Patent ID: 12238170

Like reference symbols in the various drawings indicate like elements.

DETAILED DESCRIPTION

A private cloud is an isolated environment that includes cloud computing services and infrastructure that is hosted locally. In other words, a private cloud is self-contained and not accessible by devices outside of the private cloud (e.g., via the Internet), although some devices from the private cloud can be adapted to communicate to devices outside of the private cloud environment. Private clouds are especially useful for organizations that handle sensitive information, such as health care providers and military units. The private cloud may include a number of hardware devices that are communicatively coupled within the private cloud environment. Example hardware devices that can be deployed in a private cloud include data centers, which act as central data repositories and computational centers, and edge devices (also referred to interchangeably herein as “appliances”), which are typically smaller devices that can be connected/disconnected to the private cloud environment as necessary. For example, in a private cloud deployed within a military environment, an edge device can include drones and/or computing devices deployed on vehicles such as tanks.

Transferring data between devices in a private cloud environment is different from transferring data in a normal cloud environment. Normally, an Internet-based cloud implements a control plane to transfer data between devices. However, as a private cloud does not typically access the Internet, such a control plane is not available in the private cloud environment. Instead, private clouds typically execute data transfers between devices by cloning and/or executing a binary file transfer. However, this method of transferring data between devices can be slow and also can possibly expose local device storage between devices during transfer.

Implementations herein are directed to on demand serverless (i.e., in a private cloud) container-based storage transfer. In other words, the current disclosure provides for the use of containers to transfer data between various devices in a private cloud environment. Unlike previous methods of data transfer, the container-based approach maintains device security through the duration of the data transfer as the container does not directly access local storage of any device. Instead, the container is instantiated at a first device to receive data from the first device and then a second device retrieves the data from the container. The transfer of data using containers can be completed without exposing the local storage of either the first device or the second device throughout the data transfer process. Further, the container based data transfer process of the current disclosure is portable, reproducible, and scalable, allowing it to run on multiple devices and/or operating systems simultaneously.

Referring toFIG.1, in some implementations, an on demand serverless container based storage transfer system100includes a private cloud140that is communicatively coupled to an edge device110and a data center120through a private network130(e.g., a local area network (LAN) and/or a wide area network (WAN)). The private cloud140, including the connected devices110,120, may be isolated from devices outside of the private cloud140(i.e., the private cloud140is not connected to the Internet or any other network connections). Thus, the network130may be a secure private network that connects the various devices110,120through wired and/or wireless connections. The private cloud140may be a distributed system having scalable/elastic resources142. The resources142include computing resources144(e.g., data processing hardware) and/or storage resources146(e.g., memory hardware such as volatile and/or non-volatile addressable semiconductor memory). The edge device110and data center120may access and use the resources142. In some implementations, the private cloud140executes a transfer module145that manages transfer of data50between various devices in the private cloud (i.e., the edge device110and the data center120).

In some implementations, the private cloud140is an isolated environment that includes cloud computing services and infrastructure that is hosted locally. The private cloud140may be deployed by an organization that requires strict security of data50, such as a military unit or hospital. The edge device110and the data center120can be any device suitable for the organization in which the private cloud140is deployed. In particular, the edge device110can refer to any device that is portable and/or can be connected/disconnected from the private cloud140. For example, the edge device110can be any of a tablet, a smart phone, a smart watch, a drone, an on-board computer of a vehicle, or any other suitable portable computing device. Further, the data center120may be a stationary device that contains larger processing and storage capabilities, such as a single computer or a cluster of computers. The private cloud140can host any number of edge devices110and/or data centers120, although only one of each is included inFIG.1for simplicity.

The private cloud140is configured for on demand serverless container based transfer of data50between devices110,120of the private cloud140. Generally, the private cloud140, via the transfer module145, is responsible for securely transferring data50between devices110,120. In particular, the transfer module145implements a container150during data transfer such that the transfer module145does not access local storage of any of the devices110,120during the data50transfer processes. The container150is a package of software that includes all of the necessary elements to run in any environment (i.e., a private cloud140) by virtualizing an operating system. In other words, the container150functions as a compute unit which may be instantiated at either one of the devices110,120, and/or the private cloud140. The container150allows for easily sharing CPU, memory, storage, and network resources at the operating systems level and offers a logical packaging mechanism in which applications can be abstracted from the environment (i.e., the devices110,120) in which they actually run. By using a container150based process to transfer data50, the transfer module145can initiate multiple transfers within the private cloud140simultaneously (i.e., instantiate containers150at various devices110,120). Further, the transfer module145is portable and scalable as the transfer module145can easily adjust containers150for the various devices110,120of the private cloud140without requiring manual intervention (i.e., code rewrites) or processing power.

