.

These functions are available independently of the processor, BIOS, and operating system. Platform management features may be available even if the system is turned off. Among the sensors 6 can be identified:

Temperature sensors (processor, RAM, hard disk controller, individual zones of the prototype, etc.);

Voltage sensors of various elements;

Sensors of rotation speeds of coolers of the prototype cooling system;

Power sensors power supplies;

Indicators of the presence and performance of power supplies;

Prototype cover removal sensor;

Self-test sensor IUD controller.

When using the functions of remote control and connecting virtual devices from a remote workstation, it becomes possible for an attacker to steal sensitive information.

Access to such functionality should be strictly limited, as it is potentially a channel for data leakage. However, in most existing systems, access control is provided by the web server by user name and password.

It is proposed to use more than one authentication factor. The authentication method "username - password" refers to factors like "Something we know." It is proposed to use authentication devices (“something we have”) or biometric means (“something we are”).

Access to such functionality should be strictly limited, as it is potentially a channel for data leakage. However, in most existing systems, access control is provided by the web server by user name and password.

When the standby power is supplied, the BMS 4 (Baseboard Management Controller) is launched. He polls sensors, connects to a hardware platform. After that, the web server 3 starts, which is available at a pre-configured address through the BIOS address. At the entrance, it is required to pass the first authentication by name and password, which is provided by the web server. If this verification is successful, a second authentication is required through another, isolated channel to provide greater security.

It can be a hardware USB token (a compact device designed to ensure the information security of the user is also used to identify its owner, secure remote access to information resources, etc. As a rule, this is a physical device used to simplify authentication), the application one-time password generator, SMS authentication, fingerprint sensor, retina scanner and other means of identity verification.

The principle of operation of these tools varies, but in the end the user will be either authenticated or blocked. Depending on the choice of means of authentication, appropriate actions will be taken to verify. In the case of working with a hardware token, a work driver is searched for at the workstation, with the help of which data is exchanged with the key. To activate and access key data, a custom token code is used. After that, the system checks whether the authentication data matches the user who is trying to authenticate with their help. In the event of a successful identification, access is granted to all subsystems of the control and monitoring module.

Thus, in the proposed data storage device to ensure the information security of the user, two-factor authentication is provided.

Claims (2)

1. A data storage device comprising a controller, N HDD connected by inputs / outputs to the controller, characterized in that it additionally includes a web server, the first input / output of which is connected by a bus to the first input / output of the controller, the Navy controller, the first input / the output of which is connected by a bus to the third input / output of the web server, and the second input / output - to the second input / output of the controller; sensors whose input / output is connected to the third input / output of the IUD controller; a power controller, the input / output of which is connected to the fourth input / output of the IUD controller; identification devices, the outputs of which are connected to the second input of the web server. 2. The device according to p. 1, characterized in that all its elements are made using digital technology.

Images