Multi-array user authorization for cloud-based storage systems

Patent metadata

Field	Value
Publication number	US-12489755-B2
Application number	US-202418607843-A
Country	US
Kind code	B2
Filing date	Mar 18, 2024
Priority date	May 29, 2015
Publication date	Dec 2, 2025
Grant date	Dec 2, 2025

Abstract

Providing authorization and authentication in a cloud for a user of a storage array includes: receiving, by a storage array access module from a client-side array services module, a token representing authentication of user credentials and authorized access privileges defining one or more storage array services accessible by the user, where the token is generated by a cloud-based security module upon authentication of the user credentials and identification of authorized access privileges for the user; receiving, by the storage array access module from the user, a user access request to one or more storage array services; and determining, by the storage array access module, whether to grant the user access request in dependence upon the authorized access privileges represented by the token.

First claim

What is claimed is:

1 . A method comprising:
determining, by a storage array access module, that a user is authorized to access at least one of a plurality of storage systems based on a token representing user access privileges defined by user profiles including at least one multi-array profile specifying access privileges for the plurality of storage systems; and initiating, by the storage array access module, a storage session between the user and a storage array, wherein the storage array access module grants access to a plurality of storage arrays for the user based on a single receipt of the token.

2 . The method of claim 1 , wherein access privileges are defined in a cloud-based security module for a plurality of users with an association of each user with one of a plurality of profiles.

3 . The method of claim 2 , wherein each user profile specifies access privileges for a user associated with the user profile.

4 . The method of claim 2 , wherein the plurality of profiles comprise at least one multi-array profile specifying access privileges for a plurality of storage systems.

5 . The method of claim 2 , wherein the plurality of profiles comprise:
a read-only profile specifying, for users associated with the read-only profile, read-only access privileges; a modify profile specifying, for users associated with the modify profile, read and modify access privileges; and an administrator profile specifying, for users associated with the administrator profile, all available access privileges.

6 . The method of claim 2 , wherein the cloud-based security module comprises a cloud identity provider (‘IDP’).

7 . The method of claim 2 , wherein the cloud-based security module comprises a component of a cloud-based storage services provider.

8 . The method of claim 2 , wherein the cloud-based security module comprises a lightweight directory access protocol directory service.

9 . The method of claim 1 , wherein:
access privileges are further defined in a storage system access module for a plurality of users, further comprising determining whether to grant a user access request based on authorized access privileges represented by the token by determining whether to grant the user access request in dependence upon the access privileges defined in the storage system access module as well as the token.

10 . An apparatus comprising:
a memory; and a processing device operatively coupled to the memory, the processing device configured to: determine, by a storage array access module, that a user is authorized to access at least one of a plurality of storage systems based on a token representing user access privileges defined by user profiles including at least one multi-array profile specifying access privileges for the plurality of storage systems; and initiate, by the storage array access module, a storage session between the user and a storage array, wherein the storage array access module grants access to a plurality of storage arrays for the user based on a single receipt of the token.

11 . The apparatus of claim 10 , wherein access privileges are defined in a cloud-based security module for a plurality of users with an association of each user with one of a plurality of profiles.

12 . The apparatus of claim 11 , wherein each user profile specifies access privileges for a user associated with the user profile.

13 . The apparatus of claim 11 , wherein the plurality of profiles comprise at least one storage-array specific profile specifying access privileges for a single storage system.

14 . The apparatus of claim 11 , wherein the plurality of profiles comprise:
a read-only profile specifying, for users associated with the read-only profile, read-only access privileges; a modify profile specifying, for users associated with the modify profile, read and modify access privileges; and an administrator profile specifying, for users associated with the administrator profile, all available access privileges.

15 . The apparatus of claim 11 , wherein the cloud-based security module comprises a cloud identity provider (‘IDP’).

16 . The apparatus of claim 11 , wherein the cloud-based security module comprises a component of a cloud-based storage services provider.

17 . The apparatus of claim 11 , wherein the cloud-based security module comprises a lightweight directory access protocol directory service.

18 . A non-transitory computer-readable storage medium having instructions stored thereon, which when executed by a processing device, cause the processing device to:
determine, by a storage array access module, that a user is authorized to access at least one of a plurality of storage systems based on a token representing user access privileges defined by user profiles including at least one multi-array profile specifying access privileges for the plurality of storage systems; and initiate, by the storage array access module, a storage session between the user and a storage array, wherein the storage array access module grants access to a plurality of storage arrays for the user based on a single receipt of the token.

19 . The non-transitory computer-readable storage medium of claim 18 , wherein access privileges are defined in a cloud-based security module for a plurality of users with an association of each user with one of a plurality of profiles.

20 . The non-transitory computer-readable storage medium of claim 19 , wherein each user profile specifies access privileges for a user associated with the user profile.

Assignees

• Pure Storage Inc

Inventors

• Hu Jimmy T
• Borowiec Benjamin
• Miller Ethan
• Noonan Terence
• Sapuntzakis Constantine
• Vachharajani Neil
• Zuo Daquan

Classifications

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L2209/72

  Signcrypting, i.e. digital signing and encrypting simultaneously · CPC title