Authentication system, authentication method, and network storage appliance

An authentication system, an authentication method, and a network storage appliance are provided. The authentication system includes a client electronic device, the network storage appliance having an authentication proxy, and a directory server having an authentication service module and an account database. The client electronic device selects a data access service and transmits an encrypted data and a user data to the network storage appliance. The authentication proxy packs the encrypted data and the user data into an authentication login information and transmits the authentication login information to the directory server. The authentication service module receives the authentication login information and performs decryption and comparison on the authentication login information according to a corresponding authentication protocol and a corresponding account information in the account database, so as to determine whether the authentication is successful. Then, the authentication service module transmits an authentication response to the network storage appliance.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The invention generally relates to an authentication technique, and more particularly, to a system and a method which carry out a unified authentication by a network storage appliance.

2. Description of Related Art

Nowadays, local area networks (LANs) are broadly deployed. By setting up a network storage appliance connected to computer devices inside an enterprise, the computer devices can access files or data stored in the network storage appliance through LAN connections. Moreover, the network storage appliance allows heterogeneous platforms or clients and servers within a system to share files. For the security of data access, a user has to log into a network storage appliance by using authorized ID and password. Because different data access techniques adopt different authentication protocols, a network storage appliance has to use different account databases to carry out ID/password authentication.

FIG. 1is a diagram of an authentication system. The authentication system100includes an Internet Small Computer System Interface (iSCSI) initiator112, a Common Internet File System (CIFS) client114, a network storage appliance120, and a directory server130. When the iSCSI initiator112sends a connection request to the iSCSI target122through a data flow1, the iSCSI target122sends an authentication comparison request to a local account database126of the network storage appliance120through a data flow2. When the CIFS client114sends a connection request to the CIFS server124through a data flow4, the CIFS server124has to send an authentication comparison request to a remote account database132of the directory server130through a data flow5.

This creates an in-consistent usage paradigm for most of network storage appliance. When a user uses different data access protocols provided by the network storage appliance120, the user may be authenticated by different account databases of the network storage appliance120. When the user changes his/her password, the user does not know whether he/she changes data in the local account database126or data in the remote account database132. When the account information of the user is out of synchronization between the local account database126and the remote account database132, the user is prone to input incorrect ID/password so that the authentication may be failed and the user may be prohibited from accessing any data. In addition, it is very time-consuming and inconvenient for a network system administrator to maintain the account information in both the local account database126and the remote account database132.

SUMMARY OF THE INVENTION

Accordingly, the invention is directed to an authentication system and an authentication method thereof, in which regardless of which type of data access service is selected, a user can perform the login authentication action by using the same ID and password.

The invention is directed to a network storage appliance which allows a user to determine whether to perform authentication comparison by using a remote account database only or a local account database only.

The invention provides an authentication system including a client electronic device, a network storage appliance having an authentication proxy, and a directory server having an authentication service module and an account database. The client electronic device selects a data access service and transmits a first encrypted data and a user data required by the authentication protocol to the network storage appliance. The authentication proxy of the network storage appliance packs the first encrypted data and the user data into an authentication login information and transmits the authentication login information to the directory server. The authentication service module of the directory server receives the authentication login information and performs decryption and comparison according to a corresponding authentication protocol and a corresponding account information in the account database, so as to determine whether the authentication is successful, and then the authentication service module transmits an authentication response to the network storage appliance.

According to an embodiment of the invention, the client electronic device further transmits an authentication request to the network storage appliance. The network storage appliance receives the authentication request, selects an authentication protocol according to the authentication request, and transmits one or a plurality of parameters required by the authentication protocol to the client electronic device.

According to an embodiment of the invention, the client electronic device encrypts the parameters and a password input by a user by using a hashing algorithm, so as to generate the first encrypted data, wherein the authentication proxy of the network storage appliance packs the first encrypted data, the parameters, and the user data into the authentication login information and transmits the authentication login information to the directory server.

According to an embodiment of the invention, the authentication service module selects a password corresponding to the user data from the account database and encrypts the parameters and the password by using the same hashing algorithm, so as to generate a second encrypted data, and the authentication service module determines whether the authentication is successful by comparing the first encrypted data with the second encrypted data.

