Systems and methods for permissioned blockchain access to computing networks

Abstract

A computer-implemented system, method and computer program product for providing access to a network of computing nodes, comprising: requesting access by a client to a host node in the network, preferably a private network; selecting a digital certificate issuer; verifying an identity of the client's token by the digital certificate issuer; adding a nonce to a distributed ledger by the certificate issuer; and granting the client access to the host node in the network. In one embodiment, the computing nodes are ranked based on CPU capacity, and the computing node with the highest CPU capacity rank is selected to participate in a proof-of-capacity consensus to find a solution to the nonce.

Description

[Technical Field]

[0001] This application relates generally to information handling and / or data processing networks, and more particularly to authenticating users within the network and providing access (e.g., remote access) to computing networks, preferably using an improved permissioned blockchain process. [Background technology]

[0002] SSH, also known as Secure Shell or Secure Socket Shell, is a cryptographic network protocol that provides users with a secure means of accessing a computer over an insecure network. SSH is a method of secure remote login from one computer to another, providing strong authentication and protecting communications with strong encryption. Secure Shell (SSH) certificates are a scalable means of authenticating many users to one or more hosts in a computing network. All hosts are configured to trust certificates signed by the public key of a Certificate Authority. A Certificate Authority is traditionally a key pair (public and private) issued by a single host. A failure of that single host, such as an outage, can cause problems when attempts to sign in to the network fail. In other words, if that single host cannot issue digital certificates (e.g., Certificates of Authority (CA)), client / peer computing devices cannot join the network; thus, having one central certificate authority can be a single, potentially destructive point of failure. Using a privately owned CA server can be risky because if something goes wrong with that single server, SSH authentications are interrupted for the time it takes to return the server to operation. It would be advantageous to have a system and / or method that overcomes the disadvantages of having only one single computing node that issues Certificates of Authority, e.g., SSH certificates.

[0003] Furthermore, having only one server issue certificates of authority also presents an inefficient process for onboarding new compute nodes to the network. Each time a new node is added to the network, several steps are required to enable the new node to receive a signed certificate from the CA server. Each new node requires uploading the certificate of authority's public key and modifying the SSHD configuration. These steps are also required when the certificate of authority public key must be changed. Having a single CA server can be inefficient in handling all of these tasks. It would be beneficial to have a system and / or method that overcomes the disadvantages of having a single server or computing node that handles all of the tasks for enabling a new node to access the network. Summary of the Invention

[0004] To aid in understanding the present disclosure, a summary of the present disclosure is presented without intending to limit the disclosure. The present disclosure is directed to persons skilled in the art. It should be understood that various aspects and features of the present disclosure can be advantageously used separately in some situations or examples, or in combination with other aspects, embodiments, or features of the present disclosure, or combinations thereof, in other situations or examples. Accordingly, modifications and variations can be made to these systems and / or methods to achieve different results. In this regard, it is understood that the present disclosure presents and describes one or more inventions, and that in its multiple aspects, the present invention includes numerous inventions as defined by the claims.

[0005] A system, method, or computer program product, or combination thereof, for providing access to a network of computing nodes, preferably a closed network of computing nodes, is disclosed. In one or more embodiments, the system, method, or computer program product, or combination thereof, includes: requesting access by a client to a host node within the network, preferably a private network; selecting a digital certificate issuer; verifying the identity of the client's token via the digital certificate issuer; adding a nonce to a distributed ledger via the certificate issuer; and granting the client access to the host node within the network. In one embodiment, the system, method, or computer program product, or combination thereof, includes ranking the computing nodes within the network and selecting one or more (preferably at least three) computing nodes to participate in a proof-of-capacity consensus to find a solution to the nonce according to the ranking of the computing nodes within the network. Ranking the computing nodes within the network is preferably based on the unused CPU capacity of the computing nodes. In one embodiment, the system, method, or computer program product, or a combination thereof, further includes selecting the computing node with the highest rank as a main miner, and retrieving, by the main miner, the deadline from a plugin installed on the main miner.In one aspect, the system, method, or computer program product, or combination thereof, further includes storing all possible solutions to the nonce in a nonce solution store on all computing nodes selected to participate in the proof-of-capacity consensus.

[0006] In one aspect, the system, method, or computer program product, or combination thereof, further includes computing a proof-of-capacity consensus by all computing nodes selected to participate in the proof-of-capacity consensus to find a solution to the nonce. In one aspect, the system, method, or computer program product, or combination thereof, further includes selecting a node containing the solution to the nonce as the digital certificate issuer. In an additional aspect, the system, method, or computer program product, or combination thereof, further includes computing a proof-of-capacity consensus by all computing nodes selected to participate in the proof-of-capacity consensus to find a solution to the nonce, and selecting the main miner as the digital certificate issuer in response to none of the computing nodes selected to participate in the proof-of-capacity consensus finding a solution to the nonce by the deadline.

[0007] In one or more embodiments, the system, method, or computer program product, or combination thereof, further includes adding a new host node to the network, where adding the new host node to the network includes determining, by all computing nodes on the network, whether the new host node has a set of defined network characteristics; retrieving state information from the new host node in response to determining that the new host node has the set of defined network characteristics; and sharing the state information with all computing nodes on the network. In one aspect, adding the new host node to the network further includes sharing a distributed ledger with the new host node, where additional aspects include ensuring that the new host node is added to the same network as the computing nodes, installing a plugin on the new host node, discovering the network via the plugin, and notifying all computing nodes on the network that the new host node has joined the network. In one embodiment, sharing the distributed ledger with the new host node includes utilizing the RAFT protocol, where a database including the distributed ledger in a RAFT leader node is shared with the new host node.

