Secure memory sharing method

Abstract

A computer-implemented method includes receiving, by a source node, a request from a destination node for data stored in an area of ​​a shared memory controlled by the source node. The data is encrypted with a local key of the source node. The method includes decrypting, by the source node, the locally encrypted data using the local key, and encrypting, by the source node, the decrypted data using the first key to generate first encrypted data. The method further includes encrypting, by the source node, the first encrypted data using the second key to generate second encrypted data, and transmitting, by the source node, the second encrypted data to the destination node.

Description

[Technical Field]

[0001] The present invention relates generally to secure memory sharing using storage systems, and more particularly to a secure transcoder for securing memory sharing in cloud storage systems and networks. [Background technology]

[0002] It is desirable to securely share data stored in shared memory among various computer nodes. Secure data transfer is particularly advantageous for having computational capabilities close to the stored data. For example, each node may have specific computational capabilities (e.g., a database, an inference engine, etc.). Prior art approaches typically use access control to limit data sharing. Access control is not foolproof and can lead to data leakage. For example, privileges can be escalated, or controls can be misconfigured.

[0003] In other prior art approaches, the source node encrypts stored data. In another approach, the source node can decrypt the data and send it over a secure link for sharing. In yet another approach, the source node can decrypt the data and share its decryption key with the destination node. These applications present many opportunities for data leakage. In some applications, homomorphic encryption can be used to provide secure access to data, but homomorphic encryption is limited to situations where computations can be performed on the data without the destination having access to the plaintext of the data. The usefulness of homomorphic encryption is limited by its slow performance.

[0004] These various prior art approaches tend to require a high degree of trust in the destination node. Additionally, these prior art approaches lack flexibility for functionality substitution. There remains a need in the art to securely share data in shared memory and enable operations (e.g., computation near storage) while providing a high degree of security for the shared data, particularly including the ability to stop sharing if the destination node misbehaves. Summary of the Invention

[0005] According to one aspect, a computer-implemented method includes receiving, by a source node, a request from a destination node for data stored in a region of shared memory controlled by the source node. The data is encrypted using a local key of the source node. The method includes, by the source node, decrypting the locally encrypted data using the local key and encrypting the decrypted data using the first key to generate first encrypted data. The method further includes, by the source node, encrypting the first encrypted data using the second key to generate second encrypted data and transmitting the second encrypted data to the destination node. This aspect is advantageous because it enables sharing and processing of memory ranges in the local memory.

[0006] An optional computer-implemented method includes requesting a region of shared memory by multiple destination nodes, with each of at least two of the destination nodes being associated with a different second key. This optional aspect provides the advantage of separate sharing policies for each destination node, allowing the source node to independently control access for each destination node.

[0007] According to one aspect, a computer program product includes one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including program instructions for performing the method described above.

[0008] Another aspect of the computer-implemented method includes receiving, by a destination node, second encrypted data, the second encrypted data being data encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. The method includes receiving, by the destination node, the second key and receiving, by the destination node, the first key. The method further includes, by the destination node, decrypting the second encrypted data using the second key to obtain the first encrypted data, and decrypting, by the destination node, the first encrypted data using the first key to obtain data. This aspect is advantageous because it adapts a memory load / store model to provide the ability to share access to data in memory between a source node and a destination node.

[0009] In one optional aspect, a computer-implemented method includes receiving a first key from a key manager. This optional aspect provides the advantage of the key manager implementing a sharing policy between the destination node and the source node.

[0010] According to another aspect, a computer-implemented method includes receiving, by a destination node, second encrypted data. The second encrypted data is data encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. The first key is associated with a region of memory controlled by the source node. The second key is associated with the destination node. The method includes receiving, by the destination node, the second key and receiving, by the destination node, the first key. The method further includes, by the destination node, decrypting the second encrypted data using the second key to obtain the first encrypted data and decrypting, by the destination node, the first encrypted data using the first key to obtain the data. This aspect is advantageous because it facilitates sharing between the destination node and the source node by adding security against data leakage and providing access control to the source node.

[0011] In one optional aspect, the computer-implemented method includes receiving a second key from the source node, which provides the advantage of allowing the source node to maintain ultimate control over the destination node's share with the source node.

[0012] According to another aspect, a computer-implemented method includes receiving second encrypted data by a transcoder. The second encrypted data is data stored in an area of ​​a shared memory controlled by a source node. The data is encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. The method includes receiving the second key by the transcoder and decrypting the second encrypted data using the second key to obtain the first encrypted data. The method further includes encrypting the first encrypted data using a third key to create third encrypted data by the transcoder, transmitting the third key to a destination node by the transcoder, and transmitting the third encrypted data to the destination node by the transcoder. This aspect is advantageous because it allows the destination node to access and decrypt the data as long as the transcoder authorizes the destination node to do so in accordance with a sharing policy established between the source node and the transcoder.

[0013] In one optional aspect, the computer-implemented method includes receiving a third key from a transcoder manager. This optional aspect provides the advantage of allowing the secure transcoder manager to perform relatively heavy functions for the transcoder, such as key generation, while keeping the relatively light functions coupled to memory via the secure transcoder.

[0014] Other aspects and techniques of the present invention will become apparent from the following detailed description, which, when taken in conjunction with the drawings, illustrate by way of example the principles of the invention. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 illustrates a cloud computing environment according to an aspect of the present invention. [Figure 2] FIG. 2 illustrates abstraction model layers according to an aspect of the present invention. [Figure 3]FIG. 1 illustrates a schematic architecture according to an aspect of the present invention. [Figure 4] FIG. 1 illustrates a schematic architecture according to an aspect of the present invention. [Figure 5A] FIG. 1 illustrates a schematic architecture according to an aspect of the present invention. [Figure 5B] FIG. 1 illustrates a schematic architecture according to an aspect of the present invention. [Figure 5C] FIG. 1 illustrates a schematic architecture according to an aspect of the present invention. [Figure 5D] FIG. 1 illustrates a schematic architecture according to an aspect of the present invention. [Figure 6] 1 is a flowchart illustrating a method according to an aspect of the present invention. [Figure 7] 1 is a flowchart illustrating a method according to an aspect of the present invention. [Figure 8] 1 is a flowchart illustrating a method according to an aspect of the present invention. [Figure 9] 1 is a flowchart illustrating a method according to an aspect of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0016] The following description is set forth for the purpose of illustrating the general principles of the present invention and is not intended to limit the inventive concepts claimed herein. Furthermore, particular features described herein can be used in combination with other described features in each of the various possible combinations and permutations.

[0017] Unless otherwise defined herein, all terms are to be given the broadest possible interpretation of the term, including the meaning implied from this specification and the meaning understood by those skilled in the art and / or defined in dictionaries, treatises, etc.

[0018] It should also be noted that, as used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless expressly stated otherwise. It should also be understood that the terms "comprise" and / or "comprising," when used herein, specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups or combinations thereof.

[0019] The following description discloses several aspects of allowing one or more destination nodes to share access to a memory controlled by a source node, preferably using a transcoder to give the destination node access to the memory without access to the source private key to decrypt the memory.

[0020] In one general aspect, a computer-implemented method includes receiving, by a source node, a request from a destination node for data stored in a region of shared memory controlled by the source node. The data is encrypted with a local key of the source node. The method includes decrypting, by the source node, the locally encrypted data using the local key and encrypting, by the source node, the decrypted data using the first key to generate first encrypted data. The method further includes encrypting, by the source node, the first encrypted data using the second key to generate second encrypted data and transmitting, by the source node, the second encrypted data to the destination node.

[0021] In another general aspect, a computer program product includes one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including program instructions for performing the method described above.

[0022] In another general aspect, a computer-implemented method includes receiving, by a destination node, second encrypted data, the second encrypted data being data encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. The method includes receiving, by the destination node, the second key and receiving, by the destination node, the first key. The method further includes decrypting, by the destination node, the second encrypted data using the second key to obtain the first encrypted data, and decrypting, by the destination node, the first encrypted data using the first key to obtain data.

[0023] In another general aspect, a computer-implemented method includes receiving, by a destination node, second encrypted data. The second encrypted data is data encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. The first key is associated with a region of memory controlled by the source node. The second key is associated with the destination node. The method includes receiving, by the destination node, the second key and receiving, by the destination node, the first key. The method further includes decrypting, by the destination node, the second encrypted data using the second key to obtain the first encrypted data and decrypting, by the destination node, the first encrypted data using the first key to obtain data.

[0024] In another general aspect, a computer-implemented method includes receiving, by a transcoder, second encrypted data. The second encrypted data is data stored in an area of ​​a shared memory controlled by a source node. The data is encrypted with a first key to create first encrypted data, which is then encrypted with a second key to create second encrypted data. The method includes receiving, by the transcoder, the second key and decrypting, by the transcoder, the second encrypted data using the second key to obtain the first encrypted data. The method further includes encrypting, by the transcoder, the first encrypted data using a third key to create third encrypted data, transmitting, by the transcoder, the third key to a destination node, and transmitting, by the transcoder, the third encrypted data to the destination node.