According to an embodiment of the invention, if the authentication service module determines that the first encrypted data is the same as the second encrypted data, the authentication service module transmits a positive response to the network storage appliance, and if the authentication service module determines that the first encrypted data is different from the second encrypted data, the authentication service module transmits a negative response to the network storage appliance.

According to an embodiment of the invention, the data access service includes one of Internet Small Computer System Interface (iSCSI), Common Internet File System (CIFS), File Transfer Protocol (FTP), Apple Filing Protocol (AFP), HyperText Transfer Protocol (HTTP), or Network File System (NFS).

According to an embodiment of the invention, the directory server is an active directory (AD) server of a Microsoft Windows operating system.

According to an embodiment of the invention, the authentication protocol includes one of Challenge-Handshake Authentication Protocol (CHAP), Kerberos Protocol, New Technology LAN Manager (NTLM), Digest Access Authentication, clear-text password, or encrypted password.

The invention also provides a network storage appliance including an authentication proxy. The authentication proxy packs an encrypted data and a user data from a client electronic device into an authentication login information and transmits the authentication login information to a directory server. Besides, the authentication proxy receives an authentication response indicating whether the authentication is successful from the directory server and transmits an authentication result to the client electronic device.

According to an embodiment of the invention, the network storage appliance further includes one or more file servers coupled to the authentication proxy. The file servers are configured to receive the encrypted data and the user data required by the authentication according to a data access service selected by the client electronic device and transmits the encrypted data and the user data to the authentication proxy to be packed.

According to an embodiment of the invention, the network storage appliance is a storage device adopting the network attached storage (NAS) technique.

The invention further provides an authentication method adapted to an authentication system, wherein the authentication system includes a client electronic device, a network storage appliance, and a directory server. The authentication method includes following steps. An authentication proxy is disposed in the network storage appliance, and an authentication service module and an account database are disposed in the directory server. A data access service is selected and an encrypted data and a user data required by the authentication are transmitted to the network storage appliance by the client electronic device. The encrypted data and the user data are packed into an authentication login information and the authentication login information is transmitted to the directory server by the authentication proxy of the network storage appliance. The authentication login information is received by the authentication service module of the directory server, wherein the authentication service module performs decryption and comparison according to a corresponding authentication protocol and a corresponding account information in the account database to determine whether the authentication is successful, and then the authentication service module transmits an authentication response to the network storage appliance.

As described above, the invention provides an authentication system and an authentication method. The authentication system provided by the invention can perform authentication comparison on different types of data access services by using a single account database through the operations of the authentication proxy in the network storage appliance and the authentication service module in the directory server.

These and other exemplary embodiments, features, aspects, and advantages of the invention will be described and become more apparent from the detailed description of exemplary embodiments when read in conjunction with accompanying drawings.

DESCRIPTION OF THE EMBODIMENTS

FIG. 2is a block diagram of an authentication system according to an embodiment of the invention. Referring toFIG. 2, the authentication system200includes a client electronic device210, a network storage appliance220, and a directory server230. The functions of aforementioned components will be respectively explained below.

The client electronic device210is, for example, a personal computer (PC), a notebook computer, a tablet PC, or a workstation that can be connected to the network storage appliance220through an Ethernet connection. However, the type of the client electronic device210is not limited herein. The client electronic device210can transmit files or data through different data access services. However, the client electronic device210has to perform an authentication operation before transmitting files or data. Aforementioned data access services include Internet Small Computer System Interface (iSCSI), Common Internet File System (CIFS), File Transfer Protocol (FTP), Apple Filing Protocol (AFP), HyperText Transfer Protocol (HTTP), and Network File System (NFS), etc. The scope of the data access services is not limited in the invention.

The network storage appliance220is a storage appliance adopting the network attached storage (NAS) technique. NAS is a data storage protocol used on the Ethernet for managing data flows on local area networks (LANs) based on the Internet Protocol (IP) through specific file servers, and which allows different types of servers, clients, and workstations to share files and data. At least one hard disc (not shown) is installed in the network storage appliance220, and an operating system for NAS file servers is installed in the hard disc. In the present embodiment, the network storage appliance220includes an authentication proxy221and a plurality of file servers. The file servers are respectively an iSCSI target222, a FTP server223, a CIFS server224, an AFP server225, and a HTTP server226.