[0008] Also disclosed is a non-transitory computer-readable medium containing instructions that, when executed by at least one hardware processor, configure the at least one hardware processor to perform the processes and / or steps discussed above. In one or more aspects, a computer-implemented system and / or method is disclosed for configuring a network of computing nodes, the computer-implemented system and / or method including a memory storage device storing program instructions and a hardware processor having circuitry and logic for executing the program instructions for configuring the network of computing nodes, the hardware processor coupled to the memory storage device and configured to perform the processes and / or steps discussed above in response to executing the program instructions. In one or more embodiments, the system, method, or computer program product, or combination thereof, is configured to add a new host node to a network, and the system, method, or computer program product, or combination thereof, is configured to: determine whether the new host node is being added to the same network as other computing nodes; install a plugin on the new host node in response to determining that the new host node is being added to the same network as other computing nodes; discover the network using the plugin; notify all computing nodes on the network that the new host node has joined the network; and share the distributed ledger with the new host node; or include instructions to do these things. In one embodiment, the plugin includes a certificate issuer module, a ranking algorithm module, a nonce generator, a document database containing the distributed ledger and state information, and a key-value database.

[0009] The above objects, features or advantages, or combinations thereof, and other objects, features or advantages, or combinations thereof, of the present invention will become apparent from the following more particular description of the invention and the illustrative embodiments thereof, as illustrated in the accompanying drawings, in which like reference numerals generally represent like parts of the illustrative embodiments of the invention.

[0010] Various aspects, features, or embodiments, or combinations thereof, of a system and / or method for authorizing a client to add a host to a network and / or remotely access a node in a network, e.g., a computing network of nodes, preferably using permissioned blockchain technology, and in one aspect, a system and / or method for adding a node and / or remotely accessing a node in a closed network, will be more fully understood when read in conjunction with the accompanying figures. While embodiments are provided in these figures to illustrate aspects, features, or various details or combinations thereof of these systems and methods, the claims should not be limited to the exact arrangements, features, aspects, embodiments, systems, modules, functional units, programming, instructions, methods, processes, techniques, or devices, or combinations thereof, shown, and any illustrated arrangements, features, aspects, embodiments, systems, modules, functional units, programming, instructions, methods, processes, techniques, or devices, or combinations thereof, may be used alone or in combination with other arrangements, features, aspects, embodiments, systems, modules, functional units, programming, instructions, methods, techniques, processes, or devices, or combinations thereof. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 illustrates two peer devices connected on a peer network, according to one embodiment of the present disclosure. [Figure 2]1 illustrates multiple peer devices in a peer group connected over a network. [Figure 3] FIG. 1 illustrates an exemplary peer device according to the present disclosure that can connect to other peer devices over a network. [Figure 4] FIG. 1 is a diagram illustrating an exemplary peer network having several peer devices connectable in accordance with one or more embodiments of the present disclosure. [Figure 5] FIG. 10 is a schematic diagram illustrating one embodiment of an overview diagram of a plug-in to a peer device or node for implementing one or more embodiments of the present disclosure. [Figure 6] FIG. 6 is a schematic diagram illustrating a certificate issuer module as part of the plug-in of FIG. 5, in accordance with one or more embodiments of the present disclosure. [Figure 7] 1 is a schematic flowchart of a method for adding a computing node, e.g., a host node, to a network, according to one embodiment of the present disclosure. [Figure 8] 1 is a schematic flowchart of a method for a node, e.g., a client, to access one of the nodes in a network, according to one embodiment of the present disclosure. [Figure 9] 1 is a schematic flowchart of a method for selecting a Certificate of Authority (CA) issuer according to one embodiment of the present disclosure. [Figure 10] 1 is a schematic flowchart of a method for synchronizing data between nodes in a network, according to an embodiment of the present disclosure; DETAILED DESCRIPTION OF THE INVENTION

[0012] The following description is provided for illustrating the general principles of the present invention and is not intended to limit the inventive concepts described herein. The following detailed description includes numerous details to provide an understanding of the inventive systems, methods, or techniques, or combinations thereof, for securely accessing nodes and / or peer devices in a computing network, and, in one aspect, adding nodes and remotely accessing a computing network. However, those skilled in the art will understand that numerous different embodiments of the inventive systems and / or methods can be practiced without the specific details, and that the claims and this disclosure should not be limited to the arrangements, systems, devices, modules, functional units, programming, instructions, embodiments, features, aspects, processes, methods, techniques, or details, or combinations thereof, specifically described and illustrated herein. Furthermore, particular features, aspects, embodiments, arrangements, systems, devices, modules, functional units, programming, instructions, methods, processes, techniques, details, etc., described herein can also be used in combination with other described features, aspects, embodiments, arrangements, structures, systems, devices, modules, functional units, programming, instructions, techniques, methods, processes, details, etc., in each of a variety of possible combinations and permutations.

[0013] Those skilled in the art are assumed to be familiar with computing environments, including networked computing environments, e.g., those that involve secure access to a network of computing nodes, e.g., using the SSH protocol. Furthermore, those skilled in the art are assumed to be familiar with permissioned blockchain technology. The following discussion omits or only briefly describes conventional features of computing networks that would be apparent to those skilled in the art, including computing network architecture, permissioned blockchain technology, remote access to computer nodes (e.g., SSH remote access), and their operation. Note that labeled elements are labeled according to the figure in which they are introduced and are typically referred to by that number throughout subsequent figures.

