Techniques for securing a centralized metadata distributed filesystem

A method performed by a data server of a plurality of data servers connected to a network, the data server including data storage managed by a remote metadata server, the metadata server managing storage of data across the plurality of data servers, the method comprising:

• receiving, via the network, an access request from a client, the access request requesting access to a portion of the data storage of the data server;
• testing whether the access request includes a data server specific token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• and
• in response to testing, providing the client with access to the portion of data storage on condition that the access request includes the token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• wherein testing includes:
• extracting the token from the access request;
• computing a test token by applying a message authentication code algorithm using an authentication key uniquely shared between the data server and the metadata server to a combination of an identifier of the client, an identifier of the portion of data storage, and an expiration time;
• and
• determining that the access request includes the token authenticating that the client has been authorized by the metadata server to access the portion of data storage if and only if the extracted token matches the test token and the expiration time is in the future;
• wherein the method further comprises, prior to receiving the access request from the client, engaging in a registration procedure with the metadata server, wherein engaging in the registration procedure with the metadata server includes:
• generating the authentication key;
• encrypting the generated authentication key using a public key of the metadata server, thereby generating a ciphertext;
• embedding the ciphertext within a registration message;
• sending the registration message to a trusted administrator;
• in response to sending, receiving an administrator signature from the administrator, the administrator signature being a cryptographic signature of the registration message with a private key of the administrator;
• and
• sending the registration message and the received administrator signature to the metadata server for validation.

A data server apparatus comprising:

• data storage managed by a remote metadata server, the metadata server managing storage of data across a plurality of data servers;
• a network interface;
• a processor;
• and
• memory, the memory storing instructions, which when performed by the processor, cause the apparatus to perform the following operations:
• receiving, via the network interface, an access request from a client, the access request requesting access to a portion of the data storage;
• testing whether the access request includes a data server specific token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• in response to testing, providing the client with access to the portion of data storage on condition that the access request includes the token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• extracting a ciphertext from within the access request, the ciphertext having been provided to the client by the metadata server;
• and
• decrypting the ciphertext using a first encryption key to learn a second encryption key, the first encryption key being uniquely shared between the metadata server and the data server apparatus, the second encryption key having been assigned, for a limited period of time, by the metadata server for protecting interactions between the client and the data server apparatus, the second encryption key having been cryptographically embedded by the metadata server within the ciphertext using the first encryption key, the metadata server having provided the ciphertext to the client;
• wherein the operation of providing the client with access to the portion of data storage includes cryptographically exchanging data with the client using the second encryption key learned from decrypting the ciphertext from the access request, the second encryption key having also been provided to the client by the metadata server encrypted using a third encryption key uniquely shared between the metadata server and the client.

A data server apparatus comprising:

• data storage managed by a remote metadata server, the metadata server managing storage of data across a plurality of data servers;
• a network interface;
• a processor;
• and
• memory, the memory storing instructions, which when performed by the processor, cause the apparatus to perform the following operations:
• receiving, via the network interface, an access request from a client, the access request requesting access to a portion of the data storage;
• testing whether the access request includes a data server specific token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• and
• in response to testing, providing the client with access to the portion of data storage on condition that the access request includes the token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• wherein the operation of testing includes:
• extracting the token from the access request;
• computing a test token by applying a message authentication code algorithm using an authentication key uniquely shared between the data server apparatus and the metadata server to a combination of an identifier of the client, an identifier of the portion of data storage, and an expiration time;
• and
• determining that the access request includes the token authenticating that the client has been authorized by the metadata server to access the portion of data storage if and only if the extracted token matches the test token and the expiration time is in the future;
• wherein the instructions, when performed by the processor, further cause the apparatus to, prior to receiving the access request from the client, perform the operation of engaging in a registration procedure with the metadata server, wherein the operation of engaging in the registration procedure with the metadata server includes:
• generating the authentication key;
• encrypting the generated authentication key using a public key of the metadata server, thereby generating a ciphertext;
• embedding the ciphertext within a registration message;
• sending the registration message to a trusted administrator via the network interface;
• in response to sending, receiving an administrator signature from the administrator via the network interface, the administrator signature being a cryptographic signature of the registration message with a private key of the administrator;
• and
• sending, via the network interface, the registration message and the received administrator signature to the metadata server for validation.

A computer program product comprising a non-transitory computer-readable storage medium, storing instructions, which, when performed by a data server computer, cause the data server computer to perform the following operations:

• receiving, via a network, an access request from a client, the access request requesting access to a portion of data storage of the data server computer, the data storage being managed by a remote metadata server, the metadata server managing storage of data across a plurality of data server computers;
• testing whether the access request includes a data server specific token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• in response to testing, providing the client with access to the portion of data storage on condition that the access request includes the token authenticating that the client has been authorized by the metadata server to access the portion of data storage;
• extracting a ciphertext from within the access request, the ciphertext having been provided to the client by the metadata server;
• and
• decrypting the ciphertext using a first encryption key to learn a second encryption key, the first encryption key being uniquely shared between the metadata server and the data server computer, the second encryption key having been assigned, for a limited period of time, by the metadata server for protecting interactions between the client and the data server computer, the second encryption key having been cryptographically embedded by the metadata server within the ciphertext using the first encryption key, the metadata server having provided the ciphertext to the client;
• wherein the operation of providing the client with access to the portion of data storage includes cryptographically exchanging data with the client using the second encryption key learned from decrypting the ciphertext from the access request, the second encryption key having also been provided to the client by the metadata server encrypted using a third encryption key uniquely shared between the metadata server and the client.