IAM Key Fencing for Shared Storage in Cluster Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In scalable data storage systems, particularly in cloud environments, there is a lack of effective fencing mechanisms to ensure data consistency and prevent unauthorized access to shared storage resources when cluster nodes become unavailable, leading to potential data integrity issues and resource conflicts.
Innovation Solution
Implement identity and access management (IAM) to generate individualized secret access keys for each service in a cluster, allowing only one service to access a resource at a time by using signing keys, and invalidating keys for unavailable services to maintain data consistency and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional fencing mechanisms are used in scalable data storage systems, then data consistency can be maintained, but the system lacks adaptability to cloud environments and cannot effectively prevent unauthorized access when cluster nodes become unavailable
Solution Approach 1:
The patent changes the access control parameter from traditional fencing mechanisms to IAM-based access keys and signing keys. This allows the system to maintain data consistency while adapting to cloud environments by using cryptographic key validation instead of conventional fencing approaches.
Solution Approach 2:
The patent replaces the mechanical fencing system with an information-based IAM system that uses digital signatures and key validation. This substitution enables effective access control in virtualized cloud environments where traditional mechanical fencing is not feasible.
2Productivity
If multiple services in a cluster can access shared storage resources simultaneously, then system availability is improved, but data consistency and resource conflict prevention deteriorate
Solution Approach 1:
The patent segments the access rights by providing unique signing keys to each service. This segmentation allows multiple services to access shared storage simultaneously while maintaining data consistency, as each service's actions can be individually validated and tracked through its unique cryptographic key.
3Reliability
If access keys are invalidated for unavailable services, then unauthorized access is prevented, but key management complexity increases
Solution Approach 1:
The patent implements a feedback mechanism where the IAM system receives notifications about service availability status and automatically responds by invalidating or regenerating access keys. This automated feedback loop prevents unauthorized access while managing key complexity through systematic key rotation based on service health status.
Data Source
AI summary
A system prompts a key manager to provide access keys, to access resources stored by a shared storage, for a group of services hosted by nodes of a cluster. The group of services receive the access keys from the key manager. The first service in the group of services uses the first access key to create a signing key, which is used to sign a request, which is sent to the shared storage, which enables access to the first resource. The system detects the second service in the group of services becoming unavailable for the cluster. The system informs the key manager that the second service is removed from the groups of services, which prompts the key manager to invalidate use of the access key provided for the second service, after which the first service continues using the first access key to access the first resource.