[0014] FIG. 1 shows two peer devices 25A and 25B, also called computing nodes, connected within a computing network 30. The peer devices 25 can be computers, virtual computers or virtual machines (VMs), or nodes. Either of the two peer devices 25 can act as a host or a client to the other peer device. FIG. 2 shows several peer devices 25 connected via a network 24 within a computing network 30. Within the computing network 30, either of the peer devices 25 can act as a host or a client to the other peer device. The peer devices 25, also called nodes, can take many forms, such as a computer 32, a laptop 33, a smartphone 34, a personal assistant 35, a terminal 36, a virtual machine, or other forms, as shown.

[0015] FIG. 3 illustrates an exemplary computing system according to the present disclosure that may be used as a node 25 in a computing network. It should be understood that the illustrated computer system or computing node 25 is merely one example of a suitable electronic computer system and is not intended to imply any limitation as to the scope of use or functionality of embodiments of the present invention. For example, the illustrated system may operate with numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with the system illustrated in FIG. 3 may include, but are not limited to, mainframe computer systems, server computer systems, thin clients, thick clients, personal computers, networked computers, minicomputer systems, handheld or laptop devices, tablets, smartphones, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, and distributed cloud computing environments that include any of the above systems or devices.

[0016] In some embodiments, computer system or node 25 may be described in the general context of computer system-executable instructions being executed by the computer system, implemented as program modules or software programs stored in memory 16. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks and / or implement particular input data and / or data types in accordance with the present invention.

[0017] Components of computer system 25 may include, but are not limited to, one or more processors or processing units 12, memory 16, and a bus 14 operatively coupling various system components, including memory 16, to processor 12. In some embodiments, processor 12 may execute one or more program modules 15 loaded from memory 16, which program modules implement software (program instructions) that cause the processor to perform one or more method embodiments of the present invention. In some embodiments, program modules 15, e.g., software programs, may be programmed into the circuitry of processor 12 and loaded from memory 16, storage device 18, network 24, or a combination thereof. It is generally understood that processor 12 includes circuitry for performing the operations of processor 12, including integrated circuits.

[0018] Bus 14 may represent any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures, including, by way of example and without limitation, the Industrial Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0019] Computer system 25 may include a variety of computer system-readable media. Such media may be any available media accessible by the computer system and may include both volatile and nonvolatile media, and both removable and non-removable media. Memory 16 (sometimes referred to as system memory) may include computer-readable media in the form of volatile memory, such as random access memory (RAM), cache memory, or other forms of memory, or a combination thereof. Computer system 25 may also include other computer system storage media, both removable and non-removable, volatile and non-volatile. By way of example only, storage system 18 may be provided for reading from and writing to non-removable, non-volatile magnetic media (e.g., a "hard drive"). Although not shown, magnetic disk drives for reading from and writing to removable nonvolatile magnetic disks (e.g., "floppy disks"), and optical disk drives for reading from and writing to removable nonvolatile optical disks, such as CD-ROMs, DVD-ROMs, or other optical media, may be provided. In such an example, each may be connected to bus 14 by one or more data media interfaces.

[0020] The computer system 25 may further communicate with one or more external devices 26, such as a keyboard, a pointing device, a display 28, one or more devices that allow a user to interact with the computer system, or any device that allows the computer system to communicate with one or more other computing devices (e.g., a network card, a modem, etc.), or a combination thereof. Such communication may be accomplished via an input / output (I / O) interface 20.

[0021] A computer system or node 25 may communicate with one or more networks 24, such as a local area network (LAN), a general wide area network (WAN), a private network, a public network (e.g., the Internet), or a closed network, or a combination thereof, via a network adapter 22. In this disclosure, one or more of the networks 24 through which the computer system 25 communicates will connect the node 25 to one or more other nodes within the network, and in one embodiment, a closed network. As shown, the network adapter 22 communicates with other components of the computer system via a bus 14. Although not shown, it should be understood that other hardware and / or software components may be used with the computer system. Examples of such components include, but are not limited to, microcode, device drivers, redundant processing units, external disk-drive arrays, RAID systems, tape drives, and data archival storage systems.

[0022] In one or more embodiments, permissioned peer-to-peer SSH certificate authority authentication between computer nodes in a network is provided for highly available SSH authentication, and in one aspect, all hosts in the network are given permission to participate in signing Certificates of Authority (CAs) used to access, e.g., log in to, any of the network hosts. In one or more embodiments, the network uses permissioned blockchain technology that allows anyone to join the network after appropriate verification of their identity. In one or more aspects, permissioned blockchain technology is used to allow all hosts to verify signed Certificates of Authority by consensus, access a shared ledger, and store records of signed Certificates of Authority (CAs). In one embodiment, all nodes in the network work together to issue Certificates of Authority, thereby eliminating reliance on a single or only node to issue Certificates of Authority (CAs). Permissioned blockchains can be used to grant client nodes the credentials to SSH into remote hosts, thereby avoiding a potential single point of failure in traditional CA architectures.

[0023] In one embodiment, multiple nodes store a distributed or shared document (ledger) containing the ability to issue a Certificate of Authority to a client wishing to access, e.g., SSH access, any of the nodes in the network. In one aspect, a Certificate of Authority (CA) is issued when all nodes in the network run a blockchain consensus algorithm to verify that the client has access to the network. According to one embodiment, a shared ledger is used to store all clients that have, have had access to, or have been denied access to any of the remote hosts in the closed network. In one aspect, every host node has a copy of all nodes that have been granted access, which improves auditability.

[0024] In additional embodiments, the idle CPUs of computing nodes in the network are monitored and ranked for executing the blockchain consensus algorithm. Nodes with more idle computing capacity are preferably prioritized when solving the blockchain consensus algorithm. In this way, CPUs utilized for other operations, such as mission-critical operations, are not impeded or bogged down by the blockchain process. In one or more embodiments, the system and / or method uses a set of node characteristics to validate computing nodes and enable them to easily join and / or leave the network.

