Securing kernel metadata communication in environments employing distributed software services
A system for securing kernel metadata communication in environments employing distributed software services includes a first and a second host linked by a network, where a distributed software service stack at each host includes a respective user-mode software layer and a respective kernel-mode software layer. The first host may be configured to establish a user-mode connection with the second host, e.g., using a secure user-mode communication protocol such as SSL (Secure Sockets Layer). The first and the second hosts may then exchange respective security keys over the secure user-mode connection, upload the security keys to the respective kernel-mode software layers, and use the security keys to secure communication over a kernel-mode connection between the two hosts.
1. A system, comprising:
a first host including a first kernel-mode software layer and a first user-mode software layer of a distributed software service; and
a second host including a second kernel-mode software layer and a second user-mode software layer of the distributed software service;
wherein the first host is configured to initiate a process configured to secure kernel-to-kernel communication between the first host and the second host, wherein said first host is configured to:
establish a user-mode network connection between the first user-mode software layer and the second user-mode software layer, the user-mode network connection being configured to use a secure communication protocol;
transmit a first security key from the first user-mode software layer to the second user-mode software layer over the user-mode network connection;
receive a second security key transmitted from the second user-mode software layer to the first user-mode software layer over the user-mode network connection; and
subsequent to receiving the second security key, initiate establishment of a kernel-mode network connection between the first kernel-mode software layer and the second kernel-mode software layer, wherein the kernel-mode connection is a different connection than the user-mode connection and uses a protocol that does not support said secure communication protocol;
wherein each of the first and second hosts are configured to use the first and second security keys to secure communication between the first kernel-mode software layer and the second kernel-mode software layer over the kernel-mode network connection.
2. The system as recited in claim 1 , wherein said kernel-mode network connection is established using one of a kernel sockets interface, Transport Level Interface, or X/Open Transport Interface.
3. The system as recited in claim 1 , wherein the first and second security keys are public keys, wherein the first host is further configured to:
upload the second security key and a first private key from the first user-mode software layer to the first kernel-mode software layer; and
use the second security key to encrypt a first message sent to the second host over the kernel-mode network connection; and
use the first private key to decrypt a second message received at the first host over the kernel-mode network connection.
4. The system as recited in claim 1 , wherein first host is further configured to:
send a first encoded authentication token to the second host over the kernel-mode network connection; and
wherein the second host is further configured to:
validate the first encoded authentication token using the second security key.
5. The system as recited in claim 1 , wherein the first host is further configured to:
encrypt a message before sending the message over the kernel-mode network connection.
6. The system as recited in claim 1 , wherein the first host is further configured to:
validate a message received over the kernel-mode network connection using a secure sequence number.
7. The system as recited in claim 1 , wherein the first host is further configured to:
validate a message received over the kernel-mode network connection using a checksum.
8. The system as recited in claim 1 , wherein the distributed software service is a storage virtualization service, the first host is a virtual device client and the second host is a virtual device server.
9. The system as recited in claim 8 , further comprising one or more physical storage devices, wherein the virtual device server is further configured to:
aggregate storage within the one or more physical storage devices into a virtual storage device; and
provide metadata for the virtual storage device to the virtual device client over the secure kernel-mode connection.
10. The system as recited in claim 9 , wherein the virtual storage device is a virtual block device.
11. The system as recited in claim 9 , wherein the virtual storage device is a virtual object device.
12. The system as recited in claim 9 , wherein the user-mode network connection and the kernel-mode network connection are established over a first network, wherein the one or more physical storage devices are linked to the virtual device client by a second network, wherein the virtual device client is configured to perform I/O operations on the one or more physical storage devices via the second network.
13. The system as recited in claim 12 , wherein the first network is an Internet Protocol (IP) network and the second network is a fibre-channel network.
14. A method comprising:
a first host initiating a process configured to secure kernel-to-kernel communication between the first host and the second host, wherein said process comprises the first host:
establishing a user-mode network connection between a first user-mode software layer of a distributed software service at the first host and a second user-mode software layer of the distributed software service at a second host, the user-mode network connection being configured to use a secure communication protocol;
transmitting a first security key from the first user-mode software layer of the distributed software service at the first host to the second user-mode software layer of the distributed software service at the second host over the user-mode network connection;
receiving a second security key transmitted from the second user-mode software layer to the first user-mode software layer over the user-mode network connection; and
subsequent to receiving the second security key, initiating establishment of a kernel-mode network connection between a first kernel-mode software layer of the first host and a second kernel-mode software layer of the second host, wherein the kernel-mode connection is a different connection than the user-mode connection and uses a protocol that does not support said secure communication protocol; and
using the first and second security keys to secure communication over the kernel-mode network connection between the first kernel-mode software layer at the first host and the second kernel-mode software layer at the second host.
15. The method as recited in claim 14 , wherein said kernel-mode network connection is established using one of a kernel sockets interface, Transport Level Interface, or X/Open Transport Interface.
16. The method as recited in claim 14 , wherein the first and second security keys are public keys, further comprising:
uploading the second security key and a first private key from the first user-mode software layer to the first kernel-mode software layer at the first host; and
using the second security key to encrypt a first message sent to the second host over the kernel-mode network connection; and
using the first private key to decrypt a second message received at the first host over the kernel-mode network connection.
17. The method as recited in claim 14 , further comprising:
sending a first encoded authentication token from the first host to the second host over the kernel-mode network connection; and
validating the first encoded authentication token at the second host using the second security key.
18. The method as recited in claim 14 , further comprising:
encrypting a message before sending the message over the kernel-mode network connection.
19. A computer accessible medium comprising program instructions, wherein the program instructions are computer-executable to:
initiate a process configured to secure kernel-to-kernel communication between a first host and a second host, wherein said program instructions are executable to cause the first host to:
establish a user-mode network connection between a first user-mode software layer of a distributed software service at the first host and a second user-mode software layer of the distributed software service at a second host, the user-mode network connection being configured to use a secure communication protocol;
transmit a first security key from the first user-mode software layer of the distributed software service at the first host to the second user-mode software layer of the distributed software service at the second host over the user-mode network connection;
receive a second security key transmitted from the second user-mode software layer to the first user-mode software layer over the user-mode network connection; and
subsequent to receiving the second security key, cause the first host to initiate establishment of a kernel-mode network connection between a first kernel-mode software layer of the first host and a second kernel-mode software layer of the second host, wherein the kernel-mode connection is a different connection than the user-mode connection and uses a protocol that does not support said secure communication protocol;
use the first and second security keys to secure communication over the kernel-mode network connection between the first kernel-mode software layer at the first host and the second kernel-mode software layer at the second host.
20. The computer accessible medium as recited in claim 19 , wherein said kernel-mode network connection is established using one of a kernel sockets interface, Transport Level Interface, or X/Open Transport Interface.
21. The computer accessible medium as recited in claim 19 , wherein the first and second security keys are public keys, wherein the program instructions are further computer-executable to:
upload the second security key and a first private key from the first user-mode software layer to the first kernel-mode software layer at the first host; and
use the second security key to encrypt a first message sent to the first host over the kernel-mode network connection; and
use the first private key to decrypt a second message received at the first host over the kernel-mode network connection.
22. The computer accessible medium as recited in claim 19 , wherein the program instructions are further computer-executable to:
send a first encoded authentication token from the first host to the second host over the kernel-mode network connection; and
validate the first encoded authentication token at the second host using the second security key.
23. The computer accessible medium as recited in claim 19 , wherein the program instructions are further computer-executable to:
encrypt a message before sending the message over the kernel-mode network connection.