In an example container-based transfer of data50, the transfer module145may receive a request30indicating that data50is to be transferred from the edge device110to the data center120. The transfer module145may only accept the request30when it is provided by a user authorized to access the private cloud140. For example, the transfer module145may include role based access controls (RBAC) to determine if the request30is from an authorized user. Further, the request30may be received at the transferring device (e.g., the edge device110in this example) or the receiving device (e.g., the data store120in this example). In some implementations, the transfer module145defines limitations such as a maximum memory, CPU, and/or network limit for the transfer of data50. Accordingly, the request30must comply with the limitations defined by the transfer module145, otherwise the transfer module145rejects the request30.

In some implementations, each device110,120of the private cloud140may correspond to a CA certificate such that the transfer module145establishes a secure connection with each device110,120when communicating with the respective device110,120. In this example, the transfer module145may establish a secure connection with the edge device110, based on the corresponding CA certificate, and then transmits the request30to the edge device110such that the edge device110can select the appropriate data50to upload to the container150. If the edge device110is connected to the private cloud140(i.e., connected to network130), the transfer module145instantiates the container150at the edge device110. If the edge device110is not connected to the private cloud140(i.e., disconnected from the network130), the transfer module145periodically (e.g., at regular or irregular intervals, such as once a minute, once an hour, once a day, etc.) rechecks to see if the edge device110is connected. The transfer module145may create a file (e.g., a YAML file) with specific details about the source and the destination (i.e., source type, destination type, source path, destination path, source and destination access credentials, source and destination custom CA certificates) Once the transfer module145instantiates the container150at the edge device110, the edge device110uploads the data50to the container150. In some implementations, the transfer module145schedules the transfer of data50based on demands of the system100. For example, if the devices110,120are in use or in a low power mode, the transfer module145may initiate (and/or schedule) the transfer of data50at a later time. The transfer module145may then deploy the container150at the data center120for the data center120to retrieve the data50from the container150. In some implementations, the transfer module145first checks to ensure the data center120is connected to the private cloud140(i.e., connected to the network130) before deploying the container150at the data center120.

The transfer module145may also monitor the transfer of data50from the edge device110to the data center120. For example, if the container150crashes (i.e., suffers from a software or hardware failure), the transfer module145may instantiate a new container150. In some implementations, the transfer module145includes a limit of retry attempts (i.e., a maximum number of container150crashes). In some implementations, the transfer module145monitors a progress of the transfer of data from the source device (i.e., the edge device110) to the container150. In some of these implementations, if the source device disconnects from the network130midway through the transfer of data50, the transfer module145restarts the upload once the source device is reconnected to the network130from the failure point without having to restart the entire upload of data50. The transfer module145may track the progress of the transfer of data50by running a describe on the job or by analyzing pod logs.

While the example shown depicts the edge device110providing the data50and the data center120receiving the data50, in practice either entity can provide the data50and/or receive data50via the transfer module145. Further, the example system100ofFIG.1is not intended to be limiting and may include multiple edge devices110and data centers120. Thus, any number of additional devices110,120hosted by the private cloud140can transfer and/or receive data50via the transfer module145. In turn, the private cloud140, via the transfer module145, allows data50transfer between devices110,120of the private cloud140, without exposing the devices110,120to external entities. Further, because the transfer module145implements containers150during the transfer of data50, the transfer module145does not need to access local storage of any of the devices110,120during the transfer of data50. All communications between the transfer module145, the container150, and the various devices110,120may be secured using CA certificates as an added extra layer of security.

FIG.2is a schematic view200of example devices110connected to an example private cloud140. As described above, a private cloud140may host a number of devices, including any number of edge devices110. In an example of a private cloud environment of a military unit, the edge devices may include drones110,110A and military vehicles110,110B. These edge devices110may be configured to connect and disconnect from the private cloud140as necessary. For example, the drone110A may be deployed to take pictures of a remote area. When the drone110A is in the field it may be disconnected from the private cloud140. Further, at times the drone110A may be connected to the Internet220. For example, if the drone110A captures images that need to be shared urgently while not connected to the private cloud140, the drone can initiate a data transfer via the Internet220(e.g., via a broadband cellular network or the like). The drone110A may transfer data50using containers150via the transfer module145(FIG.1). Further, a vehicle110B, or any other suitable edge device110(e.g., a smart phone, a tablet, a laptop, a smart watch, on-board computer) may similarly be configured to repeatedly connect and disconnect from the private cloud140and/or the Internet220as necessary for operation.