[0025] For highly available SSH authentication, a system (e.g., a peer-to-peer SSH certificate authority) for permissioned blockchain authentication between compute nodes in a computing network is disclosed. In one embodiment, all hosts can confirm signed digital certificates by consensus, store records of signed digital certificates (e.g., storing records of all clients that have access, had access, and have been denied access to any of the hosts in the network (e.g., a closed network)), and access a shared distributed ledger. In one or more aspects, multiple nodes, preferably multiple nodes with unused capacity, can issue digital certificates to users (clients) seeking access (e.g., SSH access) to any of the nodes in the network. In an additional aspect, multiple nodes store the shared distributed ledger, and digital certificates are issued when nodes in the network run a proof-of-capacity consensus algorithm to verify that the users (clients) are authorized to access the nodes and / or the network.

[0026] FIG. 4 illustrates a computing network 30 of computing nodes 25, also referred to as peer-to-peer devices. In one or more embodiments, network 30 is preferably a closed network, and in FIG. 4, network 30 illustrates a closed ring network topology. For example, each node 25 can be a computer, a virtual machine, or both. Each node can be a host or a client. A host is typically a computer hardware device or software connected to other devices, e.g., computers, that provides data or services to other devices, e.g., computers, preferably over a computing network. Any node 25 (e.g., a computer) connected on network 30 can function as a host to other peers or nodes 25 on network 30. A host can be, for example, a computer, a virtual machine, a peer device or node, or a combination thereof. A client is typically a computer hardware device or software that accesses services or data made available by a server or host. A server or host is often located on a separate physical computer from a client, who accesses data and / or services over a network. The host can be, for example, a computer, a virtual machine, a peer device or node, or a combination of these.

[0027] Each computer node 25 in network 30 includes an operating system (O / S) software plug-in 40. In one or more embodiments, each computing node 25 installs plug-in 40, which is preferably installed, maintained, and updated using an appropriate package manager utilized by the operating system (O / S). In one or more embodiments, plug-in 40 includes a node watcher, a ranking algorithm, node information capture, a blockchain proof-of-capacity algorithm, a RAFT protocol, and a shared copy of an asymmetric CA key. In one exemplary embodiment, each plug-in 40 includes a nonce solution generator 42, a ranking algorithm module 44, a RAFT protocol module 46, a document database 50, a key-value database 60, and a certificate issuer module 70, as shown in FIG. 5 . It will be appreciated that the plug-in 40 and disclosed modules, in one embodiment, provide instructions and logic for operating circuitry to handle and / or facilitate the secure addition of a node 25, e.g., a host node, to the network 30, and in one aspect, provide instructions and logic for operating circuitry to handle and / or facilitate secure access, e.g., SSH remote access, by a client to one of the nodes 25 in the network 30. It will be appreciated that in one embodiment, the client need not be within the network.

[0028] The plug-in 40 of the first node 25 joining the network 30 generates the genesis block (e.g., the distributed ledger) of the blockchain. The first node 25 joining the network 30 generates or creates, or generates and creates, all necessary configurations and criteria for onboard node verification (e.g., Certificate of Authority configuration, minimum number of nodes required for consensus, etc.). The criteria for onboard node verification are stored in a configuration file obtained by downloading the plug-in 40. The new node 25 can join the network 30 after successfully verifying that it has a set of characteristics. These characteristics may include, but are not limited to, the hostname, the new host's Domain Name System (DNS), the new host's subnet, netmask, the new host's network interface, inbound / outbound network bandwidth, etc. In one embodiment, other nodes joining the network automatically pick up the configuration of the first node joining the network.

[0029] In one or more embodiments, when a client requests access to any node 25 (e.g., a remote host) in the network 30, one node 25 is selected to issue a signed digital certificate. In one aspect, a node is randomly selected to sign the client's public key with a shared Certificate of Authority (CA) key. In one embodiment, a node with available resources computes a consensus algorithm to verify the authenticity of the request before the client is granted access to the network. If the authenticity of the request is verified, a digital certificate (CA) is signed, a block is generated, and the signed digital certificate (e.g., CA) is added as a block to the blockchain (e.g., a new entry is created in the distributed ledger). In an additional embodiment, the computing nodes in the network are ranked based on how much free or unused capacity they have available to issue signed digital certificates and to compute the consensus algorithm. In one aspect, the node with the most unused or free computing capacity is used to run the consensus algorithm to verify the authenticity of client requests. In this way, to avoid consuming computational resources for mission-critical operations by blockchain operations, computation nodes that have resources available for blockchain operations are used to compute and / or solve the blockchain security protocol. In one embodiment, each computation node in the network stores a current copy of the blockchain (distributed ledger).

[0030] With further reference to the details of an embodiment of plug-in 40 in FIG. 5 , certificate issuer module 70, described in more detail in FIG. 6 , generates and issues digital certificates, e.g., Certificates of Authority (CA). In one embodiment, certificate issuer module 70 includes instructions and logic for operating a circuit to issue digital certificates. In one or more embodiments, instead of one node issuing a Certificate of Authority (CA), every node in a network, e.g., network 30, can issue a Certificate of Authority (CA). In one aspect, ranking algorithm module 42 determines or calculates, or determines and calculates, the CPU capacities of nodes 25 and identifies or ranks, or identifies and ranks, nodes 25 in network 30 having the greatest CPU capacity, e.g., unused computing power. In one aspect, ranking algorithm module 42 determines or selects, or determines and selects, which nodes can participate in solving the blockchain consensus problem and issue digital certificates. In one embodiment, the ranking algorithm module 42 has instructions and logic for operating a circuit to determine, calculate, identify, or rank, or a combination thereof, the CPU computing power of nodes 25 in the network 30. In one aspect, the ranking algorithm 42 in each plug-in 40 determines the CPU computing power of its corresponding respective node 25 and receives the CPU computing power of other nodes in the network. In one or more embodiments, the ranking algorithm module 42 seeks out nodes that are not performing mission-critical processes so that permissioned blockchain operations can be performed by nodes that are not performing mission-critical operations.

