Establishing trust relationships between computer systems

#Computer systems often have various roles and relationships. For example, one computer system may operate as an email server, a web server, or a domain controller, while another computer system may operate as a client. Some computer systems may have authority to perform actions, such as authenticating other computer systems, not granted to others. One type of relationship is a trust relationship, in which a trustee establishes that a particular computer system is trusted to perform one or more actions.

#One type of trust relationship is established between a computer system acting in the role of a domain controller and one or more computer systems that are members of a domain. Computer systems join the domain by performing a domain join action that typically involves presenting a set of credentials (e.g., a username and password) to the domain controller, waiting for the domain controller to validate the credentials, and providing information (e.g., keys or other information) that allows the computer system to act as a member of the domain. In a Microsoft Windows environment, a domain join may involve saving state changes to Active Directory Domain Services and saving state changes on the computer system that is joining the domain.

#A common point of failure in domain join and other trust establishing operations is that each computer system involved in the operation is expected to maintain uninterrupted network connectivity during the entire operation, which may involve sending and receiving many packets back and forth between the computer systems. Although the probability of a single domain join action failing due to an interruption in connectivity is generally low, the probability increases dramatically in common server provisioning scenarios. For example, an organization might want to deploy many physical or virtual machines in a data center over a short period. The extra burden on the domain controller or other trust authority may cause slow responses to some target computer systems and failures of the trust operation. Even if only 5% of the operations fail, the administrative burden to track down which target computer systems successfully established a trust relationship and which did not can be unacceptably high.

#FIG. 1 is a block diagram that illustrates components of the offline trust system, in one embodiment.

#FIG. 2 is a flow diagram that illustrates processing of the provisioning component to establish trust with a target computer system, in one embodiment.

#FIG. 3 is a flow diagram that illustrates processing of the target configuration component to configure a target computer system, in one embodiment.

#An offline trust system is described herein that establishes a trust relationship between a trust authority computer system and a target computer system without relying on an active network connection between the computer systems. The offline trust system separates the trust establishment operation into a provisioning phase and a configuration phase. The provisioning phase can be performed entirely on the trust authority, such as a domain controller, while the configuration phase can be performed entirely on the target computer system requesting trust. In addition, the two phases can be performed at different times and do not assume any connection between the two computer systems. The provisioning phase involves presenting a set of credentials to the trust authority along with a request to establish a trust relationship. The trust authority stores the output of the provisioning phase into a data blob containing all of the information that the target computer system will use to complete the trust relationship. The provisioning phase completes all of the state changes and storage of new state expected by the trust authority to establish a trust relationship. For example, in a Microsoft Windows environment, a domain controller may modify Active Directory with information about a new target computer system joined to the domain, even before the target computer system has ever communicated with the domain controller. An administrator may perform the provisioning phase for many target computer systems at the same time, such as to provision servers for a data center.

#The configuration phase begins by receiving the data blob created during the provisioning phase. The target computer system may receive the data blob through a wide variety of mechanisms, including over a network, by manual transfer (e.g., storage to a USB drive that is later inserted in the target computer system), or any other method. Notably, even when network communication is used to convey the contents of the data blob, the success of the trust operation is decoupled from the quality of the network connection. If the blob cannot be successfully transferred on the first attempt, it can simply be retransmitted later, as the provisioning phase has already been completed. The configuration phase stores information from the data blob on the target computer system and modifies any state information related to establishing the trust relationship. For example, the operation may store cryptographic information, such as keys or Kerberos tickets, provided in the data blob by the trust authority. Thus, the offline trust system provides a way to establish trust between computer systems that is more reliable and less prone to failure, even when provisioning many target computer systems in a short period.

#FIG. 1 is a block diagram that illustrates components of the offline trust system, in one embodiment. The system 100 includes a provisioning component 110, a trust authority store 120, a blob transfer component 130, a target configuration component 140, a target store 150, and an application interface component 160. Each of these components is described in further detail herein.