[0025] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to cloud computing environments. On the contrary, aspects of the invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0026] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0027] The features are as follows:

[0028] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capabilities such as server time and network storage automatically as needed without the need for human interaction with the service provider.

[0029] Wide network access: Functionality is available over the network and can be accessed through standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0030] Resource Pooling: To accommodate multiple consumers using a multi-tenant model, a provider's computing resources are pooled, with different physical and virtual resources dynamically allocated and reallocated according to demand. Consumers generally have no control over or knowledge of the exact location of the resources provided, but there is a sense of location independence in that they may be able to specify a higher level of abstraction (e.g., country, state, or data center).

[0031] Rapid Elasticity: Capabilities can be provisioned quickly and elastically, sometimes automatically, to quickly scale out, and capabilities can be released quickly and quickly scale in. To the consumer, the capabilities available for provisioning often appear infinite, and they can purchase as many as they want, at any time.

[0032] Metered Services: Cloud systems automatically control and optimize resource utilization by utilizing metering capabilities at some level of abstraction appropriate for the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0033] The service model is as follows:

[0034] Software as a Service (SaaS): The functionality offered to the consumer is the use of the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings.

[0035] Platform as a Service (PaaS): The capability offered to consumers is the deployment of consumer-created or acquired applications, written using programming languages ​​and tools supported by the provider, on a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration.

[0036] Infrastructure as a Service (IaaS): The capability offered to consumers is the provisioning of processing, storage, network, and other basic computing resources onto which they can deploy and run any software, which may include operating systems and applications. While consumers do not manage or control the underlying cloud infrastructure, they do have control over the operating systems, storage, and deployed applications, and may have limited control over selected network components (e.g., host firewalls).

[0037] The deployment models are as follows:

[0038] Private Cloud: This cloud infrastructure is operated solely for the organization. It can be managed by the organization or a third party and can reside on-premise or off-premise.

[0039] Community Cloud: This cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance concerns). It can be managed by the organization or a third party and can reside on-premises or off-premises.

[0040] Public Cloud: This cloud infrastructure is available to the public or large industry organizations and is owned by an organization that sells cloud services.

[0041] Hybrid Cloud: This cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain their own entities but are joined by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0042] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0043] Referring now to FIG. 1, an exemplary cloud computing environment 50 is illustrated. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automotive computer system 54N, or any combination thereof, can communicate. The nodes 10 can communicate with each other. The nodes 10 may be physically or virtually grouped (not shown) in one or more networks, such as the private cloud, community cloud, public cloud, or hybrid cloud, or any combination thereof, described above. This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on their local computing device. It should be noted that the types of computing devices 54A-54N shown in FIG. 1 are intended to be illustrative only, and it is understood that computing node 10 and cloud computing environment 50 may communicate with any type of computerized device via any type of network connection or network-addressable connection, or combination thereof, (e.g., using a web browser).

[0044] Referring now to Figure 2, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 1) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 2 are intended to be illustrative only, and aspects of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0045] Hardware and software layer 60 includes hardware and software components, such as mainframe 61, reduced instruction set computer (RISC) architecture-based servers 62, servers 63, blade servers 64, storage devices 65, and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0046] The virtualization layer 70 provides an abstraction layer that can instantiate virtual entities such as: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0047] In one embodiment, management layer 80 may provide the following functionality: Resource provisioning 81 dynamically procures computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 tracks costs as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one embodiment, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks and protection of data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 allocates and manages cloud computing resources to ensure required service levels are met. Service level agreement (SLA) planning and fulfillment 85 proactively negotiates and procures cloud computing resources for anticipated future demand in accordance with SLAs.

[0048] The workload tier 90 provides examples of functionality that can utilize a cloud computing environment. Examples of workloads and functionality that can be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and secure memory sharing 96.

[0049] Various aspects of the present invention involve sharing access to data in memory between a source node and a destination node. In a preferred aspect, the source node uses a local key to encrypt data stored in local memory. For memory sharing, the data is decrypted from the local key and then encrypted by the source node using a first source key, and the encrypted data (e.g., the first encrypted data) is further encrypted by the source node using a second source key to create doubly encrypted data (e.g., the second encrypted data).

[0050] At least some embodiments of the present invention include sharing access to data in memory between a source node and a destination node using a secure transcoder to provide the destination node with access to the data without access to the source private key to decrypt the stored data. In a preferred embodiment, the stored data is encrypted by the source node using a first source key, and the encrypted data (e.g., the first encrypted data) is further encrypted by the source node using a second source key to create doubly encrypted data (e.g., the second encrypted data). The first source key is shared with the destination node, and the second source key is shared with the secure transcoder. The transcoder provides a third key and shares the third key with the destination node. The transcoder decrypts the doubly encrypted data using the second key and re-encrypts the resulting single-encrypted data with the third key to create doubly encrypted data (e.g., the third encrypted data) using the third key. The destination node accesses the doubly encrypted (e.g., encrypted with a first key and further encrypted with a third key) data through the transcoder, and the destination node can access the unencrypted data using the first key and the third key.

[0051] At least some aspects of the present invention adapt the memory load / store model to provide the ability to share access to data in memory between source and destination nodes. For example, various operations disclosed herein address local memory sharing, processing memory ranges with multiple destinations, memory controller transcoding, etc.

[0052] At least some aspects of the present invention advantageously allow a destination node to access and decrypt data as long as the transcoder allows it (e.g., pursuant to a sharing policy established between the source node and the transcoder). Furthermore, after the sharing policy is changed, the transcoder can never access the plaintext data, and the destination node is prevented from further accessing the data.

[0053] At least some of the aspects described herein can be advantageously used in conjunction with symmetric encryption techniques, resulting in relatively higher performance compared to relatively slower public key encryption methods of transferring data between nodes in a system.

[0054] A general architecture in various configurations is shown in Figure 3. Architecture 300 may be implemented in accordance with the present invention in various configurations, such as in any of the environments shown in Figures 1-2 and 4-9. Of course, architecture 300 may include more or fewer elements than those specifically depicted in Figure 3, as will be apparent to those skilled in the art upon reading this description.

[0055] The architecture 300 includes a general architecture including a source node 302, a source node local memory 304, and a destination node 306. In various approaches, a region of the source node local memory 304 is shared between the source node 302 and the destination node 306. The source node 302 includes a source node computational function 308 and a source node memory controller 310. The source node computational function 308 includes a source node local memory encryption key 312 (e.g., a local key) that is used in conjunction with a source node local key encryption / decryption function 314 to encrypt and decrypt data on the source node local memory 304. As will be appreciated by those skilled in the art upon reading this disclosure, any of the encryption / decryption functions described herein can be configured to encrypt and / or decrypt data using an appropriate key and any known encryption technique. In a preferred embodiment, the source node local memory encryption key 312 is not shareable (e.g., the source node local memory encryption key 312 is securely stored so that it is available to the source node local key encryption / decryption function 314, but the source node local memory encryption key 312 is not extractable). Any local keys (e.g., local encryption keys) are transient in that a power outage of the memory (local or remote) will destroy or otherwise erase the local key, data stored in the memory, etc.

[0056] The source node 302 includes a source node sharing management function 316, a sharing policy 318, a first key 322, a key generator 320, and a second key 324. The source node 302 includes a source node first key encryption / decryption function 326 and a source node second key encryption / decryption function 328. In various approaches, the key generator 320 generates the second key 324. The second key 324 may be generated by the source node 302 in some approaches. In other approaches, the second key 324 may be generated by the destination node 306. In a preferred embodiment, the second key 324 is generated by the key generator 320 or the source node 302 in a manner that avoids exposure to weak keys, key reuse, etc. In yet another approach, as will be apparent to those skilled in the art upon reading this disclosure, any of the keys described herein may be generated and / or managed by a key generator and / or key manager (such as key manager 338) known in the art.

[0057] The destination node 306 includes a destination node local memory 330 , a destination node computational function 332 , a destination node memory controller 334 , and a destination node sharing management function 336 .

[0058] An example implementation of the architecture 300 will be described with reference to the arrows in FIG. 3 . Preferably, before sharing a range of source node local memory 304, the source node 302 creates a sharing policy 318. The sharing policy 318 may include information such as the memory range to be shared, the destination node to share with, the permitted access to the memory including duration, permitted read / write operations, the number of permitted operations, or a combination thereof. In various approaches, the policy 318 may include information such as what regions of the shared memory are shareable between which entities, the length of the sharing period between any entities, the number of operations associated with the sharing period between any entities, the type of operation associated with the sharing period between any entities, the amount of data shareable per sharing period between any entities, etc. In various approaches, the policy 318 may determine the type of access (e.g., read, write, read / write, etc.) that the destination node 306 can make to share the data. Attempts to access the shared data that are inconsistent with the policy 318 (e.g., unauthorized) are denied in a manner that should be apparent to one of ordinary skill in the art upon reading this disclosure. For example, if there is no key associated with the requested range or if the requested range is outside the policy, the key manager will not return a first key for the request, as described below. In another example, among multiple destination nodes requesting the same or different regions of memory, one destination node may have read-only access (according to its sharing policy), a separate destination node may have write-only access (according to its sharing policy), and a third destination node may have read / write access (according to its sharing policy). Each destination node may have a separate sharing policy that may be independent of the number of requests each destination node is permitted to make. In some approaches, the sharing policy may be independent of the type of access and / or limited to the number of types of requests permitted.