[0031] The nonce solution generator 44 generates possible solutions to the nonce and stores these possible solutions in the nonce solution store 66. A nonce stands for "number only used once" and represents a solution to a mathematical cryptographic problem. A nonce is a number (e.g., a hash) for which a blockchain miner is seeking a solution. In one embodiment, the nonce solution generator 44 has instructions and logic for generating a cryptographic nonce and running a circuit to find the solution. Any node that can generate a solution to the nonce is selected to mine blocks into the blockchain and generate digital certificates (CAs). Nonce solution generators are well known in the art. The RAFT protocol module 46 synchronizes data across all nodes in the network. RAFT is a consensus algorithm that distributes a state machine across a cluster / network of computing nodes, ensuring that each node in the cluster / network agrees on the same set of state transitions. The RAFT protocol module 46 contains instructions and logic for operating the circuitry to synchronize data across all computing nodes in the network.

[0032] The plug-in 40 further includes a document database 50, which includes a blockchain database 52 and a state database 54. The blockchain database 52 includes a blockchain, e.g., a distributed ledger of issued certificates of authority (CAs). The state database 54 includes the state of machines in the network 30, e.g., node information, such as memory, storage, workloads (processes), hostnames, and IP addresses. The plug-in 40 further includes a key-value database 60, which includes a deadline database 62, a nonce mining difficulty database 64, and a nonce solution store 66. The deadline database 62 stores deadlines, e.g., the time it takes for any of the miners (nodes participating in the proof-of-capacity algorithm) to find a solution to a nonce. The nonce mining difficulty database 64 includes criteria for providing a solution to a nonce. For example, the nonce mining difficulty can be set as a 16-digit random number starting with three zeros (0). The nonce solution store 66 contains a list of all solutions (possible guesses) for a nonce.

[0033] The certificate issuer module 70 includes a certificate generator module 72, a CA asymmetric key module 74, a digital signer module 75, an authentication provider module 76, and an identity verification module 78, as shown in FIG. 6. The certificate generator module 72 has instructions and logic for operating a circuit to generate a digital certificate. The certificate generator module 72 is invoked when a node finds a solution to a cryptographic nonce (e.g., a proof-of-capacity process to select a node to issue a digital certificate). The output of the certificate generator is a digital certificate.

[0034] The authentication provider 76 has instructions and logic for operating the circuitry to provide and / or determine authentication of a valid user. The authentication provider module 76 receives input from an identity verification module 78 to verify the identity of a user, e.g., a client attempting remote access. The identity verification module 78 has instructions and logic for operating the circuitry to verify the identity of a user, e.g., a user's token. The identity verification module 78 accepts an authentication provider (e.g., Microsoft Active Directory, Google Suite, Okta, Tokens) and client credentials from the authentication provider module 76. The identity verification module 78 outputs a Boolean (e.g., a true / false indicator) indicating whether the client can be successfully authenticated. A client must specify credentials and an authentication method before attempting SSH access to a node in the network.

[0035] The CA asymmetric key module 74 stores the public and private keys of each node in the network. These two keys are used as inputs to the digital signer module 75. The digital signer module 75 has instructions and logic for operating a circuit to sign a Certificate of Authority (CA). Once a digital certificate is generated, the digital signer module 75 signs the digital certificate using the private key received from the CA asymmetric key module 74. The digital signer module 75 receives input (the private key) from the CA asymmetric key module 74, receives a digital certificate (e.g., CA) from the certificate generator 72, and appends the private key to the digital certificate (e.g., CA). The digital signer module 75 outputs a signed digital certificate (e.g., CA) to be added as data in a new block to be added to the blockchain. This certificate is then returned to the client and used as authorization to log in to the target node. The target node can determine whether the certificate used by the client is legitimate.

[0036] The plug-ins 40, as well as the ranking algorithm 42, nonce solution generator 44, RAFT protocol module 46, document database 50, key-value database 60 and certificate issuer module 70 are discussed in further detail with respect to FIGS.

[0037] 7 is an exemplary flowchart illustrating and describing a method 700 of adding a node to a network, according to one embodiment, where in one aspect the method includes securely adding a host node to a group of hosts in a network, preferably a closed network. While method 700 is described as including a series of steps or steps or a series of steps for convenience and without any intent to limit the disclosure, it is understood that the process need not be performed as a series of steps and / or the steps need not be performed in the order shown and described with respect to FIG. 7, but rather that the process can be integrated and / or one or more steps can be performed together simultaneously, or steps can be performed in the order disclosed or in an alternate order.

[0038] In one or more aspects, a method 700 of adding a new node, e.g., a host node, to a network includes, at 705, checking or verifying, or checking and verifying, that the new node being added is on the same network as the remaining nodes, e.g., the remaining host nodes. In one or more embodiments, a check is performed to determine whether the node being added is on / for the same primary Domain Name System (DNS), the same subnet, or the same network interface, or a combination thereof. In one or more embodiments, the network is a closed network. At 710, a software plug-in, e.g., plug-in 40, is installed on the new node. At 720, the plug-in on the new node, e.g., node 25, discovers the network and notifies other nodes on the network that the new node has joined the network. At 730, all nodes in the network verify that the new node has a set of defined network characteristics. Before the new node, e.g., a new host node, can join a network of nodes, e.g., a closed network, and participate in permissioned blockchain functionality, the new node must be verified against a set of defined characteristics. These characteristics may include, but are not limited to, the hostname, the Domain Name System (DNS) of the new node (e.g., the host node), the subset of the new node (e.g., the host node), the netmask, the network interface of the new node (e.g., the new host node), the inbound / outbound network bandwidth, etc.

