Distributed Credential Storage for Machine Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized storage of access credentials in machine scanning systems poses a single point of failure and significant security risks, hindering the implementation of highly available and scalable network scanning services.
Innovation Solution
Implementing a distributed credential storage system where access credentials are partitioned into portions and stored across multiple scanner nodes, ensuring no single node holds all portions, with redundant storage and secure encryption using asymmetric keys to enhance security and availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are stored in a centralized repository, then credential management is simplified, but the system creates a single point of failure and security risk
Solution Approach 1:
The patent divides the centralized credential repository into multiple distributed scanner nodes, where each node stores only a portion of credentials. This segmentation eliminates the single point of failure while maintaining credential management functionality through the coordination layer that tracks credential locations across the distributed network.
2Ease of operation
If credentials are stored in a centralized repository, then credential management is simplified, but security risk increases substantially
Solution Approach 1:
By segmenting the credential repository into distributed portions across multiple scanner nodes, the patent reduces security risk. If one node is compromised, only a portion of credentials are affected, not the entire credential base. The coordination layer manages these distributed portions without requiring a centralized storage point.
Solution Approach 2:
Each scanner node stores only the credential portions it needs for its specific scanning tasks, rather than all credentials being available centrally. This local quality approach ensures that credential access is distributed and limited to what is necessary for each node's function, reducing overall security exposure.
3Reliability
If credentials are distributed across multiple nodes, then system reliability and security are improved, but system complexity increases
Solution Approach 1:
The patent introduces a coordination layer as an intermediary that manages the distributed credential portions across scanner nodes. This coordination layer tracks which nodes hold which credential portions and facilitates credential retrieval without requiring complex peer-to-peer coordination between nodes, thereby managing the complexity of the distributed system.
4Object-affected harmful factors
If credentials are distributed across multiple nodes, then security is improved, but credential retrieval complexity increases
Solution Approach 1:
The coordination layer acts as a mediator that simplifies credential retrieval from the distributed network. When a scanner node needs a credential, it requests the coordination layer, which then directs the request to the appropriate node(s) holding the required credential portions and facilitates reconstruction of the full credential, thereby managing retrieval complexity.
Data Source
AI summary
Systems and methods are disclosed to implement a machine scanning system that stores machine access credentials in a distributed fashion in a pool of scanner nodes. In embodiments, a storage manager node is selected from the pool to manage the storage of each new credential. The storage manager partitions the credential into portions and distributes the portions among the nodes, which may store the portions under different encryptions. A credential storage metadata is updated to indicate portion assignments and also distributed. At scanning time, the node selected to perform the scan uses the credential storage metadata to gather the portions and reconstruct the credential. In embodiments, the portions may be assigned so that no single node holds all portions of the credential, and at least two nodes hold each portion. Advantageously, the disclosed storage scheme enhances the security and availability of access credentials used by the machine scanning system.