[0059] The various aspects described herein assume that the request for data is authorized (e.g., valid). Preferably, before sharing a range of source node local memory 304, the source node 302 and destination node 306 authenticate each other to verify each other's identity. In one approach, the source node sharing management function 316 and the destination node sharing management function 336 authenticate each other to verify each other's identity (e.g., the identity of the source node 302 and the identity of the destination node 306). In various approaches, the identity of each component in the architecture 300 may be authenticated according to protocols known in the art. In some approaches, authentication may be part of setting up a secure communication connection between the parties. In a preferred aspect, all communication links are secure (e.g., encrypted).

[0060] The source node 302 requests a first key 322 from a key manager 338, which creates and maintains a set of first keys 340. The key generator 320 creates a second key 324. The second key 324 is preferably a temporary key (e.g., the second key 324 may be revoked by the second node 302 in response to the termination of a shared policy with the destination node 306). The source node 302 notifies the key manager 338 to grant the destination node 306 access to the first key 322 in accordance with a policy 318. In at least some approaches, the policy 318 may reside in the key manager 338. In another approach, the policy 318 may reside in a policy manager (not shown) external to the source node 302. In operation 342, the destination node 306 requests the first key 322 from the key manager 338. The destination node 306 stores the first key 322 in a first key storage 344. At operation 346, the source node 302 sends a copy of the second key 324 to the destination node 306. The destination node 306 stores the second key 324 in a second key storage 348. The memory ranges associated with the keys may also be stored in the key manager 338 in a manner that would be apparent to one skilled in the art. For example, each first key 322 in the set of first keys 340 may be associated with a range in the source node local memory 304. In response to receiving a request from the destination node 306 for data stored in the source node local memory 304, the key manager 338 sends the appropriate first key 322 for the range of data associated with the request.

[0061] In a preferred implementation, when the destination node 306 reads from a region of shared memory (e.g., source node local memory 304), the source node local key encryption / decryption function 314 decrypts the data using the source node local memory encryption key 312. The source node first key encryption / decryption function 326 encrypts the unencrypted data using the first key 322 to obtain encrypted data (e.g., data encrypted with the first key 322). The first encrypted data is then encrypted by the source node second key encryption / decryption function 328 using the second key 324 to obtain second encrypted data (e.g., data encrypted with the first key 322 and then with the second key 324). This doubly encrypted data (e.g., second encrypted data) is sent to the destination node 306 in operation 350.

[0062] The destination node 306 includes a destination node second key encryption / decryption function 352 and a destination node first key encryption / decryption function 354. In various approaches, the destination node includes a destination node local memory encryption key 356 for use with a destination node local key encryption / decryption function 358. The destination node second key encryption / decryption function 352 decrypts the second encrypted data using the second key 324 stored in the second key storage 348 to obtain first encrypted data (e.g., data encrypted only with the first key 322). The destination node first key encryption / decryption function 354 decrypts the first encrypted data using the first key 322 stored in the first key storage 344 to obtain unencrypted data. In various approaches, the plaintext data is output to the destination node memory controller 334. The destination node local key encryption / decryption function 358 may encrypt the plaintext data using the destination node local memory encryption key 356. This data encrypted with the destination node local memory encryption key 356 may be stored in the destination node local memory 330. Alternatively, the decrypted data (e.g., plaintext data not encrypted with any key) may be sent to the destination node computational function 332 for operations to be performed on the data, in a manner that would be apparent to one of ordinary skill in the art upon reading this disclosure.

[0063] The source node 302 may revoke the sharing permission it granted to the destination node 306 at any time. In some approaches, the source node 302 notifies the destination node 306 that sharing has ended. In response to the sharing ending, the destination node preferably deletes its stored copies of the first key 322 and the second key 324. The sharing policy may be terminated in any manner that would be apparent to one of ordinary skill in the art upon reading this disclosure, such as a command from the source node 302 to the destination node 306, the key manager 338, any other component, or a combination thereof. In other approaches, the sharing policy may be terminated by a request from the destination node 306 to the source node 302.

[0064] In another approach, the source node 302 may revoke the sharing permission by revoking (e.g., deleting or otherwise erasing) the second key 324 in a manner known in the art. Revoking the second key 324 prevents the destination node 306 from any future access of the plaintext in the source node local memory 304, even if the destination node 306 finds a way to circumvent the policy 318. Thus, confidentiality is protected even if the destination node 306 tampers by retaining the first key 322 and the second key 324 stored in the first key storage 344 and the second key storage 348, respectively, after the sharing policy has been terminated in accordance with the policy 318.

[0065] Advantageously, having the first key 322 distributed by the key manager 338 and the second key distributed by the source node 302 allows the source node 302 to maintain ultimate control over the sharing. If the second key 324 is not available to the key manager 338, the key manager 338 will not have enough information to grant the destination node 306 access to the data in the area of ​​shared memory. Alternatively, for additional security and access control, a set of first keys 340 may be stored on the source node 302.

[0066] A general architecture in various configurations is shown in Figure 4. Architecture 400 may be implemented in accordance with the present invention in a variety of configurations, such as in any of the environments shown in Figures 1-3 and 5A-9. Of course, architecture 400 may include more or fewer elements than those specifically depicted in Figure 4, as will be apparent to those skilled in the art upon reading this description.

[0067] Figure 4 shows a simplified embodiment for sharing multiple ranges of a source node's local memory with multiple destination nodes. The use of first and second keys as described in Figure 3 is advantageous because it facilitates such sharing by adding security against data leakage and access control to the source node.

[0068] The architecture 400 includes a schematic architecture including a source node 402, a source node local memory 404, and multiple destination nodes. The destination nodes include destination node 1 406, destination node 2 408, destination node 3 410, and destination node 4 412. The source node 402 shares three regions of the source node local memory 404 with the four destination nodes. A first region of the source node local memory 404 is shared with destination node 1 406 and destination node 4 412. A second region of the source node local memory 404 is shared with destination node 2 408. A third region of the source node local memory 404 is shared with destination node 3 410.

[0069] The source node 402 requests three first keys (first key k1 414, first key k2 416, first key k3 418) from the key manager 420, one first key for each region of the source node local memory 404. Specifically, first key k1 414 may correspond to a first region of memory in the source node local memory 404, first key k2 416 may correspond to a second region of memory in the source node local memory 404, and first key k3 418 may correspond to a third region of memory in the source node local memory 404. The source node 402 generates four second keys (second key k1 422, second key k2 424, second key k3 426, second key k4 428), one for each destination node. Specifically, second key k1 422 may correspond to destination node 1 406, second key k2 424 may correspond to destination node 2 408, second key k3 426 may correspond to destination node 3 410, and second key k4 428 may correspond to destination node 4 412. Source node 402 may transmit each of the second keys to its associated destination node in a manner that should be apparent to those skilled in the art upon reading this disclosure.

[0070] Advantageously, the first key is distinct for each shared region and the second key is distinct for each destination node. The distinct first keys maintain cryptographic separation of data regions. The distinct second keys allow sharing policies to be controlled separately for each destination. For example, in a preferred embodiment, revoking the first key terminates sharing of a region, and revoking the second key terminates sharing for a destination node (e.g., the sharing period between the source node 402 and the destination node associated with the revoked second key). In this way, access to data on the source node local memory 404 for each destination node and for each region in memory is controlled independently.

[0071] In another embodiment, the source node 402 may group destination nodes. Each group of destination nodes may be given access to the same range of memory for the same period of time. An example implementation of the above embodiment may be used in a cloud environment where Company A shares information with Company B, and the destination nodes represent individuals within Company A. If either company terminates the collaboration, Company A revoks the second key associated with the collaboration. All parties within Company A who had access to the information based on the collaboration lose access.

[0072] Preferably, prior to sharing, destination node 1 406 requests the first key k1 414 from the key manager 420 in operation 430, and destination node 4 412 requests the first key k1 414 from the key manager 420 in operation 432. Destination node 2 408 requests the first key k2 416 from the key manager 420 in operation 434. Destination node 3 410 requests the first key k3 418 from the key manager 420 in operation 436.