[0039] At 740, a plug-in, e.g., plug-in 40, retrieves state information from the new node and shares it with the network, e.g., each of the other nodes in the network. In one aspect, the state information is retrieved from state database 54 in document database 50 of plug-in 40 and transmitted to other nodes in the network. A method and technique for distributing state information within a network includes utilizing the RAFT protocol, and in one embodiment, this method and technique is described in method 1000 and flowchart of FIG. 10 . At 750, a blockchain, e.g., a distributed ledger, is shared with the new node. In one aspect, other nodes in the network send the distributed ledger to the new node, or retrieve the distributed ledger from other nodes in the network, or both. In this manner, in one or more embodiments, a new node, preferably a host node, is added to a network, preferably a closed network, having permissioned blockchain functionality. The new node preferably has a copy of the entire distributed / shared ledger, e.g., the entire blockchain.

[0040] 8 is an exemplary flowchart illustrating a method 800 for remotely accessing a node in a network, preferably for Secure Shell (SSH) remote access to a node in a network. Method 800 is described as including a series of steps or a number of steps or a series of steps for convenience and without any intention to limit the disclosure, but it is understood that the process need not be performed as a series of steps and / or the steps need not be performed in the order shown and described with respect to FIG. 8, but that the process can be integrated and / or one or more steps can be performed together simultaneously, or steps can be performed in the order disclosed or in an alternate order.

[0041] In one embodiment, method 800 is directed to remotely accessing a node in a network, and in one aspect, particularly to Secure Shell (SSH) remote access to a network. At 805, a client requests remote access to a node in the network. In one embodiment, the client issues a Secure Shell (SSH) request to a node in the network. In one or more aspects, the network is a closed network. At 810, a Certificate of Authority (CA) issuer is selected. An embodiment of selecting a Certificate of Authority (CA) issuer is described in more detail with respect to the flowchart and method 900 of FIG. 9.

[0042] At 815, the selected certificate issuer verifies the identity of the client token. In this regard, a client wishing to remotely access a node in the network sends its client token to the selected certificate issuer 70 in the plug-in 40. The client token is generated at the client node, where it is established that the selected authentication provider will authenticate the client credentials and issue the token. The client is a combination of the client's credentials. The client should have existing credentials in the authentication provider module 76. In one embodiment, at 815, the identity verification module 78 in the certificate issuer 70 is used to verify the client's token (client credentials) against the authentication provider specified in the authentication provider module 76. That is, in one aspect, at 815, the client's identity is verified by the identity verification module 78 (the identity verification module checks whether the client's token is valid). At 820, the certificate issuer adds the new certificate, the hash of the previous block, the timestamp, and the nonce to the blockchain. The blockchain is stored in a blockchain database 52 in a document database 50 of a software plugin 40 installed on all nodes in a network, e.g., a closed network. This information is synchronized with other nodes in the network using the RAFT protocol module of the plugin 40. At 825, a client accesses a node.

[0043] In one embodiment, at 815-825, a permissioned blockchain process is performed to allow clients / users to remotely access the network. In one aspect, each node in the network works together to sign / issue the certificate authority, eliminating reliance on one single node to issue the CA. Every host in the network has a copy of every client that is authorized to access any of the remote hosts. Every host has a copy of a shared ledger that identifies every client that has, had access to, or has been denied access to any of the remote hosts in the network.

[0044] FIG. 9 is an exemplary flowchart illustrating a method 900 for selecting a certificate issuer, preferably for secure shell (SSH) remote access to a node in a network. While method 900 is described as including a series of steps or steps or a series of steps for convenience and without any intent to limit the disclosure, it is understood that the process need not be performed as a series of steps, or the steps need not be performed in the order shown and described with respect to FIG. 9 , or both, but that the process can be integrated and / or one or more steps can be performed simultaneously together, or steps can be performed in the disclosed order or in an alternate order. In one or more embodiments, method 900 is used to select a certificate issuer at 810 of method 800. Other methods of selecting a certificate issuer are also contemplated.

[0045] At 905, the node ranking is used to select which one or more nodes will participate in a proof-of-capacity consensus, e.g., a blockchain proof-of-capacity consensus. In one embodiment, a plurality of nodes, preferably an odd number of nodes, are selected to participate in the proof-of-capacity consensus. The proof-of-capacity consensus is a solution to a cryptographic problem, and solving the cryptographic problem uses available space on the node's storage, e.g., hard drive, to compute the solution to the cryptographic problem. In one or more embodiments, the CPU capacities of the nodes in the network are calculated and ranked within ranking algorithm module 42. At 905, the node CPU capacity ranking is used to select one or more nodes, preferably three or more nodes, to be used to solve the proof-of-capacity consensus.

[0046] At 910, the highest-ranked node is selected as the main miner. At 915, the main miner retrieves the deadline from the plugin. That is, in one embodiment, at 915, the main miner retrieves the deadline from the deadline database 62 in the key-value database 60 of its plugin 40. This deadline is the time, e.g., in seconds, that must elapse before one of the miners (e.g., nodes) selected to participate in solving the proof-of-capacity consensus is selected as the miner (node) to find a solution to the nonce. The nonce (number only used once) is a number that the miner is solving, for example, for guessing, as a solution to a cryptographic problem. This cryptographic problem is the nonce solution (stored in the nonce mining difficulty database 64 in the key-value database 60).