In some implementations, each edge device110may include a CA certificate210issued by a certificate authority (CA). A CA certificate210is a digital certificate that certifies ownership of a public key by the named subject of the certificate, allowing other parties to trust (and/or be trusted by) the corresponding device (i.e., edge device110). For example, the drone110A corresponds to a first CA certificate210,210A and the vehicle110B corresponds to a second CA certificate210,210B. Here, the certificates210A,210B, and any other respective certificate210corresponding to the other devices110of the private cloud140, are different.

In conventional private cloud implementations, each device110of the private cloud generally uses the same CA certificate210. As these implementations transfer data between devices110through cloning and/or binary data transfer, the single CA certificate210may be sufficient. In the current disclosure, having each device correspond to a unique CA certificate210allows for data50transfer through containers150. Here, each time the transfer module145communicates to an edge device110(or data center120), the transfer module145is able to establish a secure connection (to instantiate and/or deploy a container150) using the unique CA certificate210of the corresponding device110. In other words, the container150uses the unique CA certificates210to read and transfer data50to the devices110and120.

FIG.3is a schematic view of a sequence diagram300for on demand serverless container based storage transfer. At step302, a user305requests a data transfer. For example, the user305sends a request30(FIG.1) indicating that data50from a first device110is to be transferred to a second device120. The request30may indicate that data50is to be transferred from any device of the private cloud140(i.e., an edge device110or data center120) to any other device or devices110,120of the private cloud140. In the example sequence diagram300, the request is for data50to be transferred from the edge device110to the data center120. In some implementations, the transfer module145accepts or rejects the request based on a number of features. For example, the transfer module145determines that the user305associated with the request30has permissions for the request30. In some implementations, the request30must satisfy certain conditions, such as a maximum memory, a maximum CPU usage, a maximum network limit, etc. The conditions may be set to a default/predetermined value or user defined.

At step304, the transfer module145determines if the edge device110is connected to the private cloud140. In some implementations, when the data50is to be transferred from the edge device110to a device outside of the private cloud140(e.g., to an external device through the Internet), the transfer module145may determine if the edge device is connected to the external device/network. If the edge device110is not connected to the private cloud140(or external network), the transfer module145may periodically recheck to see if the edge device110has reconnected.

At step306, the transfer module145instantiates a container150at the edge device110. In some implementations, the transfer module145schedules (i.e., for a point in time in the future) the transfer of data based on network resources, the size of the request, the status of the source device and/or the destination device, or any other appropriate basis. Accordingly, in these implementations, the transfer module145does not instantiate the container150at the edge device110until the scheduled time. At step308, the edge device110transfers the requested data to the container150. Here, the container150does not have access to local storage of the edge device110. Instead, the edge device110is configured to upload the appropriate data50to the container150. In some implementations, the transfer module145monitors the transfer of data50. In case the container150crashes, or any other failure, the transfer module145is configured to allow automatic failure recovery, such as by instantiating a new container150. The transfer module145may include a maximum number of attempts to complete the transfer of data50before rejecting the request30. Further, the transfer module may monitor the progress of the data50upload, such as by running a describe on the upload or by tracking pod logs. If the edge device110disconnects from the private cloud140during the upload, the transfer module145can resume the upload once the edge device110reconnects to the private cloud140without having to restart the transfer of data50completely.

At step310, the transfer module145, via the container150, transfers the data50to the data center120. For example, the container150may establish a connection at the data center120using a CA certificate210unique to the data center120and then transfer the data accordingly. At step312, the data center120retrieves the data50from the container150.

FIG.4is a flowchart of an exemplary arrangement of operations for a method400of on demand serverless container based storage transfer. The method400can be performed by various interconnected computing devices such as the components of the system100ofFIG.1and/or the computing device500ofFIG.5. At operation402, the method400includes receiving a request30to transfer data50from a first device110to a second device120, the first device110hosted at a private cloud140, the private cloud140isolated from the Internet. At operation404, the method400includes determining that the first device110is communicatively connected to the private cloud140. In response to operation404, at operation406the method400includes instantiating a container150at the first device110, the container150configured to receive the data50from the first device110without directly accessing a local storage of the first device110. At operation408, the method400includes transferring, using the container150, the data50from the first device110to the second device120.

