Granted Patent B2

US 11,657,164 · App. 17/031,282 · Granted May 23, 2023

Inventors: Pengfei Wu (Shanghai, CN); Stephen J. Todd (Center Conway, NH); Kun Wang (Beijing, CN)

Assignee: EMC IP Holding Company LLC

G06F21/602H04L9/0637H04L63/0823H04L63/0876H04L63/20

Abstract

Claims (49)

1. A method comprising:

sending a request from a given node in a decentralized system of nodes to a blockchain network, wherein the request is associated with a given policy file that defines a policy that applies to at least a subset of nodes in the decentralized system of nodes;

receiving policy file retrieval metadata at the given node from the blockchain network in response to the request, wherein the policy file retrieval metadata comprises address information associated with storage of the given policy file in a decentralized storage network, the address information comprises a content-based address generated for the given policy file, and the content-based address comprises a computed hash value of the given policy file;

sending the address information from the given node to the decentralized storage network; receiving the given policy file at the given node from the decentralized storage network; and

verifying an integrity of the given policy file by comparing the content-based address to a hash digest of the given policy file to determine whether the hash digest is the same as the content-based address;

wherein the policy file retrieval metadata comprises a key-value pair and the key of the key-value pair comprises a policy type associated with the given policy file;

wherein the request sent from the given node to the blockchain network comprises a command specifying the policy type associated with the given policy file; and

wherein the given node is implemented via at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 , wherein the value of the key-value pair comprises the content-based address generated for the given policy file.

3. The method of claim 1 , wherein the given policy file defines one or more data protection and management rules associated with data stored by one or more nodes of the decentralized system of nodes.

4. The method of claim 1 , further comprising the given node:

obtaining at least one authenticating credential from an identity management system; and

providing the authenticating credential with the request sent to the blockchain network and the address information sent to the decentralized storage network.

5. The method of claim 4 wherein the at least one authenticating credential comprises a certificate digitally signed by the identity management system.

6. An apparatus comprising at least one processing device, wherein the at least one processing device comprises a processor coupled to a memory configured to enable the given node to perform the steps of claim 1 .

7. The method of claim 1 wherein the given node is a cloud node in a multi-cloud computing environment.

8. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the given node to perform the steps of:

sending a request from a given node in a decentralized system of nodes to a blockchain network, wherein the request is associated with a given policy file that defines a policy that applies to at least a subset of nodes in the decentralized system of nodes;

receiving policy file retrieval metadata at the given node from the blockchain network in response to the request, wherein the policy file retrieval metadata comprises address information associated with storage of the given policy file in a decentralized storage network, the address information comprises a content-based address generated for the given policy file, and the content-based address comprises a computed hash value of the given policy file;

sending the address information from the given node to the decentralized storage network;

receiving the given policy file at the given node from the decentralized storage network; and

verifying an integrity of the given policy file by comparing the content-based address to a hash digest of the given policy file to determine whether the hash digest is the same as the content-based address;

wherein the policy file retrieval metadata comprises a key-value pair and the key of the key-value pair comprises a policy type associated with the given policy file;

wherein the request sent from the given node to the blockchain network comprises a command specifying the policy type associated with the given policy file; and

wherein the given node is implemented via at least one processing device comprising a processor coupled to a memory.

9. The article of manufacture of claim 8 , wherein the value of the key-value pair comprises the content-based address generated for the given policy file.

10. The article of manufacture of claim 8 , wherein the given policy file defines one or more data protection and management rules associated with data stored by one or more nodes of the decentralized system of nodes.

11. The article of manufacture of claim 8 , further comprising the given node:

obtaining at least one authenticating credential from an identity management system; and

providing the authenticating credential with the request sent to the blockchain network and the address information sent to the decentralized storage network.

12. The article of manufacture of claim 11 wherein the at least one authenticating credential comprises a certificate digitally signed by the identity management system.

13. The article of manufacture of claim 8 wherein the given node is a cloud node in a multi-cloud computing environment.

14. A decentralized system comprising:

a plurality of nodes, wherein at least a portion of the nodes are cloud nodes in a multi-cloud computing environment;

a decentralized storage network accessible by at least a subset of nodes of the decentralized system of nodes and configured to store one or more policy files that define one or more policies associated with data protection and management of data processed by the plurality of nodes;

a blockchain network accessible by at least a subset of nodes of the decentralized system of nodes and configured to store policy file retrieval metadata for obtaining the one or more policy files from the decentralized storage network, wherein the policy file retrieval metadata for the one or more policy files comprises address information associated with storage of respective policy files of the one or more policy files in the decentralized storage network, and wherein the

address information comprises a content-based address generated for each of the respective policy files, and the content-based address comprises a computed hash value of each the respective policy files; and

an identity management system for providing authenticating credentials to nodes communicating with the blockchain network and the decentralized storage network;

wherein at least the subset of nodes is configured to verify an integrity of the respective policy files by comparing the content-based address for each of the respective policy files to a hash digest of each of the respective policy files to determine whether the hash digest is the same as the content-based address;

wherein the policy file retrieval metadata for the one or more policy files comprises one or more key-value pairs and the key of a key-value pair comprises a policy type associated with a respective policy file;

wherein the blockchain network receives requests from at least the subset of nodes, and the requests are associated with the one or more policy files;

wherein at least one of the requests comprises a command specifying the policy type associated with the respective policy file; and

wherein the decentralized system is implemented by a set of processing devices, each comprising a processor and a memory.

15. The decentralized system of claim 14 , wherein the value of the key-value pair comprises a content-based address generated for the respective policy file.

16. The decentralized system of claim 14 , wherein the authenticating credentials each comprise a certificate digitally signed by the identity management system.

17. The decentralized system of claim 14 wherein the multi-cloud computing environment comprises at least one private cloud.

18. The decentralized system of claim 14 wherein the multi-cloud computing environment comprises at least one public cloud.

19. The decentralized system of claim 14 wherein the multi-cloud computing environment comprises one of virtual machines and containers implemented using a virtualization infrastructure.

20. The decentralized system of claim 19 wherein the virtualization infrastructure comprises one or more hypervisors.

Assignments (9)