[0073] In this implementation, the source node first key encryption / decryption function 438 may use any of the first encryption keys (e.g., first key k1 414, first key k2 416, first key k3 418) to encrypt appropriate regions of data stored in the source node local memory 404 in a manner that would be apparent to one of ordinary skill in the art upon reading this disclosure. In other approaches, the source node second key encryption / decryption function (not shown) may use any of the second encryption keys (second key k1 422, second key k2 424, second key k3 426, second key k4 428) to encrypt data for the appropriate destination node in a manner that would be apparent to one of ordinary skill in the art upon reading this disclosure.

[0074] For data to be shared with destination node 1 406, source node first key encryption / decryption function 438 encrypts the data in a first region using first key k1 414. Then, source node second key k1 encryption / decryption function 440 encrypts the data in the first region using second key k1 422 to obtain second encrypted data. The second encrypted data (e.g., data encrypted with first key k1 414 and then with second key k1 422) is sent to destination node 1 406 in operation 442.

[0075] For data shared with destination node 2 408, source node first key encryption / decryption function 438 encrypts the data in the second region with first key k2 416. Then, source node second key k2 encryption / decryption function 444 encrypts the data in the second region with second key k2 424 to obtain second encrypted data. The second encrypted data (e.g., data encrypted with first key k2 416 and then with second key k2 424) is sent to destination node 2 408 in operation 446.

[0076] For data to be shared with destination node3 410, source node first key encryption / decryption function 438 encrypts the data in the third region with first key k3 418. Then, source node second key k3 encryption / decryption function 448 encrypts the data in the third region with second key k3 426 to obtain second encrypted data. The second encrypted data (e.g., data encrypted with first key k3 418 and then with second key k3 426) is sent to destination node3 410 in operation 450.

[0077] For data to be shared with destination node 4 412, source node first key encryption / decryption function 438 encrypts the data in the first region with first key k1 414. Then, source node second key k4 encryption / decryption function 452 encrypts the data in the first region with second key k4 428 to obtain second encrypted data. The second encrypted data (e.g., data encrypted with first key k1 414 and then with second key k4 428) is sent to destination node 4 412 in operation 454.

[0078] Destination node 1 406 includes a destination node 1 second key encryption / decryption function 456 and a destination node 1 first key encryption / decryption function 458. In response to receiving the second encrypted data (e.g., data encrypted with the first key k1 414 and then encrypted with the second key k1 422), the destination node 1 second key encryption / decryption function 456 may decrypt the second encrypted data using the second key k1 422 to obtain the first encrypted data (e.g., data encrypted with the first key k1 414). The destination node 1 first key encryption / decryption function 458 may then decrypt the first encrypted data using the first key k1 414 to obtain unencrypted data.

[0079] Destination node 2 408 includes a destination node 2 second key encryption / decryption function 460 and a destination node 2 first key encryption / decryption function 462. In response to receiving the second encrypted data (e.g., data encrypted with the first key k2 416 and then encrypted with the second key k2 424), the destination node 2 second key encryption / decryption function 460 may decrypt the second encrypted data using the second key k2 424 to obtain the first encrypted data (e.g., data encrypted with the first key k2 416). The destination node 2 first key encryption / decryption function 462 may then decrypt the first encrypted data using the first key k2 416 to obtain unencrypted data.

[0080] Destination node 3 410 includes a destination node 3 second key encryption / decryption function 464 and a destination node 3 first key encryption / decryption function 466. In response to receiving the second encrypted data (e.g., data encrypted with the first key k3 418 and then encrypted with the second key k3 426), the destination node 3 second key encryption / decryption function 464 may decrypt the second encrypted data using the second key k3 426 to obtain the first encrypted data (e.g., data encrypted with the first key k3 418). The destination node 3 first key encryption / decryption function 466 may then decrypt the first encrypted data using the first key k3 418 to obtain unencrypted data.

[0081] Destination node 4 412 includes a destination node 4 second key encryption / decryption function 468 and a destination node 4 first key encryption / decryption function 470. In response to receiving the second encrypted data (e.g., data encrypted with the first key k1 414 and then encrypted with the second key k4 428), the destination node 4 second key encryption / decryption function 468 may decrypt the second encrypted data using the second key k4 428 to obtain the first encrypted data (e.g., data encrypted with the first key k1 414). The destination node 4 first key encryption / decryption function 470 may then decrypt the first encrypted data using the first key k1 414 to obtain unencrypted data.

[0082] The use of distinct second keys, e.g., second key k1 422 and second key k4 428, allows source node 402 to individually control access to the common shared region of source node local memory 404. For example, sharing with destination node 1 406 can be terminated by source node 402 revoking second key k1 422. Destination node 1 406 will not be able to decrypt the data in the shared region even if it retains its own copy of the second key (second key k1 422) and the first key (first key k1 414). Destination node 4 412, which shared access to the region of source node local memory 404, can continue to access the shared region using first key k1 414 and its own second key (second key k4 428).

[0083] Figures 5A-5D illustrate a schematic architecture in various configurations. Architecture 500 may be implemented in accordance with the present invention in any of the environments illustrated in Figures 1-4 and 6-9 in various configurations. Of course, those skilled in the art will recognize from reading this description that architecture 500 may include more or fewer elements than those specifically illustrated in Figures 5A-5D.

[0084] 5A-5D illustrate variations of a schematic architecture for sharing a region of remote memory controlled by a source node using secure transcoder functionality, and therefore common features are commonly numbered as would be apparent to one of ordinary skill in the art upon reading this disclosure.

[0085] The architecture 500 of FIG. 5A includes a source node 502 and a destination node 504. The source node 502 includes a source node computational resource 506 and a source node shared manager function 508. The source node 502 includes a source node first key encryption / decryption function 510 and a source node second key encryption / decryption function 512. The source node 502 includes a source node local memory controller 514 having a source node local memory encryption / decryption function 516 that uses a source node local memory encryption key 518. The source node is preferably coupled to a key manager 520 and a source node local memory 522. The key manager 520 stores and manages a set of first keys 524 and a set of second keys 526. In some approaches, the architecture 500 does not include a key manager 520 , and the source node 502 maintains a set of first keys 524 and a set of second keys 526 .

[0086] In various approaches, the source node 502 requests a first key 528 of a set of first keys 524 from the key manager 520. The source node also requests a second key 530 of a set of second keys 526 from the key manager 520. Both the first key 528 and the second key 530 are usable by the source node 502 to share a range of data stored in memory with the destination node 504.

[0087] The source node computational resource 506 stores data in the source node local memory 522 using the source node local memory controller 514. The data may be stored as created via path 532. In a preferred embodiment, secure encryption of the data may be provided by a source node local memory encryption key 518 used in conjunction with a source node local memory encryption / decryption function 516, which may be part of the source node local memory controller 514. The source node local memory encryption key 518 is preferably a temporary key.

[0088] The source node computational resources 506 may also store data in a remote memory 534. The source node 502 may be coupled to a secure transcoder 536 and a secure transcoder manager 538. The secure transcoder 536 includes a second key storage 540 for the second key 530, a secure transcoder memory controller 542, a secure transcoder second key encryption / decryption function 544, and a policy management function 546. The policy management function 546 of the secure transcoder 536 provides an advantage by allowing sharing between the source node 502 and the destination node 504 to continue using the secure transcoder 536 even if the secure transcoder 536 is no longer coupled with the secure transcoder manager 538 (e.g., thereby making the system more fault-tolerant). In a preferred embodiment, second key storage 540 for second keys 530 restricts access of stored second keys 530 to secure transcoder second key encryption / decryption function 544. Secure transcoder manager 538 may be coupled to multiple transcoders (not shown) in various ways. Secure transcoder manager 538 advantageously performs the heavier functions for the transcoders and leaves the lighter functions coupled to memory via the secure transcoders.

[0089] When remote memory is shared, it is preferable for the first and second keys to persist in the event of independent failures of source node 502 and remote memory 534. Key manager 520 is one technique for ensuring key persistence.

[0090] A region of remote memory 534 may be shared between source node 502 and destination node 504. A policy management function 546 on secure transcoder 536 stores, provides, enforces, etc., the shared policy information, as described in FIG. 3 and other figures. After authenticating secure transcoder manager 538 (e.g., using secure transcoder manager function 548) and secure transcoder 536 (e.g., using policy management function 546), source node 502 transmits scope ownership information to policy management function 546. In a preferred embodiment, source node 502 securely transmits second key 530 to secure transcoder 536 in operation 552, and secure transcoder 536 stores second key 530 in second key storage 540. In response to establishing the policy and authenticating the destination node 504 using the destination node manager function 550, the source node 502 sends the first key 528 to the destination node 504 in operation 554, and the destination node 504 stores the first key 528 in a first key storage 556. A key generator 558 on the secure transcoder manager 538 generates a third key 560 and sends the third key 560 to the secure transcoder 536 in operation 562. In other approaches, the secure transcoder 536 manages and / or generates the third key 560 without the secure transcoder manager 538. The secure transcoder 536 preferably stores the third key 560 in a secure transcoder third key storage 564.

