# US 12,113,796 B2 · Secured data access in virtual data processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,796 B2 - Document ID: US12113796B2 - Status: Granted - Kind: B2 - Application number: 17/708,783 - Filed: 2022-03-30 - Published: 2023-10-05 - Granted: 2024-10-08 - Earliest claimed: 2022-03-30 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Xiongbing Ou; Thomas Anthony Phelan; David E. Lee; Ramaswami Kishore - Web page: https://patentgrep.com/patent/US12113796B2 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Secured data access in virtual data processing is described. An example includes instructions to receive a request from an application in a compute node of a compute cluster in a virtual data processing environment to access a secured data source for a user, the virtual data processing environment including a multiple secured data sources that are accessible by compute nodes of the virtual compute cluster; fetch a credential in a current application context and forward the credential for validation; validate the credential with a credential authority; and, upon successfully validating the credential, authenticate the user at the secured data source and establish a connection with the secured data source. ## Claims ### Claim 1 A non-transitory computer-readable storage medium comprising instructions that upon execution cause a system to: intercept, by a first data agent in a first virtual compute node, a first request from an application in the first virtual compute node to access a secured data source for a requester, the first virtual compute node being one of a plurality of virtual compute nodes of a compute cluster in a virtual data processing environment including a plurality of secured data sources that are accessible by the plurality of virtual compute nodes, the secured data source being secured with a security authentication technology; forward, by the first data agent, the first request to a first data daemon outside the first virtual compute node; validate, by the first data daemon with a credential authority, a credential from a current application context associated with the first request; based on successfully validating the credential: authenticate, by the first data daemon, the requester using the security authentication technology for the secured data source, establish a connection with the secured data source for access by the application to the secured data source, and generate, by the first data daemon, a delegation token comprising a value based on an authentication secret of the secured data source; send the delegation token to a second virtual compute node of the plurality of virtual compute nodes; send, by a second data agent in the second virtual compute node, the delegation token to a second data daemon for a second request to access the secured data source intercepted by the second data agent; validate, by the second data daemon, the delegation token from the second data agent; and based on validating the delegation token, authenticate, by the second data daemon, with the secured data source for the requester that initiated the second request. ### Claim 2 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the plurality of secured data sources comprises a second secured data source that is secured with a second security authentication technology that is different than the security authentication technology for the secured data source. ### Claim 3 (depends on 2) The non-transitory computer-readable storage medium of claim 2, wherein the security authentication technology for the secured data source uses a first type of authentication secret, and the second security authentication technology for the second secured data source uses a second type of authentication secret different from the first type of authentication secret. ### Claim 4 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the first data agent implements an API (Application Programming Interface), and the first request to access the secured data source is made via the API. ### Claim 5 (depends on 4) The non-transitory computer-readable storage medium of claim 4, wherein the API includes a Hadoop Distributed File System (HDFS) API. ### Claim 6 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the credential is obtained from a shared storage, the shared storage being accessible to each virtual compute node of the compute cluster. ### Claim 7 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the value in the delegation token comprises a signature, and wherein the validating of the delegation token by the second data daemon comprises: calculating, by the second data daemon, a calculated signature based on the authentication secret of the secured data source, and comparing, by the second data daemon, the calculated signature to the signature in the delegation token. ### Claim 8 (depends on 1) The non-transitory computer-readable storage medium of claim 1, further comprising instructions that when executed cause the system to: request the credential from the credential authority and receive the credential at the first virtual compute node. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the credential is a Kerberos credential, and the credential authority is a Kerberos Key Distribution Center (KDC). ### Claim 10 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein each of the first and second virtual compute nodes includes a container or a virtual machine. ### Claim 11 A method comprising: intercepting, by a first data agent in a first virtual compute node, a first request from an application in the first virtual compute node to access a secured data source for a requester, the first virtual compute node being one of a plurality of virtual compute nodes of a compute cluster in a virtual data processing environment including a plurality of secured data sources that are accessible by the plurality of virtual compute nodes, the secured data source being secured with a security authentication technology; forwarding, by the first data agent, the first request to a first data daemon outside the first virtual compute node; validating, by the first data daemon with a credential authority, a credential from a current application context associated with the first request; based on successfully validating the credential: authenticating, by the first data daemon, the requester using the security authentication technology for the secured data source, establishing a connection with the secured data source for access by the application to the secured data source, and generating, by the first data daemon, a delegation token comprising a value based on an authentication secret of the secured data source; sending the delegation token to a second virtual compute node of the plurality of virtual compute nodes; sending, by a second data agent in the second virtual compute node, the delegation token to a second data daemon for a second request to access the secured data source intercepted by the second data agent; validating, by the second data daemon, the delegation token from the second data agent; and based on validating the delegation token, authenticating, by the second data daemon, with the secured data source for the requester that initiated the second request. ### Claim 12 (depends on 11) The method of claim 11, wherein the plurality of secured data sources comprises a second secured data source that is secured with a second security authentication technology that is different than the security authentication technology for the secured data source. ### Claim 13 (depends on 11) The method of claim 11, wherein the delegation token is generated further based on a timestamp. ### Claim 14 (depends on 12) The method of claim 12, wherein the security authentication technology for the secured data source uses a first type of authentication secret, and the second security authentication technology for the second secured data source uses a second type of authentication secret different from the first type of authentication secret. ### Claim 15 (depends on 11) The method of claim 11, wherein the credential is a Kerberos credential, and the credential authority is a Kerberos Key Distribution Center (KDC). ### Claim 16 A computing system comprising: a processor; and a non-transitory storage medium storing instructions executable on the processor to: intercept, by a first data agent in a first virtual compute node, a first request from an application in the first virtual compute node to access a secured data source for a requester, the first virtual compute node being one of a plurality of virtual compute nodes of a compute cluster in a virtual data processing environment including a plurality of secured data sources that are accessible by the plurality of virtual compute nodes, the secured data source being secured with a security authentication technology; forward, by the first data agent, the first request to a first data daemon outside the first virtual compute node; validate, by the first data daemon with a credential authority, a credential from a current application context associated with the first request; and based on successfully validating the credential: authenticate, by the first data daemon, the requester using the security authentication technology for the secured data source, establish a connection with the secured data source for access by the application to the secured data source, and generate, by the first data daemon, a delegation token comprising a value based on an authentication secret of the secured data source; send the delegation token to a second virtual compute node of the plurality of virtual compute nodes; send, by a second data agent in the second virtual compute node, the delegation token to a second data daemon for a second request to access the secured data source intercepted by the second data agent; validate, by the second data daemon, the delegation token from the second data agent; and based on validating the delegation token, authenticate, by the second data daemon, with the secured data source for the requester that initiated the second request. ### Claim 17 (depends on 16) The computing system of claim 16, wherein the plurality of secured data sources comprises a second secured data source that is secured with a second security authentication technology that is different than the security authentication technology for the secured data source. ### Claim 18 (depends on 17) The computing system of claim 17, wherein the security authentication technology for the secured data source uses a first type of authentication secret, and the second security authentication technology for the second secured data source uses a second type of authentication secret different from the first type of authentication secret. ### Claim 19 (depends on 16) The computing system of claim 16, wherein the value in the delegation token comprises a signature, and wherein the validating of the delegation token by the second data daemon comprises: calculating, by the second data daemon, a signature based on the authentication secret of the secured data source, and comparing, by the second data daemon, the calculated signature to the signature in the delegation token. ### Claim 20 (depends on 16) The computing system of claim 16, wherein the credential is a Kerberos credential, and the credential authority is a Kerberos Key Distribution Center (KDC).