[0047] At 920, all nodes participating in solving the proof-of-capacity cryptographic consensus problem store all possible solutions to the nonce in their nonce solution stores 66. That is, at 920, each node selected to participate in the proof-of-capacity consensus stores all possible solutions to the nonce in its nonce solution store 62. At 925, each node selected as a miner to participate in the proof-of-capacity consensus begins a proof-of-capacity consensus algorithm calculation. In one embodiment, each possible solution from the nonce solution store 66 is used by the respective nonce solution generators 44 of each node (e.g., miners) selected to participate in the blockchain proof-of-capacity consensus to generate a solution to the nonce. At 930, the first node containing a solution to the nonce within the deadline is selected to issue a certificate of authority. That is, at 930, the node that solves the nonce issues a new Certificate of Authority. If no node finds a solution to the nonce within a specified deadline, the main miner is selected as the node to issue the Certificate of Authority at 940. In one or more embodiments, the solution to the nonce does not need to be found (guessed) by the main miner or other nodes during implementation.

[0048] 10 illustrates a method 1000 for synchronizing data across nodes, such as node 25, of a network, such as closed network 30. While exemplary flowchart method 1000 is described for convenience and without intent to limit the disclosure as including a series of steps or steps, it is understood that the process need not be performed as a series of steps, and / or the steps need not be performed in the order shown and described with respect to FIG. 10 , but rather that the process can be integrated and / or one or more steps can be performed together simultaneously, or steps can be performed in the order disclosed or in an alternate order.

[0049] At 1005, the log and / or database are stored in the RAFT protocol module along with a timestamp. RAFT (Reliable, Replicated, Redundant, and Fault-tolerant) is a consensus algorithm that provides a means for distributing state machines across a cluster / network of computing nodes or systems. In one aspect, the log and / or database are stored in the RAFT protocol module 46 of the plug-in 40 of the node 25 along with a timestamp. At 1010, in response to an event occurring on any node, or at the time the event occurs, or both, data about the event is recorded in the RAFT protocol module 46. At 1015, one node is selected as the RAFT leader. In one embodiment, each node takes turns being the RAFT leader, preferably in a round-robin fashion, although other selection processes are contemplated. At 1020, the database in the RAFT leader node is shared with the remaining nodes. The database in a RAFT leader can be shared in response to an event occurring on the node at a fixed or dynamic period, or when an event occurs on the node, or according to other criteria. RAFT protocols are known in the art, and other means of distributing state machines across the nodes of a network are also contemplated.

[0050] The present invention may be a system, method, or computer program product, or combination thereof, at any level of technical detail that allows integration. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to carry out aspects of the present invention.

[0051] The computer-readable storage medium may be any tangible device capable of holding and storing instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or raised structures in grooves having instructions recorded thereon, and any suitable combination thereof. As used herein, computer-readable storage media should not be construed as being, per se, ephemeral signals, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating in waveguides or other transmission bodies (e.g., light pulses traveling in fiber optic cables), or electrical signals transmitted over electrical wires.

[0052] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each corresponding computing / processing device, or can be downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. This network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within each corresponding computing / processing device.

[0053] The computer-readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or configuration data for an integrated circuit, or may be source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the “C” programming language or the like. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or remote server. In the last scenario above, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to carry out aspects of the present invention.

[0054] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0055] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, produce means for performing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium, directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium having instructions stored therein comprises an article of manufacture including instructions for implementing aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0056] These computer-readable program instructions may further be loaded into a computer, other programmable data processing apparatus or other device to cause the computer, other programmable apparatus or other device to perform a series of operational steps to produce a computer-implemented process such that the instructions, executing on the computer, other programmable apparatus or other device, perform the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0057] The flowcharts and block diagrams in the accompanying figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions that implement the specified logical function(s). In some alternative implementations, the functions shown in the blocks may be executed in an order different from that shown in the figures. For example, two blocks shown in succession may in fact be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0058] Additionally, systems according to various embodiments may include a processor, a functional unit of a processor, or a computer-implemented system, and logic integrated with and / or executable by the system, processor, or functional unit, where the logic is configured to perform one or more of the process steps described herein. By integrated with, in one embodiment, it is meant that the functional unit or processor has logic implemented as hardware logic, such as an application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or the like. By executable by a functional unit or processor, in one embodiment, it is meant that the logic is hardware logic; software logic, such as firmware, a portion of an operating system, a portion of an application program, or the like; or some combination of hardware or software logic accessible by the functional unit or processor and configured, when executed by the functional unit or processor, to cause the functional unit or processor to perform a function. Software logic may be stored in any memory type known in the art, local memory, remote memory, or both. Any processor known in the art may be used, such as a software processor module or a hardware processor such as an ASIC, FPGA, central processing unit (CPU), integrated circuit (IC), graphics processing unit (GPU), or both.

[0059] It will be apparent from the foregoing description that various features of the above systems and / or methods can be combined in various ways to create multiple combinations. It will also be appreciated that embodiments of the present invention can be provided in the form of a service that is deployed for customers to provide services on demand.

[0060] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the present invention. Unless otherwise defined herein, all terms are to be given their broadest possible interpretation, including the meaning implied by the specification and the meaning understood by those skilled in the art and / or defined in dictionaries, academic treatises, etc. As used herein, the singular forms "a," "an," and "the" are intended to include the plural unless the context makes clear otherwise. As used herein, the terms "comprises" and / or "comprising" specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but are understood not to preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof. Corresponding structures, materials, operations, and equivalents of all elements recited in a claim are intended to include any structure, material, or operation for performing a function in combination with elements of other claims recited in the claim. The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the disclosed forms. Many changes and modifications will become apparent to those skilled in the art without departing from the scope of the invention. The embodiments and terminology have been chosen and described to best explain the principles and practical application of the invention and to enable others skilled in the art to understand the invention in terms of various embodiments with various modifications suited to the particular uses contemplated.

