Active-active environment control
The present disclosure provides a method, system, and device for security object synchronization at multiple nodes of an active-active environment. To illustrate, a source node may generate a corresponding security object sync request for each of multiple target nodes. The source node may send the security object sync request to the target nodes via a source queue and, for each target node, a corresponding distribution queue. A distribution queue may be closed based on an acknowledgement received from a corresponding target node, after a time period, or after a number of transmission attempts. A synchronization log may be maintained to indicate which security object sync requests have been delivered to which target nodes. In some implementations, the source node and the target nodes are part of an active-active environment that may be synchronized in time so the nodes resolve conflicts between received security object updates initiated from two different nodes.
1. A method for security object synchronization in an active-active environment, the method comprising:
initializing, at a source node, a distribution structure comprising a source queue and one or more distribution queues, the one or more distribution queues including, for each of one or more target nodes identified to receive a security object sync request from the source node to synchronize an instance of an application, a corresponding distribution queue;
for each of the one or more target nodes, transmitting, via the source queue and the corresponding distribution queue, a corresponding security object sync request;
receiving, at the source node, at least one acknowledgement of receipt of security object sync request from at least one target node of the one or more target nodes; and
updating, at the source node, a synchronization log to record the at least one acknowledgment.
2. The method of claim 1 , further comprising:
receiving, at the source node, a user instruction that contains an identification of the one or more target nodes.
3. The method of claim 1 , where receiving the at least one acknowledgement comprises receiving a first acknowledgement from a first target node of the one or more target nodes, and where updating the synchronization log comprises updating the synchronization log to record acknowledgement of receipt of a first security object sync request from the first target node.
4. The method of claim 3 , where receiving the at least one acknowledgement comprises receiving a second acknowledgement from a second target node of the one or more target nodes, and where updating the synchronization log comprises updating the synchronization log to record acknowledgement of receipt of a second security object sync request from the second target node.
5. The method of claim 1 , where the security object sync request comprises an add group request, a delete group request, a modify group request, an add user request, a delete user request, a modify user request, an add key request, a remove key request, an add permissions request, a remove permissions request, a modify permissions request, or any combination thereof.
6. The method of claim 1 , further comprising:
identifying, at the source node, a most recent synchronization update of a first target node of the one or more target nodes;
determining, at the source node, if at least one synchronization update was requested between the most recent synchronization update and receipt of an instruction to synchronize the instance of the application; and
generating, at the source node, a first sync request for the first target node.
7. The method of claim 6 , where the first sync request includes update data corresponding to the instruction and to the at least one synchronization update.
8. The method of claim 6 , where identifying the most recent synchronization update of the first target node comprises:
determining, at the source node, a first time value corresponding to the most recent synchronization update;
determining, at the source node, a second time value corresponding to receipt of the instruction; and
comparing the first time value and the second time value, where the source node and each of the one or more target nodes are synchronized in time.
9. The method of claim 6 , further comprising:
prior to sending the first sync request for the first target node, encoding the first sync request with a certificate of the source node, where the certificate of the source node comprises a token or a private key of the source node.
10. The method of claim 1 , further comprising:
receiving an acknowledgement from a first target node of the one or more target nodes via a first distribution queue of the one or more distribution queues responsive to transmitting a first security object sync request;
closing the first distribution queue based on receipt of the acknowledgement; and
closing the source queue based on a determination that no distribution queue of the one or more distribution queues remains active.
11. The method of claim 1 , where a sync request that corresponds to a first target node of the one or more target nodes causes the first target node to initiate a target queue.
12. A system for security object synchronization in an active-active environment, the system, the system comprising:
at least one memory storing instructions; and
one or more processors of a source node, the one or more processors coupled to the at least one memory and configured to execute the instructions to cause the one or more processors to:
initialize a distribution structure comprising a source queue and one or more distribution queues, the one or more distribution queues including, for each of one or more target nodes identified to receive a security object sync request from the source node to synchronize an instance of an application, a corresponding distribution queue;
for each of the one or more target nodes, transmit, via the source queue and the corresponding distribution queue, a corresponding security object sync request;
receive at least one acknowledgement of receipt of security object sync request from at least one target node of the one or more target nodes; and
update a synchronization log to record the at least one acknowledgment.
13. The system of claim 12 , where the one or more processors are further configured, responsive to a determination that an acknowledgement of receipt of a first security object sync request has not been received from a first target node of the one or more target nodes, to:
determine an amount of time that has elapsed since the first security object sync request was sent;
compare the amount of time to a threshold; and
in response to the amount of time being greater than or equal to the threshold, resend the first security object sync request to the first target node.
14. The system of claim 12 , where the one or more processors are further configured, responsive to a determination that an acknowledgement of receipt of a first security object sync request has not been received from a first target node of the one or more target nodes, to:
receive an additional request to synchronize the first target node after sending the first security object sync request to the first target node;
update the first security object sync request based on the additional request to generate an updated first security object sync request; and
send the updated first security object sync request to the first target node.
15. The system of claim 12 , where the one or more processors are further configured, responsive to a determination that an acknowledgement of receipt of a first security object sync request has not been received from a first target node of the one or more target nodes, to:
determine a number of times that the first security object sync request has been sent without acknowledgement; and
in response to the number of times being greater than or equal to a threshold, determine that the first target node is inactive.
16. The system of claim 12 , where:
the active-active environment comprises multiple geographic regions;
the source node is included in a first geographic region of the multiple geographic regions; and
a first target node of the one or more target nodes is included in a second geographic region that is distinct from the first geographic region.
17. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for security object synchronization in an active-active environment, the operations comprising:
initializing, at a source node, a distribution structure comprising a source queue and one or more distribution queues, the one or more distribution queues including, for each of one or more target nodes identified to receive a security object sync request from the source node to synchronize an instance of an application, a corresponding distribution queue;
for each of the one or more target nodes, transmitting, via the source queue and the corresponding distribution queue, a corresponding security object sync request;
receiving, at the source node, at least one acknowledgement of receipt of security object sync request from at least one target node of the one or more target nodes; and
updating, at the source node, a synchronization log to record the at least one acknowledgment.
18. The non-transitory computer-readable storage medium of claim 17 , where the distribution structure comprises a logical hierarchy of virtual queues.
19. The non-transitory computer-readable storage medium of claim 17 , where the operations further comprise:
maintaining a list of the one or more target nodes, each of the one or more target nodes corresponding to a unique identifier; and
adding a target node to the list.
20. The non-transitory computer-readable storage medium of claim 19 , where the operations further comprise:
creating and storing one or more application program interfaces (APIs), the one or more APIs corresponding to a path to the target node, an operation to remove the target node from the list, an operation to perform a synchronization operation with the target node, or a combination thereof.