Cluster Federation and Trust

• US 20120233463A1
• Filed: 10/21/2011
• Published: 09/13/2012
• Est. Priority Date: 03/08/2011
• Status: Active Grant

• Current Assignee: Rackspace US Incorporated (Apollo Global Management, Inc.)
• Original Assignee: Rackspace US Incorporated (Apollo Global Management, Inc.)
• Inventors: Holt, Gregory Lee, Barton, Michael, Goetz, David Patrick, Gerrard, Clay
• Granted Patent: US 8,930,693 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 16/1824 implemented using Network-attached Storage [NAS] architecture distributed or networked storage systems G06F3/067; protocols for distributed storage of data in a network H04L67/1097
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 3/0608 Saving storage space on storage systems
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/0641 De-duplication techniques
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 9/5083 Techniques for rebalancing the load in a distributed system
• CPC Class Codes: H04L 47/80 Actions related to the user profile or the type of traffic
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1006 with static server selection, e.g. the same server being selected for a specific client
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: Y10S 707/9994 Distributed or remote access
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

An improved scalable object storage system allows multiple clusters to work together. In one embodiment, a trust and federation relationship is established between a first cluster and a second cluster. This is done by designating a first cluster as a trust root. The trust root receives contact from another cluster, and the two clusters exchange cryptographic credentials. The two clusters mutually authenticate each other based upon the credentials, and optionally relative to a third information service, and establish a service connection. Services from the remote cluster are registered as being available to the cluster designated as the trust root. Multi-cluster gateways can also be designated as the trust root, and joined clusters can be mutually untrusting. Two one-way trust and federation relationships can be set up to form a trusted bidirectional channel.

Claims

1. A method of establishing trust and federation relationship between a first cluster and a second cluster, the method comprising:

designating a first cluster as a trust root;

receiving contact from a remote cluster at the trust root over a communications medium;

receiving a remote cryptographic token from the remote cluster, and sending a local cryptographic token to the remote system;

verifying the identity of the remote cluster using the local and remote cryptographic tokens;

creating an encrypted connection between the trust root and the remote cluster; and

registering a service provided by the remote cluster as being available to the trust root.

4. The method of claim 1, wherein one of the remote cryptographic token and the local cryptographic token is one of a value encrypted using a shared secret, a public key, a certificate, Kerberos ticket, and an OAUTH token.

8. The method of claim 1, wherein the service provided by the remote system is a replication service, and wherein the method further comprises the step of setting the remote cluster as a replication target for the first cluster.

10. The method of claim 1, wherein the method further comprises the step of designating a second trust root, and establishing a trust and federation relationship using the second trust root.

11. The method of claim 1, wherein the trust root is controlled by a first party and the remote cluster is controlled by a second party.

2. A method of establishing trust and federation relationship between a first cluster and a second cluster, the method comprising:

designating a multi-cluster gateway as a trust root;

receiving contact from a remote cluster at the trust root over a communications medium;

receiving a remote cryptographic token from the remote cluster, and sending a local cryptographic token to the remote system;

verifying the identity of the remote cluster using the local and remote cryptographic tokens;

creating an encrypted connection between the trust root and the remote cluster; and

registering a service provided by the remote cluster as being available to the trust root.

3. The method of claim 2, wherein the method further comprises the steps of:

receiving contact from a second remote cluster at the trust root over a communications medium;

receiving a second remote cryptographic token from the second remote cluster, and sending a local cryptographic token to the remote system;

verifying the identity of the second remote cluster using the local and second remote cryptographic tokens;

creating an encrypted connection between the trust root and the second remote cluster; and

registering a service provided by the second remote cluster as being available to the trust root.

5. The method of claim 2, wherein one of the remote cryptographic token and the local cryptographic token is one of a value encrypted using a shared secret, a public key, a certificate, Kerberos ticket, and an OAUTH token.

6. The method of claim 3, wherein the method further comprises the step of establishing a trust and federation relationship between the first remote cluster and the second remote cluster using the mutual trust root as a trust intermediary.

7. The method of claim 3, wherein the method further comprises the step of establishing a trusted and encrypted connection between the first remote cluster and the second remote cluster using the mutual trust root as an authentication intermediary.

9. The method of claim 3, wherein the service provided by the first remote cluster is a replication service, and wherein the method further comprises the step of setting the first remote cluster as a replication target for the second remote cluster.

12. The method of claim 3, wherein the trust root is controlled by a first party and one or both of the first remote cluster and second remote cluster is not controlled by the first party.

13. A trusted federation system for a plurality of clusters, the system comprising:

a first cluster including a plurality of information processing devices;

a first cluster controller, the first cluster controller including an authenticator and an associated secret, the authenticator operable to cryptographically authenticate a request to interact with the system from a remote system using the associated secret;

the first cluster controller further including a communications module operable to create an encrypted connection between the first cluster and the remote system; and

the first cluster controller further including a service registry operable to register a service provided by the remote system as being available to the first cluster.

14. The system of claim 13, wherein one of the secret is one of a passphrase, a shared secret, a private key, and a certificate.

15. The system of claim 13, wherein the authenticator operates in accordance with one of XAUTH, OAUTH, Kerberos, and RADIUS.

16. The system of claim 13, wherein the communications module establishes the encrypted connection using a trusted intermediary.

17. The system of claim 13, further comprising a multi-cluster gateway, wherein the first cluster controller is associated with the multi-cluster gateway.

18. The system of claim 13, further comprising a replicator, operable to selectively replicate information from the first cluster to the remote system.

19. The system of claim 13, further comprising a second cluster including a plurality of information processing devices and a second cluster controller.

20. The system of claim 19, further comprising a replicator, operable to selectively replicate information from the first cluster to the second cluster.