FIG.5is a schematic view of an example computing device500that may be used to implement the systems and methods described in this document. The computing device500is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The components shown here, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed in this document.

The computing device500includes a processor510, memory520, a storage device530, a high-speed interface/controller540connecting to the memory520and high-speed expansion ports550, and a low speed interface/controller560connecting to a low speed bus570and a storage device530. Each of the components510,520,530,540,550, and560, are interconnected using various busses, and may be mounted on a common motherboard or in other manners as appropriate. The processor510can process instructions for execution within the computing device500, including instructions stored in the memory520or on the storage device530to display graphical information for a graphical user interface (GUI) on an external input/output device, such as display580coupled to high speed interface540. In other implementations, multiple processors and/or multiple buses may be used, as appropriate, along with multiple memories and types of memory. Also, multiple computing devices500may be connected, with each device providing portions of the necessary operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).

The memory520stores information non-transitorily within the computing device500. The memory520may be a computer-readable medium, a volatile memory unit(s), or non-volatile memory unit(s). The non-transitory memory520may be physical devices used to store programs (e.g., sequences of instructions) or data (e.g., program state information) on a temporary or permanent basis for use by the computing device500. Examples of non-volatile memory include, but are not limited to, flash memory and read-only memory (ROM)/programmable read-only memory (PROM)/erasable programmable read-only memory (EPROM)/electronically erasable programmable read-only memory (EEPROM) (e.g., typically used for firmware, such as boot programs). Examples of volatile memory include, but are not limited to, random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), phase change memory (PCM) as well as disks or tapes.

The storage device530is capable of providing mass storage for the computing device500. In some implementations, the storage device530is a computer-readable medium. In various different implementations, the storage device530may be a floppy disk device, a hard disk device, an optical disk device, or a tape device, a flash memory or other similar solid state memory device, or an array of devices, including devices in a storage area network or other configurations. In additional implementations, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer- or machine-readable medium, such as the memory520, the storage device530, or memory on processor510.

The high speed controller540manages bandwidth-intensive operations for the computing device500, while the low speed controller560manages lower bandwidth-intensive operations. Such allocation of duties is exemplary only. In some implementations, the high-speed controller540is coupled to the memory520, the display580(e.g., through a graphics processor or accelerator), and to the high-speed expansion ports550, which may accept various expansion cards (not shown). In some implementations, the low-speed controller560is coupled to the storage device530and a low-speed expansion port590. The low-speed expansion port590, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet), may be coupled to one or more input/output devices, such as a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, e.g., through a network adapter.

The computing device500may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a standard server500aor multiple times in a group of such servers500a, as a laptop computer500b, or as part of a rack server system500c.

Various implementations of the systems and techniques described herein can be realized in digital electronic and/or optical circuitry, integrated circuitry, specially designed ASICs (application specific integrated circuits), computer hardware, firmware, software, and/or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

A software application (i.e., a software resource) may refer to computer software that causes a computing device to perform a task. In some examples, a software application may be referred to as an “application,” an “app,” or a “program.” Example applications include, but are not limited to, system diagnostic applications, system management applications, system maintenance applications, word processing applications, spreadsheet applications, messaging applications, media streaming applications, social networking applications, and gaming applications.

These computer programs (also known as programs, software, software applications or code) include machine instructions for a programmable processor, and can be implemented in a high-level procedural and/or object-oriented programming language, and/or in assembly/machine language. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, non-transitory computer readable medium, apparatus and/or device (e.g., magnetic discs, optical disks, memory, Programmable Logic Devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term “machine-readable signal” refers to any signal used to provide machine instructions and/or data to a programmable processor.

The processes and logic flows described in this specification can be performed by one or more programmable processors, also referred to as data processing hardware, executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit). Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data from a read only memory or a random access memory or both. The essential elements of a computer are a processor for performing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto optical disks, or optical disks. However, a computer need not have such devices. Computer readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto optical disks; and CD ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

To provide for interaction with a user, one or more aspects of the disclosure can be implemented on a computer having a display device, e.g., a CRT (cathode ray tube), LCD (liquid crystal display) monitor, or touch screen for displaying information to the user and optionally a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer. Other kinds of devices can be used to provide interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. In addition, a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to a web browser on a user's client device in response to requests received from the web browser.

A number of implementations have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the disclosure. Accordingly, other implementations are within the scope of the following claims.