Hyper-Converged Infrastructure Credential Rotation and Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined data centers, managing credentials in hyper-converged infrastructures is challenging due to the need for secure and up-to-date known hosts files, which can become corrupt or unavailable, and requires synchronization across multiple physical racks to maintain communication and prevent unauthorized access.
Innovation Solution
Implementing a credentials manager that uses a secure shell (SSH) communication interface, rotates credentials during initialization, and maintains an encrypted version in a shared keys database, along with a strict host key checking mechanism to ensure only authorized resources communicate, and automates synchronization of the known hosts file with the keys database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credentials are managed locally on each rack without synchronization, then each rack can operate independently, but the known hosts file may become corrupt or unavailable and security is compromised across the hyper-converged infrastructure
Solution Approach 1:
The patent combines credential storage and synchronization across multiple racks by implementing a centralized known hosts file that is shared and synchronized between all racks in the hyper-converged infrastructure. This merging approach ensures that all racks access the same authoritative credential data, preventing corruption and availability issues that would occur with independent local storage.
Solution Approach 2:
The patent implements a feedback mechanism where racks continuously synchronize their credential data with the centralized known hosts file. This feedback loop ensures that any changes or updates to credentials are propagated across all racks, maintaining consistency and preventing divergence that could lead to security vulnerabilities or operational failures.
2Reliability
If strict host key checking is implemented to prevent unauthorized access, then security is improved, but communication may be blocked due to corrupt or missing credentials
Solution Approach 1:
The patent performs preliminary synchronization of the known hosts file and credential data before strict host key checking is enforced. By pre-distributing and validating credentials across all racks beforehand, the system ensures that when security checking is activated, legitimate communications are not blocked due to missing or corrupt credentials, while unauthorized access is still prevented.
Solution Approach 2:
The patent implements a cushioning mechanism by maintaining backup copies of the known hosts file and implementing graceful degradation protocols. When credentials are temporarily unavailable or corrupt, the system can fall back to previously validated credentials or enter a safe mode, preventing complete communication failure while maintaining security integrity once credentials are restored.
3Reliability
If credentials are rotated during initialization, then security is enhanced from the start, but the initialization process becomes more complex and time-consuming
Solution Approach 1:
The patent performs credential rotation as a preliminary action during the initialization phase, generating and distributing secure credentials to all racks before the hyper-converged infrastructure begins operational use. By completing this security-critical task during initialization rather than during ongoing operations, the system establishes strong security from the start without significantly impacting operational performance.
Solution Approach 2:
The patent implements automated credential rotation where the system autonomously generates, distributes, and manages credentials across all racks during initialization without requiring manual intervention. This self-service approach to credential management reduces the time and effort required compared to manual credential distribution while ensuring consistent security across the entire infrastructure.
Data Source
AI summary
Methods, apparatus, systems and articles of manufacture manage credentials in hyper-converged infrastructure s are disclosed. An example method includes establishing, by executing an instruction with at least one processor, a communication between a software defined data center manager of the hyper-converged infrastructure and a component of the hyper-converged infrastructure using first credentials included in a known hosts file. The example method also includes generating, by executing an instruction with the at least one processor, second credentials at the component in response to a power-on event detected by the software defined data center manager. The example method also includes recording, by executing an instruction with the at least one processor, the second credentials at the known host file.