Mechanism for implementing key-based security for nodes within a networked virtualization environment for storage management

Patent metadata

Field	Value
Publication number	US-9407433-B1
Application number	US-201314014890-A
Country	US
Kind code	B1
Filing date	Aug 30, 2013
Priority date	Aug 10, 2011
Publication date	Aug 2, 2016
Grant date	Aug 2, 2016

Abstract

A method for providing key-based security for adding a new node to an existing networked virtualization environment for storage management includes discovering the new node, establishing communication with the new node using a factory public key, requesting the new node to generate a new private key and new public key pair, receiving the new public key by the existing virtualization environment, wherein subsequent communication with the new node by the existing virtualization environment is performed using the new public key, and configuring the new node to become part of the existing virtualization environment using the new public key.

First claim

What is claimed is:

1. A method for providing key-based security for adding a new node to an existing networked virtualization environment for storage management, comprising:
discovering the new node in a cluster of existing nodes in the virtualization environment;
establishing communication with the new node via the cluster of existing nodes, the cluster of existing nodes establishing communication with the new node using a factory public key;
requesting the new node to generate a new key pair comprising a new private key and a new public key;
receiving the new public key by the cluster of existing nodes, wherein subsequent communication with the new node by the cluster of existing nodes is performed using the new public key; and
configuring the new node, in response to receiving the new public key, to become part of the cluster of existing nodes using the new public key, and the new node is provided access to the virtualization environment only after deactivating both the factory public key and the corresponding factory private key.

2. The method of claim 1 , wherein discovering the new node is performed by a distributed configuration database module of the cluster of existing nodes.

3. The method of claim 2 , wherein the distributed configuration database module notifies an administrator of the cluster of existing nodes of the existence of the new node.

4. The method of claim 1 , wherein establishing communication with the new node using the factory public key is performed by an administrator using a graphical user interface (GUI) of an existing node in the cluster of existing nodes.

5. The method of claim 1 , wherein the new node generates the new private key and new public key pair in response to the request.

6. The method of claim 5 , wherein the new node retains the new private key.

7. The method of claim 6 , wherein the new private key is known only to the new node.

8. The method of claim 1 , wherein only the new node and the cluster of existing nodes in the virtualization environment have access to the new public key.

9. The method of claim 1 , further comprising storing the new public key in configuration data associated with the cluster of existing nodes in the virtualization environment.

10. The method of claim 1 , wherein configuring the new node to become part of the cluster of existing nodes comprises providing the new node access to the cluster of existing nodes in the virtualization environment.

11. The method of claim 10 , wherein providing the new node access to the cluster of existing nodes in the virtualization environment comprises configuring the new node to include a distributed configuration database module.

12. The method of claim 10 , wherein providing the new node access to the cluster of existing nodes in the virtualization environment comprises providing the new node access to configuration data associated with the cluster of existing nodes in the virtualization environment.

13. A computer program product embodied on a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method for providing key-based security for adding a new node to an existing networked virtualization environment for storage management, comprising:
discovering the new node in a cluster of existing nodes in the virtualization environment;
establishing communication with the new node via the cluster of existing nodes, the cluster of existing nodes establishing communication with the new node using a factory public key;
requesting the new node to generate a new key pair comprising a new private key and a new public key;
receiving the new public key by the cluster of existing nodes, wherein subsequent communication with the new node by the cluster of existing nodes is performed using the new public key; and
configuring the new node, in response to receiving the new public key, to become part of the cluster of existing nodes using the new public key, and the new node is provided access to the virtualization environment only after deactivating both the factory public key and the corresponding factory private key.

14. The computer program product of claim 13 , wherein discovering the new node is performed by a distributed configuration database module of the cluster of existing nodes.

15. The computer program product of claim 14 , wherein the distributed configuration database module notifies an administrator of the cluster of existing nodes of the existence of the new node.

16. The computer program product of claim 13 , wherein establishing communication with the new node using the factory public key is performed by an administrator using a graphical user interface (GUI) of an existing node in the cluster of existing nodes.

17. The computer program product of claim 13 , wherein the new node generates the new private key and new public key pair in response to the request.

18. The computer program product of claim 17 , wherein the new node retains the new private key.

19. The computer program product of claim 18 , wherein the new private key is known only to the new node.

20. The computer program product of claim 13 , wherein only the new node and the cluster of existing nodes in the virtualization environment have access to the new public key.

21. The computer program product of claim 13 , further comprising storing the new public key in configuration data associated with the cluster of existing nodes in the virtualization environment.

22. The computer program product of claim 13 , wherein configuring the new node to become part of the cluster of existing nodes comprises providing the new node access to the cluster of existing nodes in the virtualization environment.

23. The computer program product of claim 22 , wherein providing the new node access to the cluster of existing nodes in the virtualization environment comprises configuring the new node to include a distributed configuration database module.

24. The computer program product of claim 22 , wherein providing the new node access to the cluster of existing nodes in the virtualization environment comprises providing the new node access to configuration data associated with the cluster of existing nodes in the virtualization environment.

25. A method for providing key-based security for removing a target node from an existing networked virtualization environment for storage management, comprising:
requesting the target node to stop receiving data for the existing networked virtualization environment;
requesting the target node to migrate its existing data to other nodes in the existing networked virtualization environment;
removing the target node from the existing networked virtualization environment by, after the target node has migrated its existing data, removing a public key for the target node from configuration data associated with the existing networked virtualization environment; and
requesting, after the public key for the target node has been removed from the configuration data, the target node to reactivate its factory public key and factory public key pair, and the target node is accessible via the factory public key and the corresponding factory private key only after the target node is no longer allowed to access the other nodes in the existing network virtualization environment.

Assignees

• Nutanix Inc

Inventors

• Sohi Aroosh
• Cui Miao
• Khole Akshay Anand

Classifications

• H04L9/0861 Primary

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L9/14 Primary

  using a plurality of keys or algorithms · CPC title

• H04L63/00

  Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00) · CPC title