Secure Node Discovery in Multi-Tenant Distributed Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-tenant distributed storage systems face challenges in securely discovering and claiming storage nodes over insecure networks, which can lead to security issues such as 'man in the middle' attacks without mutual verification and secure communication.
Innovation Solution
A method is introduced where a central management system establishes trust and a secure channel with unverified client computers by using HTTPS and digital fingerprints, ensuring legitimate registration and data transfer through secure communication protocols like SSL/TLS, and generating unique identifiers and secret keys for secure node registration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If distributed storage nodes are discovered and claimed over an insecure network without mutual verification, then network accessibility and ease of operation are improved, but security reliability deteriorates due to man in the middle attacks
Solution Approach 1:
The patent introduces SSL/TLS certificates as an intermediary verification mechanism between storage nodes and the network. The certificates act as a trusted mediator that enables secure communication over insecure networks by providing mutual authentication, thus resolving the contradiction between network accessibility and security reliability
Solution Approach 2:
The system performs preliminary verification actions by establishing SSL/TLS secure channels before any data transfer or storage operations occur. This preliminary security setup ensures that subsequent operations are protected, allowing the system to maintain both accessibility and security
2Reliability
If SSL/TLS certificates are used for mutual verification between storage nodes and central management system, then security reliability is improved, but device complexity and difficulty of detection increase
Solution Approach 1:
The patent implements self-service mechanisms where storage nodes automatically generate and manage their own SSL/TLS certificates. This automation reduces the operational complexity of certificate management while maintaining high security standards, as the system performs verification tasks autonomously without requiring manual intervention
3Reliability
If SSL/TLS secure channels are established for data transfer, then security reliability is improved, but use of energy and computational resources increases
Solution Approach 1:
The system applies SSL/TLS encryption selectively to only the critical communication channels between storage nodes and the central management system, rather than encrypting all data transfers uniformly. This partial application of security measures maintains essential security while reducing overall computational overhead and energy consumption
Data Source
AI summary
A technique is introduced that enables a server to establish trust of and a secure channel of communication with an unverified client computer, which can be on a different insecure network. To establish trust, the server needs to ensure that the client computer is legitimate, and the client computer similarly needs to ensure that the server is legitimate. With mutual trust established, a secure channel of communication is established between the server and the client computer. With mutual trust and a secure channel of communication established, the client computer can safely communicate with the server, for example, to download software that enables the client computer to join a central management system at the server.