Claims

1. 1. A computer-implemented method for providing access to a network of computing nodes, the method comprising: requesting access by a client to a host node within said network; ranking the computing nodes in the network; selecting one or more computing nodes to participate in a proof-of-capacity consensus to find a solution to a nonce according to the ranking of the computing nodes in the network; Selecting a digital certificate issuer; verifying the identity of the client token with the digital certificate issuer; adding, by the digital certificate issuer, the nonce to a distributed ledger; and granting said client access to said host node within said network; 20. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, wherein ranking the computing nodes in the network is based on unused CPU capacity of the computing nodes.

3. 2. The computer-implemented method of claim 1, further comprising selecting the computing node with the highest rank as a main miner, and retrieving, by the main miner, deadlines from a plug-in installed on the main miner.

4. 4. The computer-implemented method of claim 3, further comprising storing all possible solutions to the nonce in a nonce solution store on all of the computing nodes selected to participate in the proof-of-capacity consensus.

5. 5. The computer-implemented method of claim 4, further comprising: computing the proof-of-capacity consensus by all the computing nodes selected to participate in the proof-of-capacity consensus to find a solution to the nonce.

6. 6. The computer-implemented method of claim 5, further comprising selecting the computing node containing the solution to the nonce as being the digital certificate issuer.

7. computing the proof-of-capacity consensus by all the computing nodes selected to participate in the proof-of-capacity consensus to find a solution to the nonce; and selecting the main miner as the digital certificate issuer in response to none of the computing nodes selected to participate in the proof-of-capacity consensus finding a solution to the nonce by the deadline. The computer-implemented method of claim 4 further comprising:

8. and further comprising adding a new host node to the network, wherein adding a new host node to the network comprises: determining, by all of the computing nodes on the network, whether the new host node has a set of defined network characteristics; retrieving state information from the new host node in response to determining that the new host node has a set of defined network characteristics; and Sharing the state information with all of the computing nodes on the network. The computer-implemented method of claim 1 , comprising:

9. 10. The computer-implemented method of claim 8, wherein adding a new host node to the network further comprises sharing the distributed ledger with the new host node.

10. adding a new host node to the network; ensuring that the new host node is added to the same network as the computing node; installing a plug-in on the new host node; detecting the network by the plug-in; and notifying all of the computing nodes on the network that a new host node has joined the network; The computer-implemented method of claim 9 further comprising:

11. 10. The computer-implemented method of claim 9, wherein sharing the distributed ledger with the new host node comprises utilizing a RAFT protocol, and wherein a database containing the distributed ledger in a RAFT leader node is shared with the new host node.

12. A computer program product for causing a computer to carry out the method according to any one of claims 1 to 11.

13. A non-transitory computer readable medium having recorded thereon the computer program of claim 12.

14. 1. A computer-implemented system for configuring a network of computing nodes, comprising: a memory storage device containing program instructions; a hardware processor having circuitry and logic for executing said program instructions for configuring said network of computing nodes; the hardware processor is coupled to the memory storage device and, in response to executing the program instructions, requesting, by a client, remote access to a host node within said network of computing nodes; ranking the computing nodes in the network; selecting one or more computing nodes to participate in a proof-of-capacity consensus to find a solution to a nonce according to the ranking of the computing nodes in the network; Selecting a digital certificate issuer; verifying the identity of the client token with the digital certificate issuer; adding, by the digital certificate issuer, the nonce to a distributed ledger; and granting said client access to said host node within said network; 1. A computer-implemented system configured to execute

15. ranking the computing nodes in the network according to an amount of unused CPU capacity; selecting a plurality of computing nodes to participate in a proof-of-capacity consensus to find a solution to the nonce based on the ranking of the amount of unused CPU capacity; selecting the digital certificate issuer is performed by selecting a computing node as the digital certificate issuer; 15. The computer-implemented system of claim 14.

16. computing the proof-of-capacity consensus by all of the computing nodes selected to participate in the proof-of-capacity consensus to find a solution to the nonce; and selecting the computing node containing the solution for the nonce as being the digital certificate issuer; 16. The computer-implemented system of claim 14 or 15, further configured to execute:

17. selecting the computing node with the highest rank as the main miner; computing the proof-of-capacity consensus by all the computing nodes selected to participate in the proof-of-capacity consensus to find a solution to the nonce; and selecting the main miner as the digital certificate issuer in response to none of the computing nodes selected to participate in the proof-of-capacity consensus finding a solution to the nonce by a deadline.

17. The computer-implemented system of claim 16, further configured to execute:

18. and further configured to add a new host node to the network, wherein adding a new host node to the network comprises: determining, by all of the computing nodes on the network, whether the new host node has a set of defined network characteristics; and retrieving state information from the new host node in response to determining that the new host node has a set of defined network characteristics; and Sharing the state information with all of the computing nodes on the network. configuring the computer-implemented system to execute 16. A computer-implemented system according to claim 14 or 15, comprising:

19. Adding a new host node to the network further comprises: determining whether the new host node is to be added to the same network as other computing nodes; In response to determining that the new host node is to be added to the same network as other computing nodes, installing a plug-in on the new host node; detecting the network by the plug-in; notifying all of the computing nodes on the network that a new host node has joined the network; and Sharing the distributed ledger with the new host node. configuring the computer-implemented system to execute Including, the plugin includes a certificate issuer module, a ranking algorithm module, a nonce generator, a document database containing the distributed ledger and state information, and a key-value database; 20. The computer-implemented system of claim 18.

Images