Performance standby nodes for a secure storage system
Special performance standby nodes for data storage in a cloud computing security system are disclosed. Performance standby nodes are standby nodes that are configured to service requests that do not modify the underlying data store. These pseudo read-replica nodes are further configured to forward any request that results in a storage write onto an active node, while being able to service read-only requests locally.
1. A security system for a cloud computing platform, the security system comprising:
a plurality of security service nodes, each of the plurality of security service nodes having at least one data processor that is configured to provide security services on information, the security services comprising secrets protection and data management including user credentialing and authentication and information access control, and further comprising information encryption and encrypted storage in a shared data store, one of the plurality of security service nodes being designated and configured in a startup phase of the security system as an active node to execute the security services, and one or more other of the plurality of security service nodes being designated and configured as standby nodes; and
one or more performance standby nodes designated from the standby nodes, the performance standby nodes being configured to execute the security services only in response to read-only requests that do not modify the information, the read-only requests comprising cryptographic key/value requests, each designated one or more performance standby nodes being further configured to forward to the active node any requests that modify the information, each of the one or more performance standby nodes having an embedded cache storing one or more cache objects related to the security services provided by the one or more performance standby nodes, at least some of the one or more cache objects being invalidated by a write-ahead log (WAL) stream received by the one or more performance standby nodes from the active node.
2. The system in accordance with claim 1 , wherein the WAL stream is started based on a Merkle root read from the active node and unsealed in each of the one or more performance standby nodes, the Merkle root connecting the active node with each of the one or more performance standby nodes.
3. The system in accordance with claim 1 , wherein the security services include indexing the secrets and/or and data by the active node using a Merkle tree.
4. The system in accordance with claim 1 , wherein the plurality each of the one or more cache objects includes one or more of encryption keys, transport layer security certificates, security tokens and leases.
5. A method of executing security services by a security system of a cloud computing platform, the method comprising:
designating, in a startup phase of the security system, an active node from a plurality of security service nodes of the security system, each of the plurality of security service nodes having at least one data processor that is configured to provide the security services on information in response to requests the designated active node configured to execute the security services, the security services comprising secrets protection and data management including user credentialing and authentication and information access control, and further comprising information encryption and encrypted storage in a shared data store;
designating all other nodes of the plurality of security service nodes as standby nodes;
designating, from the standby nodes, one or more performance standby nodes to execute the security services only in response to read-only requests that do not modify the information, the read-only requests comprising cryptographic key/value requests, and to forward to the active node any requests that modify the information, each of the one or more performance standby nodes having an embedded cache of the cache layer storing a plurality of cache objects related to the security services provided by the plurality of security service nodes; and
invalidating at least some of the cache objects in the embedded cache by a write-ahead log (WAL) stream from the active node executing the security service.
6. The method in accordance with claim 5 , wherein the WAL stream is started based on a Merkle root fetched from the active node and unsealed in each of the one or more performance standby nodes, the unsealed Merkle root connecting the active node with each of the one or more performance standby nodes.
7. The method in accordance with claim 5 , wherein the security services include indexing the secrets and/or data by the active node using a Merkle tree.
8. The method in accordance with claim 5 , wherein the plurality of cache objects includes one or more of encryption keys, transport layer security certificates, security tokens and leases.