[0091] When source node 502 writes data to remote memory 534, the data is first encrypted using first key 528 by source node first key encryption / decryption function 510 to obtain first encrypted data (e.g., data encrypted with first key 528). The first encrypted data is then encrypted using second key 530 by source node second key encryption / decryption function 512 to obtain second encrypted data (e.g., data encrypted with first key 528 and then encrypted with second key 530). The second encrypted data is sent to secure transcoder 536 in operation 566. Secure transcoder 536 can store the second encrypted data in remote memory 534.

[0092] When destination node 504 reads from the shared area of ​​remote memory 534, secure transcoder second key encryption / decryption function 544 decrypts the second encrypted data using second key 530 to obtain first encrypted data (e.g., data encrypted with first key 528). If secure transcoder 536 does not have first key 528, secure transcoder 536 cannot access the unencrypted data. Secure transcoder 536 encrypts the first encrypted data with third key 560 using secure transcoder third key encryption / decryption function 568 to obtain third encrypted data (e.g., data encrypted with first key 528 and then encrypted with third key 560). The third encrypted data is transmitted to destination node 504 in operation 570.

[0093] Destination node 504 receives third key 560 from secure transcoder manager 538 in operation 572 and stores third key 560 in destination node third key storage 574. Destination node 504 uses destination node third key encryption / decryption function 576 to obtain the first encrypted data (e.g., data encrypted with first key 528) and uses third key 560 to decrypt the third encrypted data (e.g., data encrypted with first key 528 and then encrypted with third key 560). Destination node 504 uses destination node first key encryption function 578 to obtain unencrypted data and decrypts the first encrypted data using first key 528.

[0094] In some approaches, the plaintext data (e.g., unencrypted data) may be output to a destination node memory controller 580. A destination node local memory encryption / decryption function 582 may encrypt the plaintext data using a destination node local memory encryption key 584. The locally encrypted data may be stored in a destination node local memory 586. In other approaches, the plaintext data may be directly accessible by a destination node computational resource 587 in a manner that should be apparent to one of ordinary skill in the art upon reading this disclosure.

[0095] FIG. 5B is a variation of FIG. 5A, where common features are commonly numbered. FIG. 5B shows a schematic architecture 500 having key managers 588 and 589. Key manager 588 can be a manager for storing, managing, maintaining, etc., a set of first keys 524. Similarly, key manager 589 can be a manager for storing, managing, maintaining, etc., a set of second keys. Key manager 588 may send first key 528 to source node 502, and key manager 589 may send second key 530 to source node 502. By having separate key managers, each component individually authenticates each key manager, thereby providing additional security to the system that complements the authentication process.

[0096] Figure 5C is a variation of Figure 5A, where common features are commonly numbered. Figure 5C illustrates a schematic architecture 500 in which a key manager 520, in operation 590, provides a second key 530 directly to a secure transcoder 536 for storage in a second key storage 540. In this embodiment, as described above, the key manager 520 further provides a copy of the second key 530 to the source node 502 for encryption of the first encrypted data using the source node second key encryption / decryption function 512 to obtain second encrypted data (e.g., data encrypted with the first key 528 using the source node first key encryption / decryption function 510 and then encrypted with the second key 530 using the source node second key encryption / decryption function 512).

[0097] FIG. 5D is a variation of FIG. 5A, where common features are commonly numbered. FIG. 5D illustrates a schematic architecture 500 including a destination 1 node 591, a destination 2 node 592, and a destination 3 node 593. As shown, in an embodiment having multiple destinations, a key manager 520 may maintain different first keys in a set of first keys, each usable with an associated destination node. The key manager 520 may transmit each of the first keys (first key k1 594, first key k2 595, third key k3 596) to the source node 502. The source node 502 may transmit each first key to a respective destination node in a manner that would be apparent to one of ordinary skill in the art upon reading this disclosure. For example, a first key k1 594 may be sent from source node 502 to destination node 1 591, a first key k2 595 may be sent from source node 502 to destination node 2 592, and a first key k3 596 may be sent from source node 502 to destination node 3 593. Secure transcoder 536 may send a copy of third key 560 to each of the destination nodes as described above.

[0098] In some aspects, each destination node may similarly be associated with a different second key 530 from the set of second keys 526. In still other aspects, each region of remote memory 534 may be encrypted with a different first key, or each region of remote memory 534 may be encrypted with the same first key.

[0099] In various aspects, the source node double-encrypts the data using the source node first key encryption / decryption function 510 and then the source node second key encryption / decryption function 512, according to at least some of the approaches described herein, to obtain second encrypted data. In a preferred approach, the source node first key encryption / decryption function 510 may use any of the set of first keys 524 (first key k1 594, first key k2 595, first key k3 596) to perform the encryption / decryption. Similarly, the source node second key encryption / decryption function 512 may use any of the set of second keys (in embodiments where a different second key is associated with each destination) to perform the encryption / decryption. In other approaches, each different first key and / or each different second key may have its own encryption / decryption function.

[0100] Secure transcoder 536 may receive the second encrypted data. In aspects in which a different second key is associated with each destination, the secure transcoder also receives each copy of the different second key at operation 552. Secure transcoder second key encryption / decryption function 544 may decrypt the second encrypted data using second key 530 to obtain first encrypted data (e.g., data encrypted with the appropriate first key). Secure transcoder third key encryption / decryption function 568 encrypts the first encrypted data using third key 560 to obtain third encrypted data, as described above.

[0101] In a preferred embodiment, secure transcoder 536 transmits the third encrypted data to the appropriate destination node in a manner that should be apparent to one of ordinary skill in the art upon reading this disclosure. For example, the third encrypted data (e.g., data encrypted with first key k1 594 and then encrypted with third key 560) is transmitted to destination node 1 591 containing first key k1 594, the third encrypted data (e.g., data encrypted with first key k2 595 and then encrypted with third key 560) is transmitted to destination node 2 592 containing first key k2 595, and the third encrypted data (e.g., data encrypted with first key k3 596 and then encrypted with third key 560) is transmitted to destination node 3 593 containing first key k3 596.

[0102] Each destination node may use its respective key to decrypt the third encrypted data to obtain the first encrypted data, and then decrypt the first encrypted data to obtain the unencrypted data, in accordance with the various aspects described above.

[0103] Destination node 1 591 decrypts the third encrypted data with third key 560 using destination node third key encryption / decryption function 576 to obtain first encrypted data. Destination node 1 591 then decrypts the first encrypted data with first key k1 594 using destination node 1 first key k1 encryption / decryption function 597 to obtain unencrypted data.

[0104] Destination node 2 592 decrypts the third encrypted data with third key 560 using destination node third key encrypt / decrypt function 576 to obtain first encrypted data. Destination node 2 592 then decrypts the first encrypted data with first key k2 595 using destination node 2 first key k2 encrypt / decrypt function 598 to obtain unencrypted data.

[0105] Destination node 3 593 decrypts the third encrypted data with third key 560 using destination node third key encryption / decryption function 576 to obtain first encrypted data. Destination node 3 593 then decrypts the first encrypted data with first key k2 596 using destination node 3 first key k3 encryption / decryption function 599 to obtain unencrypted data.

[0106] In various embodiments, there may be multiple source nodes and / or multiple destination nodes. In other embodiments, a destination node may be a source node for another destination node. There may be any number of remote memories coupled to any component in the network to share memory between source and destination nodes.

[0107] In a preferred embodiment, all arrows and / or connecting lines shown in Figures 3-5D and any communications between components described herein may include additional protocols for communications encryption known in the art. For example, communications encryption protocols may be used to transfer keys between source and destination nodes, between source nodes and secure transcoders, and between secure transcoders and destination nodes, including Secure Sockets Layer (SSL), Transport Layer Security (TLS), and other protocols, as will be apparent to those skilled in the art upon reading this disclosure.

[0108] Referring now to Figure 6, a flowchart of a method 600 according to one embodiment is shown. Method 600 may be performed in accordance with the present invention in various embodiments, such as in any of the environments shown in Figures 1-5D and 7-9. Of course, one of ordinary skill in the art will recognize from reading this description that method 600 may include more or fewer operations than those specifically set forth in Figure 6.

[0109] The steps of method 600 may be performed by any suitable component of an operating environment. For example, in various embodiments, method 600 may be performed, in part or in whole, by a computer or any other device having one or more processors therein. A processor, such as a processing circuit, chip, or module implemented in hardware and / or software, preferably having at least one hardware component, or a combination thereof, may be used in any device to perform one or more steps of method 600. Examples of processors include, but are not limited to, a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0110] As shown in FIG. 6 , method 600 includes operation 602. Operation 602 includes receiving, by a source node, a request from a destination node for data stored in a region of the source node's shared memory. The request from the destination node can be received in any manner known in the art. In some approaches, the request is for a region of the source node's shared memory that resides in the source node's local memory. In other approaches, the request is for a region of the source node's shared memory that resides in the source node's remote memory and is controlled by the source node. Throughout this disclosure, a request for a region of shared memory interchangeably refers to a request for data associated with a region (e.g., a range) of shared memory, as will be apparent to one of ordinary skill in the art upon reading this disclosure.

