Decentralized access management in information processing system utilizing persistent memory
In an information processing system comprising a set of computing devices wherein each computing device comprises a set of persistent memory modules resident in the computing device, and wherein one or more data structures associate one or more application programs executing on the set of computing devices with one or more memory regions of the set of persistent memory modules such that the one or more data structures are utilized to route data between a given one of the application programs and at least one memory region, maintaining a distributed ledger system with a plurality of nodes, wherein the set of computing devices is operatively coupled to the plurality of nodes of the distributed ledger system, and managing one or more data access requests by a given application program to a memory region of a persistent memory module in consultation with the distributed ledger system.
1. A method comprising:
in an information processing system comprising a set of computing devices wherein each computing device comprises a set of persistent memory modules resident in the computing device, and wherein one or more data structures associate one or more application programs executing on the set of computing devices with one or more memory regions of the set of persistent memory modules such that the one or more data structures are utilized to route data between a given one of the application programs and at least one memory region;
maintaining a distributed ledger system with a plurality of nodes, wherein the set of computing devices is operatively coupled to the plurality of nodes of the distributed ledger system; and
managing one or more data access requests by a given application program to a memory region of a persistent memory module in consultation with the distributed ledger system by storing transaction data in the distributed ledger system that represents at least one of routing information, identity information, and binding information associated with the one or more application programs and the set of persistent memory modules;
wherein the association generated by the one or more data structures forms a per tenant binding between a given one of the application programs and at least one memory region; and
wherein the method is implemented via one or more processing devices each comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the data access managing step further comprises verifying the identity of the given application program making the one or more data access requests based on the transaction data stored in the distributed ledger system.
3. The method of claim 2 , wherein the data access managing step further comprises rejecting the one or more data access requests when the identity of the given application program making the one or more data access requests is not verified.
4. The method of claim 1 , wherein the set of computing devices are associated with one or more data centers, and further comprising:
assigning a unique cryptographic private key to each of the one or more data centers to enable the one or more data centers to sign and publish their configurations on the distributed ledger system using their assigned cryptographic private key.
5. The method of claim 4 , wherein each of the one or more data centers creates transaction data stored in the distributed ledger system specifying routing information for their configuration.
6. The method of claim 5 , wherein the configuration is represented by a mapping of a given application program to the one or more memory regions of the set of persistent memory modules associated with computing devices of the given data center.
7. The method of claim 6 , wherein the mapping is stored as transaction data in the distributed ledger system.
8. The method of claim 4 , wherein each of the one or more data centers creates transaction data stored in the distributed ledger system specifying security information.
9. The method of claim 1 , further comprising assigning a unique cryptographic private key to each of the one or more application programs to enable the one or more application programs to sign and publish identity information on the distributed ledger system as transaction data using their assigned cryptographic private key.
10. The method of claim 9 , wherein the unique cryptographic private key assigned to each of the one or more application programs is also used to sign and publish binding information on the distributed ledger system as transaction data.
11. The method of claim 10 , wherein the binding information specifies a binding between a given one of the application programs and one or more memory regions of a given one of the persistent memory modules.
12. The method of claim 9 , wherein a unique cryptographic public key, associated with the assigned cryptographic private key as part of a key pair, is assigned to each of the one or more application programs.
13. The method of claim 12 , further comprising providing the cryptographic public key for a given one of the application programs to a given one of the set of computing devices to which the given application program is deployed via a container assignment request.
14. The method of claim 1 , further comprising one of the application programs extending data access permission to another one of the application programs by creating transaction data that specifies the extended permission and storing the transaction data in the distributed ledger system.
15. The method of claim 14 , further comprising a given one of the computing devices validating the other application program by consulting the transaction data stored on the distributed ledger system to verify the extended permission.
16. The method of claim 1 , wherein the one or more data structures further comprise an identifier field for specifying the given one of the application programs and the given tenant.
17. A system comprising:
one or more processing devices operatively coupled to one or more memories having program logic, which when executed by the one or more processing devices, are configured to:
in an information processing system comprising a set of computing devices wherein each computing device comprises a set of persistent memory modules resident in the computing device, and wherein one or more data structures associate one or more application programs executing on the set of computing devices with one or more memory regions of the set of persistent memory modules such that the one or more data structures are utilized to route data between a given one of the application programs and at least one memory region;
maintain a distributed ledger system with a plurality of nodes, wherein the set of computing devices is operatively coupled to the plurality of nodes of the distributed ledger system; and
manage one or more data access requests by a given application program to a memory region of a persistent memory module in consultation with the distributed ledger system by storing transaction data in the distributed ledger system that represents at least one of routing information, identity information, and binding information associated with the one or more application programs and the set of persistent memory modules;
wherein the association generated by the one or more data structures forms a per tenant binding between a given one of the application programs and at least one memory region.
18. The system of claim 17 , wherein the program logic, which when executed by the one or more processing devices, is configured to perform at least one of the following:
a) assigning a unique cryptographic private key to each of the one or more application programs to enable the one or more application programs to sign and publish identity information on the distributed ledger system as transaction data using their assigned cryptographic private key;
wherein the unique cryptographic private key assigned to each of the one or more application programs is also used to sign and publish binding information on the distributed ledger system as transaction data; and
wherein the binding information specifies a binding between a given one of the application programs and one or more memory regions of a given one of the persistent memory modules; and
b) extending by one of the application programs data access permission to another one of the application programs by creating transaction data that specifies the extended permission and storing the transaction data in the distributed ledger system.
19. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processor causes said at least one processor to:
in an information processing system comprising a set of computing devices wherein each computing device comprises a set of persistent memory modules resident in the computing device, and wherein one or more data structures associate one or more application programs executing on the set of computing devices with one or more memory regions of the set of persistent memory modules such that the one or more data structures are utilized to route data between a given one of the application programs and at least one memory region;
maintain a distributed ledger system with a plurality of nodes, wherein the set of computing devices is operatively coupled to the plurality of nodes of the distributed ledger system; and
manage one or more data access requests by a given application program to a memory region of a persistent memory module in consultation with the distributed ledger system by storing transaction data in the distributed ledger system that represents at least one of routing information, identity information, and binding information associated with the one or more application programs and the set of persistent memory modules;
wherein the association generated by the one or more data structures forms a per tenant binding between a given one of the application programs and at least one memory region.
20. The article of manufacture of claim 19 , wherein the program code when executed by at least one processor causes said at least one processor to perform at least one of the following:
a) assign a unique cryptographic private key to each of the one or more application programs to enable the one or more application programs to sign and publish identity information on the distributed ledger system as transaction data using their assigned cryptographic private key;
wherein the unique cryptographic private key assigned to each of the one or more application programs is also used to sign and publish binding information on the distributed ledger system as transaction data; and
wherein the binding information specifies a binding between a given one of the application programs and one or more memory regions of a given one of the persistent memory modules; and
b) extend by one of the application programs data access permission to another one of the application programs by creating transaction data that specifies the extended permission and storing the transaction data in the distributed ledger system.