# US 2019/0320018 A1 · Replicating data over a public network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0320018 A1 - Document ID: US20190320018A1 - Status: Published application - Kind: A1 - Application number: 15/954,856 - Filed: 2018-04-17 - Published: 2019-10-17 - Earliest claimed: 2018-04-17 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Gurunatha Karaje; Tomasz Barszczak; Kevin Kauffman; Nguyen Truong; Cristian Medina Abkarian; Michael E. Root; Liam McArdle; Zaid Bin Tariq - Web page: https://patentgrep.com/patent/US20190320018A1 ## CPC - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 67/2871: Implementation details of single intermediate entities - H04L 67/564: Enhancement of application control based on intercepted application data - H04L 61/2514: between local and global IP addresses - H04L 61/2517: using port numbers - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A technique includes causing an agent device to setup a replication partnership between a first storage node and a second storage. Causing the agent device to setup the replication partnership includes configuring a proxy server that is associated with the second storage node to establish a secure communication channel for the replication partnership over a public network. Configuring the proxy server includes storing in the proxy server credentials for authenticating the first storage node to use the secure communication channel; and establishing port translations to be used in the secure communication channel in communicating replication data between the first storage node and the second storage node. Causing the agent device to setup the replication partnership may also include communicating replication partnership information to the second node. ## Claims ### Claim 1 A method comprising: causing an agent device to set up a replication partnership between a first storage node and a second storage node, wherein causing the agent device to setup the replication partnership comprises: configuring a proxy server that is associated with the second storage node to establish a secure communication channel for the replication partnership over a public network, wherein configuring the proxy server comprises: storing in the proxy server credentials for authenticating the first storage node to use the secure communication channel; and establishing port translations to be used in the secure communication channel in communicating replication data between the first storage node and the second storage node; and communicating replication partnership information to the second storage node. ### Claim 2 (depends on 1) The method of claim 1, wherein the proxy server and the second storage node comprise part of a private network; the private network comprises a plurality of storage nodes, including the second storage node; and configuring the proxy server further comprises selecting the second storage node from among the plurality of storage nodes. ### Claim 3 (depends on 1) The method of claim 1, wherein establishing the port translations comprises configuring local tunnel and reverse tunnel port translations associated with a public Internet Protocol (IP) address of the proxy server. ### Claim 4 (depends on 1) The method of claim 1, wherein configuring the proxy server comprises configuring the proxy server to communicate with a tunnel endpoint associated with the first storage node. ### Claim 5 (depends on 1) The method of claim 1, further comprising: providing a portal accessible through a public network to receive data representing the credentials of the first storage node. ### Claim 6 (depends on 5) The method of claim 5, further comprising: using the portal to receive input identifying a geographic region for a replication partner for the first storage node; selecting the second storage node based on the identified geographic region; and communicating an identifier to the proxy server, wherein the identifier identifies the second storage node. ### Claim 7 (depends on 6) The method of claim 6, further comprising: further basing selection of the second storage node on input identifying a storage tier associated with the replication partnership. ### Claim 8 (depends on 1) The method of claim 1, wherein configuring the proxy server further comprises configuring the proxy server to select one of the first storage node and the second storage node to be a replication source or a replication target. ### Claim 9 (depends on 1) The method of claim 1, wherein configuring the proxy server further comprises: communicating a key associated with the first storage node to the proxy server. ### Claim 10 (depends on 1) The method of claim 1, wherein configuring the proxy server further comprises communicating data to the proxy server representing a replication partnership identification associated with the first storage node and a replication partnership credential associated with the first storage node. ### Claim 11 (depends on 1) The method of claim 1, wherein configuring the proxy server further comprises communicating data representing an identification of the first storage node. ### Claim 12 An apparatus comprising: at least one processor; and a memory that stores instructions that, when executed by the at least one processor, cause the at least one processor to: store in a proxy server credentials for authenticating a first storage node to use a secure communication channel, wherein the first storage node is associated with a replication partnership with a second storage node; establish port translations to be used in the secure communication channel to communicate replication data between the first storage node and the second storage node; and communicate replication partnership information to the second storage node. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the instructions, when executed by the at least one processor, cause the at least one processor to: provide a portal accessible through a public network to receive data representing a credential of the first storage node. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the instructions, when executed by the at least one processor, cause the at least one processor to: use the portal to receive input identifying a geographic region for a replication partner for the first storage node; select the second storage node based on the identified geographic region; and communicate an identifier to the proxy server, wherein the identifier identifies the second storage node. ### Claim 15 (depends on 12) The apparatus of claim 12, wherein the instructions, when executed by the at least one processor, cause the at least one processor to configure the proxy server to set up a network tunnel. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the network tunnel comprises a Secure Shell (SSH) tunnel. ### Claim 17 A non-transitory storage medium storing instructions that, when executed by a machine, cause the machine to: provide an interface to receive input representing a credential associated with a first storage node and input representing criteria to select a replication partner storage node for the first storage node; access a proxy server for the replication partner storage node; communicate data representing the credential to the proxy server; and communicate with the proxy server to set up port forwarding for a future secure network tunnel to communicate replication data between the first storage node and the replication partner storage node, wherein the proxy server forms an endpoint of the secure network tunnel and the first storage node forms another endpoint of the secure network tunnel. ### Claim 18 (depends on 17) The non-transitory storage medium of claim 17, wherein the instructions, when executed by the machine, cause the machine to: provide access to the interface via a public network. ### Claim 19 (depends on 17) The non-transitory storage medium of claim 17, wherein the instructions, when executed by the machine, cause the machine to communicate with the proxy server to reserve a public network port of the proxy server and map the public network port to a private network port of the replication partner storage node. ### Claim 20 (depends on 17) The non-transitory storage medium of claim 17, wherein the instructions, when executed by the machine, cause the machine to select the replication partner based on a selection criteria.