[0111] In various approaches, data is encrypted with a local key of the source node. The source node contains the local key. The local key is not extractable (e.g., not shareable) and is preferably securely stored at the source node. In preferred embodiments, the source node uses the local key to encrypt data stored in local memory (e.g., locally encrypted memory).

[0112] Operation 604 includes decrypting, by the source node, the locally encrypted data using a local key. The locally encrypted data is decrypted to obtain unencrypted data. In a preferred embodiment, the source node uses the source node encryption / decryption function to decrypt the locally encrypted data to obtain the unencrypted data.

[0113] Operation 606 includes encrypting, by the source node, the decryption data using the first key to generate first encrypted data. The first encrypted data refers to data encrypted with the first key. In a preferred embodiment, the encryption of the decryption data using the first key to obtain the first encrypted data occurs at the source node. The source node includes the first key.

[0114] Operation 608 includes encrypting, by the source node, the first encrypted data using a second key to generate second encrypted data. The second encrypted data refers to data that is first encrypted with the first key and then encrypted with the second key. As used throughout this disclosure, the term second encrypted data may be used interchangeably with doubly encrypted data unless otherwise specified. In a preferred embodiment, the encryption of data into first encrypted data and then the encryption of the first encrypted data into second encrypted data occurs at the source node. The source node includes the first key and the second key.

[0115] Operation 610 includes transmitting, by the source node, second encrypted data to the destination node. The second encrypted data can be transmitted in any manner known in the art. In various approaches, the destination node is configured to decrypt the second encrypted data using a second key to obtain the first encrypted data using an encryption / decryption function at the destination node. The destination node is configured to decrypt the first encrypted data using the first key to obtain the data using an encryption / decryption function at the destination node (which may be the same or different from the encryption / decryption function that decrypts the second encrypted data to obtain the first encrypted data). The data may be unencrypted data, plaintext data, data in another key encryption form, etc., associated with the region of the source node's shared memory requested by the destination node.

[0116] In some approaches, method 600 includes transmitting, by the source node, a second key to the destination node. The source node may transmit the second key to the destination node, and the destination node may use the second key to decrypt the second encrypted data (e.g., data encrypted with the first key and then with the second key) to obtain the first encrypted data (e.g., data encrypted with the first key). In other approaches, the destination node may receive the second key from a key manager, as will be apparent to those skilled in the art upon reading this disclosure.

[0117] In some approaches, the destination node receives the first key from a key manager. The key manager may be coupled to the source node, the destination node, or any other component in the network, or a combination thereof, to provide, generate, manage, etc., keys for sharing memory between the source node and the destination node. In a preferred embodiment, the key manager provides the first key to the source node, which uses the first key to generate the first encrypted data as described in operation 606. In another preferred embodiment, the key manager also provides the first key to the destination node, which decrypts the first encrypted data (formerly the second encrypted data) using the first key to obtain unencrypted data. In other approaches, the first key may be received by the destination node directly from the source node, as will be apparent to those skilled in the art upon reading this disclosure.

[0118] In at least some approaches, a region of the shared memory may be requested by multiple destination nodes. In a preferred embodiment, at least two of the destination nodes are each associated with a different second key. For example, a source node may encrypt a region of the shared memory (e.g., data associated therewith) with the same first key for each of two destination nodes to obtain first encrypted data. The source node may encrypt the first encrypted data with one second key (k1) to obtain second encrypted data to send to the first destination node. The source node may encrypt the first encrypted data with a different second key (k2) to obtain second encrypted data to send to the second destination node (which appears different from the second encrypted data sent to the first destination node).

[0119] Referring now to Figure 7, a flowchart of a method 700 according to one embodiment is shown. Method 700 may be performed in accordance with the present invention in various embodiments, such as in any of the environments shown in Figures 1-6 and 8-9. Of course, one of ordinary skill in the art will recognize from reading this description that method 700 may include more or fewer operations than those specifically set forth in Figure 7.

[0120] Each step of method 700 may be performed by any suitable component of an operating environment. For example, in various embodiments, method 700 may be performed in part or in whole by a computer or any other device having one or more processors therein. A processor, such as a processing circuit, chip, or module implemented in hardware and / or software, preferably having at least one hardware component, or a combination thereof, may be used in any device to perform one or more steps of method 700. Examples of processors include, but are not limited to, a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0121] As shown in Figure 7, method 700 includes operation 702. Operation 720 includes receiving, by a destination node, second encrypted data. The second encrypted data is data that has been encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. In a preferred embodiment, the encryption of data into the first encrypted data and then the encryption of the first encrypted data into the second encrypted data occurs at the source node.

[0122] In a preferred embodiment, the source node includes a first key and a second key. The associated encryption of data to create first encrypted data and the associated encryption of the first encrypted data to create second encrypted data may, in some approaches, be performed by at least one encryption / decryption function on the source node. In other approaches, each key may be associated with a separate encryption / decryption function on the source node, as will be apparent to those skilled in the art in light of this disclosure.

[0123] In various approaches, the second encrypted data is received based at least in part on a request from the destination node to the source node for data stored in the region of the source node's shared memory. In some approaches, the second encrypted data corresponds to data stored in the region of the shared memory. The data stored in the region of the shared memory may be encrypted with a local encryption key and stored in the local memory. In response to the request for the data stored in the region of the shared memory, the source node may decrypt the data stored in the region of the shared memory using the local encryption key, as described in operation 604 of method 600. In other approaches, the data stored in the region of the shared memory is not encrypted with a local encryption key.

[0124] In at least some approaches, a region of shared memory may be claimed by multiple destination nodes in a manner that should be apparent to those skilled in the art upon reading this disclosure.

[0125] Operation 704 includes receiving the second key by the destination node. In various approaches, the source node transmits a copy of the second key to the destination node, which securely stores the copy for a period of time, a number of operations, etc., as defined by sharing policy information established between the source and destination nodes. In at least some aspects, in response to expiration of the sharing period (e.g., as determined by the sharing policy or required by the source node), the destination node may discard the second key and / or replace the second key with a dummy key in a manner that would be apparent to one of ordinary skill in the art upon reading this disclosure. The dummy key may be of any type known in the art.

[0126] Operation 706 includes receiving the first key by the destination node. In some approaches, the destination node receives the first key from a key manager. The key manager can be coupled to the source node, the destination node, or any other component in the network, or a combination thereof, to provide, generate, manage, etc., keys for sharing memory between the source node and the destination node. In other approaches, the first key can be received by the destination node directly from the source node, as will be apparent to one of ordinary skill in the art upon reading this disclosure.

[0127] Operation 708 includes decrypting, by the destination node, the second encrypted data using the second key to obtain first encrypted data, which is data encrypted with the first key to create the first encrypted data and then encrypted with the second key to create the second encrypted data, as described above.

[0128] Operation 710 includes decrypting, by the destination node, the first encrypted data using the first key to obtain the data. The destination node may use the encryption / decryption function and the second key (sent by the source node in some approaches) to obtain the first encrypted data. The destination node may use the encryption / decryption function and the first key (sent by a key manager in some approaches) to obtain the data. As noted above, the data may be unencrypted data, non-encrypted data, clear data, data in another key encryption form, etc.

[0129] Referring now to Figure 8, there is shown a flowchart of a method 800 according to one embodiment. Method 800 may be performed in accordance with the present invention in a variety of ways, particularly in any of the environments shown in Figures 1-7 and 9. Of course, those skilled in the art will recognize from reading this description that method 800 may include more or fewer operations than those specifically set forth in Figure 8.

[0130] Each of the steps of method 800 can be performed by any suitable component of an operating environment. For example, in various aspects, method 800 may be performed in part or in whole by a computer or any other device having one or more processors therein. A processor, e.g., a processing circuit, chip, or module implemented in hardware or software, or both, preferably having at least one hardware component, or a combination thereof, may be used in any device to perform one or more steps of method 800. Exemplary processors include, but are not limited to, a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0131] As shown in FIG. 8, method 800 includes operation 802. Operation 802 includes receiving, by a destination node, second encrypted data. The second encrypted data is data that has been encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. In a preferred embodiment, the encryption of the data into the first encrypted data and then the encryption of the first encrypted data into the second encrypted data occurs at the source node.

[0132] In various aspects, a first key is associated with a region of memory controlled by a source node, and a second key is associated with a destination node. For example, the region of memory may be requested by the destination node or multiple destination nodes, including the destination node. The same first key may be associated with each destination node. In a preferred aspect, a different second key is associated with each of at least two of the destination nodes. For example, the source node may encrypt a region of shared memory (e.g., data associated therewith) with the same first key for each of two destination nodes to obtain first encrypted data. The source node may encrypt the first encrypted data with one second key (k1) to obtain second encrypted data to send to the first destination node. The source node may encrypt the first encrypted data with a different second key (k2) to obtain second encrypted data to send to the second destination node (which appears different from the second encrypted data sent to the first destination node).

