Network authentication for a storage system

Patent metadata

Field	Value
Publication number	US-11399063-B2
Application number	US-201916399635-A
Country	US
Kind code	B2
Filing date	Apr 30, 2019
Priority date	Jun 4, 2014
Publication date	Jul 26, 2022
Grant date	Jul 26, 2022

Abstract

A method of operating a storage system is provided. The method includes establishing a security context between a client and the storage system, the security context comprising a single ticket for multiple nodes within the storage system. The method includes distributing a first request to a first blade within the storage system and distributing a second request to a second blade within the storage system. The distributing the first request and the second request includes determining a node for handling the first request and the second request based on data within the single ticket.

First claim

What is claimed is:

1. A method, comprising:
establishing a security context between a client and a storage system, the security context comprising a ticket for multiple nodes within the storage system, the establishing triggered by a remote procedure call received by the storage system;
distributing a first request to a first blade within the storage system, the distributing comprising transmitting a message to an authority owning the first request, the authority one of a plurality of authorities within the storage system; and
distributing a second request from the first blade to a second blade within the storage system, wherein the distributing the first request and the second request comprises:
determining, by the first blade, a node for handling the first request and a node for handling the second request based on data within the ticket.

2. The method of claim 1 , wherein establishing the security context includes authentication through third party authorization.

3. The method of claim 1 , wherein the security context is incremented for each remote procedure call.

4. The method of claim 1 , wherein the storage system comprises multiple chassis and wherein the ticket includes a session key and a storage system key.

5. The method of claim 1 , wherein the multiple nodes of the storage system are projected as a single node.

6. The method of claim 1 , wherein the establishing comprises:
issuing a ticket through third party authorization.

7. The method of claim 1 , comprising:
caching a client principal name across all nodes.

8. The method of claim 1 , wherein the ticket is encrypted.

9. The method of claim 1 wherein the method operations are embodied as non-transitory computer readable media.

10. A storage system, comprising:
a plurality of storage nodes configured to communicate together as a storage cluster;
each of the plurality of storage nodes having nonvolatile solid-state memory for data storage; and
the plurality of storage nodes configured to distribute the data and metadata associated with the data throughout the plurality of storage nodes, the plurality of storage nodes configurable to:
establish a security context between a client and the plurality of storage nodes, the security context comprising a ticket for the plurality of storage nodes, establishment of the security context triggered by a remote procedure call received by the storage system;

distributing a first request to a first node within the storage system, the distributing comprising transmitting a message to an authority owning the first request, the authority one of a plurality of authorities within the storage system; and
distributing a second request from the first node to a second node within the storage system, wherein the distributing the first request and the second request comprises:
determining, by the first node, a further node for handling the first request and the second request based on data within the ticket.

11. The system of claim 10 , wherein establishing the security context includes authentication through third party authorization.

12. The system of claim 10 , wherein the security context is incremented for each remote procedure call.

13. The system of claim 10 , wherein the storage system comprises multiple chassis and wherein the ticket includes a session key and a storage system key.

14. The system of claim 10 , wherein the plurality of nodes of the storage system are projected as a single node.

15. The system of claim 10 , wherein the establishing comprises:
issuing a ticket through third party authorization.

16. The system of claim 10 , comprising:
caching a client principal name across each of the plurality of nodes.

17. The system of claim 10 , wherein the ticket is encrypted.

18. The system of claim 10 wherein method operations of the plurality of storage nodes configurable are embodied as non-transitory computer readable media.

Assignees

• Pure Storage Inc

Inventors

• Narayanaswamy Purvaja
• Sandvig Cary A
• Lee Robert

Classifications

• H04L49/111

  Switch interfaces, e.g. port details · CPC title

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• G06F13/4022 Primary

  using switching circuits, e.g. switching matrix, connection or expansion network (G06F13/4009 takes precedence) · CPC title

• H04L12/40169

  Flexible bus arrangements (arrangements for maintenance or administration involving management of faults; events, alarms H04L41/06; automatic restoration of network faults H04L41/0654) · CPC title

• G06F3/0622

  in relation to access · CPC title