Dynamic Shared-Storage Access Keys for Cluster Service Fencing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems in clusters lack effective methods to ensure data consistency and prevent unauthorized access by nodes that have lost cluster membership, particularly in scalable and cloud-based environments, leading to inefficiencies and resource wastage.
Innovation Solution
Implement a system that generates new secret access keys based on cluster membership changes, using generation identifiers and cryptographic functions to authenticate access requests, ensuring only valid cluster members can access shared storage resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cluster nodes share common access keys to shared storage, then ease of operation is improved, but security deteriorates because non-member nodes can still access resources after being removed from the cluster
Solution Approach 1:
The access key is made dynamic by associating it with a generation identifier that changes when cluster membership changes. The storage system generates a new access key for each generation, ensuring that only nodes with the current generation's key can access resources. This resolves the contradiction by maintaining ease of operation for member nodes while automatically preventing access by non-member nodes.
Solution Approach 2:
The system performs preliminary action by invalidating old access keys before a node is officially removed from the cluster. When the storage system detects a generation change, it proactively revokes previous access keys, ensuring that even if a node is not properly removed from the cluster, it cannot access resources with its old key. This prevents the security vulnerability while maintaining operational simplicity.
2Reliability
If access keys are changed frequently to maintain security, then reliability is improved, but device complexity increases due to key management overhead
Solution Approach 1:
The generation identifier serves as an intermediary between the cluster membership state and the access key. Instead of directly managing complex key rotation when nodes are added or removed, the system uses the generation identifier as a simple mediator that triggers automatic key updates. This reduces key management complexity while maintaining reliable access control, as the intermediary abstracts the complexity of when and how keys should change.
3Reliability
If the storage system generates new access keys for each cluster generation, then security is improved, but use of energy increases due to additional cryptographic operations
Solution Approach 1:
The system uses periodic action by generating new access keys only at specific intervals - specifically, when the generation identifier changes. Instead of continuously validating or rotating keys, the system performs cryptographic operations periodically at generation boundaries. This reduces energy consumption compared to continuous key management while maintaining security through regular key updates triggered by cluster events.
Data Source
AI summary
A cluster service receives a cluster message based on a removal of a first service from membership in a first node in a cluster, and requests a shared storage to generate and then provide a new access key, thereby enabling the shared storage to use the new access key to validate requests to access resources stored by the shared storage. The cluster service receives the new access key from the shared storage, and sends the new access key in at least some cluster messages to at least a second service in a second node in the cluster of nodes. The second service creates a key based on the new access key. The second service uses the key to create a request to access a resource stored by the shared storage, sends the request to the shared storage, and then accesses the resource, which was previously accessed by the first service.