[0133] In another aspect, a different first key may be associated with each destination node. In this aspect, the source node may share a different region of memory with each of the destination nodes. Each region of memory may be protected by a different first key. In another aspect, when the source node has multiple external memory regions, a different first key may be associated with each destination node. Each external memory region may be associated with a different first key, a different second key, or both.

[0134] In other approaches, each destination node may be associated with a different first key and the same second key. In a preferred embodiment, at least two of the destination nodes are associated with different first keys. For example, a source node may encrypt a region of the shared memory (e.g., data associated therewith) with a first key for a first destination node, and encrypt the same or a different region of the shared memory with a different first key for a second destination node, resulting in two different sets of first encrypted data. Each set of first encrypted data may be encrypted with the same second key, resulting in two different sets of second encrypted data. The source node may transmit each set of second encrypted data to a respective destination node in a manner that should be apparent to one of ordinary skill in the art upon reading this disclosure.

[0135] In various aspects, the second encrypted data preferably corresponds to a region of shared memory controlled by the source node. For example, the second encrypted data can be data stored in a region of shared memory coupled to the source node. In other aspects, the second encrypted data corresponds to a region of shared memory controlled by the source node, where the shared memory is remote from the source node.

[0136] In a preferred embodiment, the source node includes a first key and a second key. In some approaches, the associated encryption of data to create the first encrypted data and the associated encryption of the first encrypted data to create the second encrypted data may be performed by at least one encryption / decryption function on the source node. In other approaches, each key may be associated with a separate encryption / decryption function on the source node, as will be apparent to those skilled in the art in light of this disclosure.

[0137] In various approaches, data stored in the shared memory of the source node is encrypted with a local key of the source node. The source node includes the local key. The local key is not extractable (e.g., not shareable) and is preferably securely stored at the source node. In a preferred embodiment, the source node uses the local key to encrypt data stored in its local memory (locally encrypted memory). The locally encrypted data in the locally encrypted memory is decryptable by the source node using the local key before being encrypted with the first key to obtain the first encrypted data, as described in at least some embodiments of method 600.

[0138] Operation 804 includes receiving, by the destination node, the second key. In various approaches, the source node transmits a copy of the second key to the destination node, which securely stores the copy for a period of time, a number of operations, etc., as defined by sharing policy information established between the source and destination nodes. In at least some aspects, in response to expiration of the sharing period (e.g., as determined by the sharing policy or required by the source node), the destination node may discard the second key, replace the second key with a dummy key, or both, in a manner that will be apparent to one of ordinary skill in the art upon reading this disclosure. The dummy key may be of any type known in the art.

[0139] Operation 806 includes receiving the first key by the destination node. In some approaches, the destination node receives the first key from a key manager. The key manager may be coupled to the source node, the destination node, or any other component in the network, or a combination thereof, to provide, generate, manage, etc., keys for sharing memory between the source node and the destination node. In other approaches, the first key may be received by the destination node directly from the source node, as will be apparent to one of ordinary skill in the art upon reading this disclosure.

[0140] Operation 808 includes decrypting, by the destination node, the second encrypted data using the second key to obtain first encrypted data, which is data encrypted with the first key to create the first encrypted data and then encrypted with the second key to create the second encrypted data, as described above. The destination node may use the encryption / decryption function and the second key (sent from the source node in some approaches) to obtain the first encrypted data.

[0141] Operation 810 includes decrypting, by the destination node, the first encrypted data using the first key to obtain the data. The destination node may use the encryption / decryption function and a second key (sent by the source node in some approaches) to obtain the first encrypted data. The destination node may use the encryption / decryption function and the first key (sent by a key manager in some approaches) to obtain the data. The data may be unencrypted data, unencrypted data, clear data, data in another key encryption form, etc., as described above.

[0142] Referring now to Figure 9, a flowchart of a method 900 according to one embodiment is shown. Method 900 may be performed in accordance with the present invention in various embodiments, such as in any of the environments shown in Figures 1-8. Of course, one of ordinary skill in the art will recognize from reading this description that method 900 may include more or fewer operations than those specifically set forth in Figure 9.

[0143] Each of the steps of method 900 can be performed by any suitable component of an operating environment. For example, in various embodiments, method 900 may be performed in part or in whole by a computer or any other device having one or more processors therein. A processor, such as a processing circuit, chip, or module implemented in hardware and / or software, preferably having at least one hardware component, or a combination thereof, can be used in any device to perform one or more steps of method 900. Examples of processors include, but are not limited to, a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0144] As shown in FIG. 9, method 900 includes operation 902. Operation 902 includes receiving, by a transcoder, second encrypted data. The second encrypted data is data stored in an area of ​​a shared memory controlled by a source node that has been encrypted with a first key to create first encrypted data and then encrypted with a second key to create second encrypted data. In a preferred embodiment, the encryption of the data into the first encrypted data and the subsequent encryption of the first encrypted data into the second encrypted data occurs at the source node. The source node includes the first key and the second key.

[0145] In another approach, the second encrypted data is received based at least in part on a data request from the transcoder to the source node. In response to receiving the request for data from the destination node, the transcoder may send the data request to the source node.

[0146] In various aspects, the second encrypted data is received at a transcoder from a shared memory, a source node, etc., based on a data request from at least one destination node. There may be any number of destination nodes requesting data from a region of the shared memory controlled by the source node via the transcoder. In some approaches, the transcoder may receive the second encrypted data in response to a data request from a destination node in accordance with sharing policy information between the source node, the destination node, the transcoder, etc. The sharing policy information may include the memory range to be shared, the destination node to share with, the permitted access to the memory including the duration, the permitted read / write operations, the number of permitted operations, what regions of the shared memory are shareable between which entities, the length of the sharing period between any entities, the number of operations associated with the sharing period between any entities, the type of operation associated with the sharing period between any entities, the amount of data shareable between any entities per sharing period, etc. In various approaches, the sharing policy information determines when to end the sharing period. In various aspects, the sharing period may be terminated according to a policy, in response to the revocation of at least one key, in response to a request to terminate the sharing period by the source node, a request to terminate the sharing period by the destination node, a power-off event, any other triggering event, or any combination thereof.

[0147] In various embodiments, a first key is associated with a region of memory controlled by a source node, and a second key is associated with a destination node. For example, the region of memory may be claimed by the destination node or multiple destination nodes, including the destination node. The same first key may be associated with each destination node. In a preferred embodiment, a different second key and / or a different first key is associated with each of at least two of the destination nodes.

[0148] In some approaches, if the shared memory is locally encrypted at the source node (e.g., encrypted with a local encryption key), a different first key may be associated with each destination node. If the shared memory is the same remote memory region controlled by the source node, the first key may be the same for each destination node. If the shared memory includes different regions of remote memory controlled by the source node, the first key may be different for each destination node.

[0149] In various embodiments, the second encrypted data preferably corresponds to a region of a shared memory of the source node. For example, the second encrypted data can be data stored in a region of a shared memory coupled to the source node. In other embodiments, the second encrypted data corresponds to a region of a shared memory controlled by the source node, the shared memory being remote from the source node.

[0150] In a preferred embodiment, the source node includes a first key and a second key. In some approaches, the associated encryption of data to create the first encrypted data and the associated encryption of the first encrypted data to create the second encrypted data may be performed by at least one encryption / decryption function on the source node. In other approaches, each key may be associated with a separate encryption / decryption function on the source node, as will be apparent to those skilled in the art in light of this disclosure.

[0151] In various approaches, data stored in the shared memory of the source node is encrypted with a local key of the source node. The source node includes the local key. The local key is not extractable (e.g., not shareable) and is preferably securely stored at the source node. In a preferred embodiment, the source node uses the local key to encrypt data stored in the local memory (locally encrypted memory). The locally encrypted data in the locally encrypted memory can be encrypted by the source node using the local key before being encrypted with the first key to obtain first encrypted data, as described in at least some embodiments of method 600.

[0152] Operation 904 includes receiving a second key by the transcoder. The second key can be transmitted from the source node. In various approaches, the source node transmits a copy of the second key to the transcoder, which securely stores the copy for a period of time, a number of operations, etc., as defined by the sharing policy information. In at least some aspects, in response to expiration of the sharing period (e.g., as determined by the sharing policy or required by the source node), the transcoder may discard the second key, replace the second key with a dummy key, or both, in a manner that will be apparent to one of ordinary skill in the art upon reading this disclosure. The dummy key can be of any type known in the art.

[0153] Operation 906 includes decrypting, by the transcoder, the second encrypted data using the second key to obtain the first encrypted data. The second encrypted data is data stored in a shared area of ​​memory that was encrypted with the first key to create the first encrypted data and then encrypted with the second key to create the second encrypted data, as described above. According to operation 906, the transcoder may use encryption / decryption functionality in the transcoder and the second key (sent by the source node) to obtain the first encrypted data. The transcoder preferably never obtains the unencrypted data (or the original data in another key-encrypted form) if it cannot access the first key (e.g., to decrypt the first encrypted data to obtain the data).