The directory server230is connected to the network storage appliance220through an Ethernet connection. The directory server230works with a Windows, Linux, Unix, or Netware operating system. However, the invention is not limited thereto. In the present embodiment, the directory server230further includes an authentication service module232and an account database234.

As shown inFIG. 2, the client electronic device210selects one of the iSCSI initiator212, the CIFS client214or the network browser216to transmit a first encrypted data and a user data required by the authentication to the network storage appliance220. The network storage appliance220receives the first encrypted data and the user data through the corresponding iSCSI target222, the CIFS server224, and the HTTP server226. Herein the user data is, for example, a user name, and the first encrypted data varies with the adopted authentication protocol. In an embodiment, the first encrypted data is the encrypted data of a password input by a user.

The corresponding file server in the network storage appliance220first transmits the first encrypted data and the user data to the authentication proxy221to be packed. The authentication proxy221packs the first encrypted data, the user data, and other parameters required by the authentication into an authentication login information according to the adopted authentication protocol and transmits the authentication login information to the directory server230. The authentication service module232of the directory server230receives the authentication login information and performs decryption and comparison according to a corresponding authentication protocol and a corresponding account information in the account database to determine whether the authentication is successful. After that, the authentication service module232transmits an authentication response to the network storage appliance220.

It should be noted that with different authentication protocols, the authentication proxy221generates the authentication login information with different data. The authentication protocol includes Challenge-Handshake Authentication Protocol, Kerberos Protocol, New Technology LAN Manager (NTLM), Digest Access Authentication, clear-text password, or encrypted password. However, the invention is not limited thereto. Correspondingly, the authentication service module232of the directory server230selects a suitable authentication protocol and the corresponding account information in the account database by means of judging the content of the authentication login information, so as to perform the decryption and comparison action. The data access services, authentication protocols, content of authentication login information, and the authentication protocols thereof are listed in following table 1 according to an embodiment of the invention.

Referring to table 1, the directory server230in the present embodiment is an active directory (AD) server of a Microsoft Windows operating system. Thus, the authentication service module232selects different authentication packages according to different authentication protocols. Regarding the CIFS data access service, the network storage appliance220selects one of the Kerberos authentication protocol or the NTLM authentication protocol. Below, the invention will be described by taking the iSCSI and CIFS data access services as an example.

FIG. 3is a time flowchart of an authentication method according to an embodiment of the invention. Referring toFIG. 3, the authentication method in the present embodiment is adapted to the authentication system200illustrated inFIG. 2. Below, the authentication method in the present embodiment will be described in detail with reference to various components inFIG. 2.

In step S301, the client electronic device210transmits an authentication request to the network storage appliance220. Specifically, if a user uses the client electronic device210and selects the iSCSI data access service, the iSCSI initiator212proposes the authentication protocols to be used to the iSCSI target222in the network storage appliance220. In other words, during establishment of the iSCSI session, the iSCSI initiator212would negotiate the authentication protocol with the iSCSI target222.

Then, in step S302, the network storage appliance220receives the authentication request, selects an authentication protocol according to the authentication request, and transmits one or a plurality of parameters required by the authentication protocol to the client electronic device210. In the present embodiment, the network storage appliance220selects the CHAP authentication protocol and transmits a CHAP ID and a challenge to the iSCSI initiator212.

Next, in step S303, the client electronic device210encrypts the parameters and the password input by the user by using a hashing algorithm, so as to generate the first encrypted data. Specifically, the iSCSI initiator212performs a calculation on the CHAP ID, the challenge, and the password input by the user by using the MD5 hashing algorithm, so as to generate a challenge response. Besides, the iSCSI initiator212transmits the user name and the challenge response (i.e., the first encrypted data) to the network storage appliance220.

In step S304, the authentication proxy221packs the user name, the CHAP ID, the challenge, and the challenge response into an authentication login information and transmits the authentication login information to the directory server230.

