Host authentication using a non-addressable domain controller

Patent metadata

Field	Value
Publication number	US-12413517-B2
Application number	US-202318119237-A
Country	US
Kind code	B2
Filing date	Mar 8, 2023
Priority date	Mar 8, 2023
Publication date	Sep 9, 2025
Grant date	Sep 9, 2025

Abstract

A data management system (DMS) may support authentication of a host using a non-addressable domain controller within a network. The DMS may obtain a list of domain controllers within the network and create an account at a domain controller on the list via a virtual machine instantiated within the network and used to create a tunnel between the DMS and the virtual machine The DMS may receive, via a port, a packet from a host within the network and route the packet, using a demultiplexer configured to monitor the port, to a storage entity. The storage entity may transmit, via the port to the domain controller, a request to authenticate the host, the request bypassing the demultiplexer that is configured not to monitor the port when the storage entity operates in a client mode. The DMS may receive an indication of whether the host is authenticated from the domain controller.

First claim

What is claimed is:

1. A method for data management, comprising:
receiving a first packet at a data management system, wherein the first packet is from a host that is within a network that includes one or more hosts for which the data management system is configured to provide backup and recovery services, and wherein the first packet is associated with a request to establish, via a port at which the first packet is received, a connection between the host and a storage entity within the data management system that is used to back up the host;
routing the first packet to the storage entity using a demultiplexer of the data management system that is configured to monitor the port when the storage entity operates to receive packets in a server mode via the port, the demultiplexer configured to identify the storage entity based at least in part on an internet protocol address associated with the host;
transmitting, from the storage entity based at least in part on receiving the first packet, a second packet to a domain controller within the network, wherein the second packet requests that the domain controller authenticate the host, and wherein the second packet bypasses the demultiplexer based at least in part on the demultiplexer being configured not to monitor the port when the storage entity operates to transmit packets in a client mode via the port;
receiving, at the storage entity from the domain controller, a third packet that indicates an authentication of the host, wherein the third packet bypasses the demultiplexer based at least in part on being in response to the second packet; and
establishing the connection between the storage entity and the host based at least in part on the authentication of the host indicated by the third packet.

2. The method of claim 1 , further comprising:
instantiating, within the network, a virtual machine configured to create a tunnel for communications between the data management system and the one or more hosts; and
configuring the demultiplexer not to monitor the port when the storage entity operates to transmit packets in the client mode based at least in part on the packets being transmitted via the tunnel.

3. The method of claim 1 , further comprising:
allocating a virtual internet protocol address to the domain controller, the virtual internet protocol address different than a private internet protocol address of the domain controller, wherein the second packet is transmitted to the domain controller using the virtual internet protocol address.

4. The method of claim 1 , further comprising:
instantiating, within the network, a virtual machine configured to create a tunnel for communications between the data management system and the one or more hosts;
obtaining, via the virtual machine, a list of one or more domain controllers within the network, wherein the one or more listed domain controllers are associated with authenticating the one or more hosts; and
creating, before transmitting the second packet, an account for the data management system at the domain controller based at least in part on the domain controller being included in the one or more listed domain controllers, wherein the third packet is received from the domain controller based at least in part on the account created at the domain controller.

5. The method of claim 4 , further comprising:
transmitting, to the virtual machine, a fourth packet requesting the list of one or more domain controllers, wherein the list of one or more domain controllers is obtained via the virtual machine in response to the fourth packet.

6. The method of claim 4 , further comprising:
maintaining, via the virtual machine, an up-to-date list of the one or more domain controllers within the network.

7. The method of claim 4 , further comprising:
refraining from accessing a domain name system (DNS) server within the network to obtain the list of one or more domain controllers, the refraining based at least in part on obtaining the list of one or more domain controllers via the virtual machine.

8. The method of claim 4 , wherein:
the domain controller is associated with an internet protocol address that, based at least in part on the domain controller being within the network, is unknown to the data management system prior to the list of one or more domain controllers being obtained, and
the second packet is transmitted to the domain controller based at least in part on obtaining the list of one or more domain controllers.

9. The method of claim 1 , wherein the storage entity operating to transmit packets in the client mode comprises the storage entity transmitting packets to request to establish a respective connection between the storage entity and a respective entity within the network.

10. The method of claim 1 , wherein the storage entity operating to receive packets in the server mode comprises the storage entity receiving packets to request to establish a respective connection between the storage entity and a respective entity within the network.

11. An apparatus for data management, comprising:
at least one processor;
memory coupled with the at least one processor; and
instructions stored in the memory and executable by the at least one processor to cause the apparatus to:
receive a first packet at a data management system, wherein the first packet is from a host that is within a network that includes one or more hosts for which the data management system is configured to provide backup and recovery services, and wherein the first packet is associated with a request to establish, via a port at which the first packet is received, a connection between the host and a storage entity within the data management system that is used to back up the host;
route the first packet to the storage entity using a demultiplexer of the data management system that is configured to monitor the port when the storage entity operates to receive packets in a server mode via the port, the demultiplexer configured to identify the storage entity based at least in part on an internet protocol address associated with the host;
transmit, from the storage entity based at least in part on receiving the first packet, a second packet to a domain controller within the network, wherein the second packet requests that the domain controller authenticate the host, and wherein the second packet bypasses the demultiplexer based at least in part on the demultiplexer being configured not to monitor the port when the storage entity operates to transmit packets in a client mode via the port;
receive, at the storage entity from the domain controller, a third packet that indicates an authentication of the host, wherein the third packet bypasses the demultiplexer based at least in part on being in response to the second packet; and
establish the connection between the storage entity and the host based at least in part on the authentication of the host indicated by the third packet.

12. The apparatus of claim 11 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:
instantiate, within the network, a virtual machine configured to create a tunnel for communications between the data management system and the one or more hosts; and
configure the demultiplexer not to monitor the port when the storage entity operates to transmit packets in the client mode based at least in part on the packets being transmitted via the tunnel.

13. The apparatus of claim 11 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:
allocate a virtual internet protocol address to the domain controller, the virt

Assignees

• Rubrik Inc

Inventors

• Jaiswal Rajesh Kumar
• Luo Jiangbin

Classifications

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title