[0154] Operation 908 includes encrypting, by the transcoder, the first encrypted data using a third key to create third encrypted data. The first encrypted data (e.g., encrypted only with the first key) may be encrypted with a new, third key to create third encrypted data by an encryption / decryption function in the transcoder. The encryption / decryption function may be the same as or different from the encryption / decryption function of operation 906 (e.g., separate from or used only with the third key). In a preferred approach, the third key is received at the transcoder from a transcoder manager. In another approach, the transcoder manager sends the third key to the transcoder and the destination node. The transcoder manager may generate the third key and send it to the transcoder, the destination node, or both in a manner that will be apparent to one of ordinary skill in the art upon reading this disclosure. In at least some approaches, the third key may be generated by the transcoder by a key generator on the transcoder. In other approaches, any keys may be generated and / or managed by a key manager and / or key generator coupled to the source node, transcoder, destination node, etc.

[0155] Operation 910 includes transmitting, by the transcoder, the third key to the destination node. In a preferred approach, the destination node receiving the third key is the destination node that originated the request for data. In various approaches, the transcoder transmits a copy of the third key to the destination node, which securely stores the copy for a period of time, a number of operations, etc., as defined by the sharing policy information and / or in a manner that will be apparent to those skilled in the art upon reading this disclosure. In a preferred embodiment, in response to expiration of the sharing period (e.g., as determined by the sharing policy or requested by the source node), the transcoder discards the third key and / or replaces it with a dummy key to terminate data sharing between the source node and the destination node, in a manner that will be apparent to those skilled in the art upon reading this disclosure. The dummy key can be of any type known in the art.

[0156] Operation 912 includes transmitting the third encrypted data to the destination node by the transcoder. The third encrypted data is data in which the first encrypted data (e.g., data encrypted using the first key) is encrypted using the third key to create the third encrypted data, as described above. The destination node receives the first key directly from the source node in various ways. The destination node is configured, in various ways, to use an encryption / decryption function on the destination node to obtain the first encrypted data and decrypt the third encrypted data using the third key. The destination node is configured to use an encryption / decryption function on the destination node (which may be the same as or different from the encryption / decryption function that decrypts the third encrypted data to obtain the first encrypted data) and decrypt the first encrypted data using the first key to obtain the data. The data can be unencrypted data, unencrypted data, cleartext data, data in another key encryption form, etc., as described above.

[0157] The present invention may be a system, method, or computer program product, or combination thereof, of any possible level of technical detail. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions stored thereon for causing a processor to implement aspects of the present invention.

[0158] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media also includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVDs), memory sticks, floppy disks, punch cards, or mechanically encoded devices such as ridge structures in grooves on which instructions are recorded, and any suitable combination thereof. As used herein, computer-readable storage media should not be construed as ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted over wires.

[0159] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to a computer-readable storage medium within the respective computing / processing device for storage.

[0160] Computer-readable program instructions for carrying out the operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or procedural programming languages, such as object-oriented programming languages ​​such as Smalltalk®, C++, and the "C" programming language, or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the present invention, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer-readable program instructions by personalizing the electronic circuitry using state information of the computer-readable program instructions.

[0161] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams that illustrate methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0162] These computer-readable program instructions may be supplied to a processor of a computer or other programmable data processing apparatus such that the instructions, executed by the processor, form means for implementing the functions / acts specified in the blocks of the flowcharts and / or block diagrams to implement a machine. These computer-readable program instructions may be stored on a computer-readable storage medium, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in the blocks of the flowcharts and / or block diagrams, and may direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0163] The computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to implement a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / operations specified in the flowchart and / or block diagram blocks.

[0164] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be completed in a single step, may be executed in parallel, may be executed substantially in parallel, may be partially or fully overlapped in time, or the blocks may even be executed in the reverse order, depending on the functionality involved. It will also be understood that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can function or be embodied by a combination of dedicated hardware and computer instructions.

[0165] Additionally, systems according to various embodiments may include a processor and logic integrated with or executable by the processor, the logic configured to perform one or more of the process steps described herein. "Integrated" means that the processor has the logic embedded in hardware logic, such as an application-specific integrated circuit (ASIC), FPGA, etc. "Executable by the processor" means that the logic is accessible by the processor and configured to cause the processor to perform a function when executed by the processor, such as hardware logic, software logic such as firmware, part of an operating system, part of an application program, or some combination of hardware and software logic. The software logic may be stored in any memory type known in the art, local and / or remote. Any processor known in the art may be used, such as a software processor module and / or a hardware processor, such as an ASIC, FPGA, central processing unit (CPU), integrated circuit (IC), graphics processing unit (GPU), etc.

[0166] It will be apparent from the above description that the various features of the above systems and / or methods may be combined in any manner, thereby creating multiple combinations.

[0167] It will also be appreciated that embodiments of the present invention may be provided in the form of a service that is deployed on behalf of a customer to provide the service on demand.

[0168] The descriptions of various embodiments of the present invention have been presented for illustrative purposes, but are not intended to be exhaustive or to be limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein are chosen to best explain the principles of the embodiments, practical applications, or technical improvements over commercially available technologies, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for computer information processing, comprising: receiving, by a source node, a request from a destination node for data stored in an area of ​​shared memory controlled by said source node, said data being encrypted with said source node's local key; decrypting, by the source node, the locally encrypted data using the local key; Based on the decoded data obtained from the area of ​​the shared memory, encrypting, by the source node, the decrypted data using a first key associated with the region of shared memory to generate first encrypted data; encrypting, by the source node, the first encrypted data using a second key associated with the destination node to generate second encrypted data; transmitting, by the source node, the second encrypted data to the destination node.

2. The method of claim 1 , wherein the destination node receives the first key from a key manager.

3. The method of claim 1 , comprising transmitting the second key by the source node to the destination node.

4. 2. The method of claim 1, wherein the region of shared memory is requested by multiple destination nodes, and a different second key is associated with each of at least two of the destination nodes.

5. 2. The method of claim 1, wherein the destination node is configured to decrypt the second encrypted data using the second key to obtain the first encrypted data, and the destination node is configured to decrypt the first encrypted data using the first key to obtain the data.

6. The method of claim 1, receiving, by a destination node, second encrypted data, the second encrypted data being data encrypted with a first key to create first encrypted data and then encrypted with a second key to create the second encrypted data; receiving the second key by the destination node; receiving the first key by the destination node; decrypting, by the destination node, the second encrypted data using the second key to obtain the first encrypted data; and decrypting, by the destination node, the first encrypted data using the first key to obtain the data.

7. 7. The method of claim 6, wherein the second encrypted data corresponds to data stored in an area of ​​shared memory controlled by the source node.

8. The method of claim 7 , wherein the region of shared memory is requested by the destination node.

9. 8. The method of claim 7, wherein the region of shared memory is requested by multiple destination nodes.

10. The method of claim 7 , wherein the second key is received from the source node.

11. The method of any of claims 6 to 10, wherein the first key is received from a key manager.

12. 12. A method according to any one of claims 6 to 11, wherein the first key is associated with a region of memory controlled by a source node and the second key is associated with the destination node.

13. 13. The method of claim 12, wherein the region of shared memory controlled by the source node is claimed by the destination node.

14. 13. The method of claim 12, wherein the region of shared memory controlled by the source node is claimed by multiple destination nodes, each of the destination nodes being associated with the same first key and at least two of the destination nodes being associated with different second keys.

15. The method of claim 1, receiving, by a transcoder, second encrypted data, the second encrypted data being data stored in an area of ​​a shared memory controlled by the source node, the data being encrypted with a first key to create first encrypted data and then encrypted with a second key to create the second encrypted data; receiving the second key by the transcoder; decrypting, by the transcoder, the second encrypted data using the second key to obtain the first encrypted data; encrypting, by the transcoder, the first encrypted data using a third key to create third encrypted data; transmitting the third key to a destination node by the transcoder; transmitting, by the transcoder, the third encrypted data to the destination node.

16. 16. The method of claim 15, wherein the second key is received from the source node.

17. 17. The method of claim 15 or 16, wherein the third key is received from a transcoder manager.

18. 18. A method according to any one of claims 15 to 17, wherein the second encrypted data corresponds to the region of memory controlled by the source node.

19. 19. A method according to any one of claims 15 to 18, wherein the region of memory controlled by the source node is claimed by the destination node.

20. 20. A method according to any one of claims 15 to 19, wherein the region of memory controlled by the source node is claimed by multiple destination nodes, each of which is associated with the same first key and each of at least two of which is associated with a different second key.

21. 21. The method of claim 15, wherein the destination node is configured to decrypt the third encrypted data using the third key to obtain the first encrypted data, and wherein the destination node is configured to decrypt the first encrypted data using the first key to obtain the data.

22. A computer program product that causes a computer to perform a method according to any one of claims 1 to 21.

Images