In step S305, the authentication service module232performs decryption and authentication comparison by using a Microsoft remote access authentication package corresponding to the CHAP authentication protocol. The authentication service module232first searches for a corresponding password in the account database234by using the user name and then performs a calculation on the CHAP ID and the challenge in the authentication login information and the password found in the account database234by using the same MD5 hashing algorithm, so as to generate a second encrypted data. After that, the authentication service module232compares the second encrypted data with the challenge response (i.e., the first encrypted data) in the authentication login information.

If the first encrypted data is the same as the second encrypted data, the authentication service module232transmits a positive response to the network storage appliance220. If the first encrypted data is different from the second encrypted data, the authentication service module232transmits a negative response to the network storage appliance220.

In the last step S306, the network storage appliance220notifies the client electronic device210about whether the iSCSI session is accepted or rejected.

Below, the invention will be described with reference to another embodiment.FIG. 4is a flowchart of an authentication method according to another embodiment of the invention. The authentication method in the present embodiment is adapted to the authentication system200illustrated inFIG. 2. Please refer to bothFIG. 2andFIG. 4for following description.

In step S401, the client electronic device210transmits an authentication request. Since the client electronic device210selects the CIFS data access service, the CIFS client214first request a ticket for the directory server230. Herein the ticket is related to an access authority of the client electronic device210.

In step S402, the directory server230records the access authority of the client electronic device210into the ticket and transmits the ticket to the client electronic device210.

In step S403, the client electronic device210issues a data access request to the network storage appliance220according to the ticket and user information.

In step S404, the authentication proxy221packs the user information and the Kerberos ticket into an authentication login information according to the Kerberos authentication protocol and transmits the authentication login information to the authentication service module232of the directory server230.

In step S405, the authentication service module232performs decryption and authentication comparison on the authentication login information by using the Microsoft Kerberos authentication package. Besides, the directory server230transmits an authentication response to the network storage appliance220.

In last step S406, the network storage appliance220notifies the client electronic device210about whether the access connection is accepted or rejected.

FIG. 5is a flowchart of the authentication method described above according to yet another embodiment of the invention.FIG. 6is a block diagram of an authentication system according to yet another embodiment of the invention. The authentication system600includes a client electronic device610, a network storage appliance620, and a directory server630. Please refer toFIG. 5andFIG. 6for following description.

First, an authentication proxy621is disposed in the network storage appliance620, and an authentication service module632and an account database634are disposed in the directory server630(step S510). The client electronic device610selects a data access service and transmits an encrypted data and a user data required by the authentication to the network storage appliance620(step S520). The authentication proxy621of the network storage appliance620packs the encrypted data and the user data into an authentication login information and transmits the authentication login information to the directory server630(step S530). The authentication service module632of the directory server630receives the authentication login information, wherein the authentication service module632performs decryption and comparison according to a corresponding authentication protocol and a corresponding account information in the account database634to determine whether the authentication is successful, and then the authentication service module632transmits an authentication response to the network storage appliance620. The network storage appliance620notifies the client electronic device610about whether the access connection is accepted or rejected (step S540).

The authentication system in each embodiment described above has a directory server. Thus, through the operation of the authentication proxy in the network storage appliance, the authentication system in the invention can perform authentication comparison by using only the remote account database in the directory server. However, a local account database can still be configured in the network storage appliance such that when no directory server is deployed, the authentication system can perform authentication comparison by directly using the local account database since the network storage appliance can capture clear-text information. Namely, the network storage appliance in the invention allows a user to determine whether to perform authentication comparison by using a remote account database only or a local account database only.

As described above, according to the invention, an authentication system can perform a unified authentication (i.e., perform authentication comparison by using one and only one account database) through the operations of an authentication proxy in the network storage appliance and an authentication service module in the directory server. Thereby, the time required by a network system administrator for maintaining account database is greatly shortened. Since the user can perform the login authentication action by using the same ID and password regardless of which type of data access service the user selects, the possibility for the user to input incorrect ID or password is reduced, and accordingly the possibilities for authentication fail and denial of data access are reduced as well.