Cluster-Wide Encryption Key Management for Distributed Storage Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed datastores like VSAN, data migration across different physical blocks with varying encryption keys leads to increased latency and resource usage due to the need for additional decryption and encryption processes.
Innovation Solution
Implementing a cluster-wide Key Encryption Key (KEK) and Data Encryption Key (DEK) generation and management system, where all hosts in the cluster use a common KEK and DEK for data encryption and decryption, thereby eliminating the need for decryption and re-encryption during data migration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted with different DEKs on different disks/hosts, then security is improved, but data migration latency and resource usage increase due to additional decryption and encryption operations
Solution Approach 1:
The patent merges the encryption keys across the distributed cluster by introducing a cluster-wide KEK that all hosts use to encrypt and decrypt DEKs. This allows data encrypted with one host's DEK to be decrypted by any other host in the cluster without requiring re-encryption, thereby reducing data migration latency while maintaining security through the hierarchical key structure.
Solution Approach 2:
The KEK acts as an intermediary between different DEKs used by various hosts. Instead of requiring direct decryption and re-encryption when migrating data between hosts with different DEKs, the standardized KEK serves as a common mediator that enables seamless key translation and eliminates the performance penalty associated with repeated encryption/decryption operations.
2Reliability
If data is encrypted with different DEKs on different disks/hosts, then security is improved, but resource usage increases due to additional decryption and encryption operations
Solution Approach 1:
The patent merges the encryption keys across the distributed cluster by introducing a cluster-wide KEK that all hosts use to encrypt and decrypt DEKs. This allows data encrypted with one host's DEK to be decrypted by any other host in the cluster without requiring re-encryption, thereby reducing data migration latency while maintaining security through the hierarchical key structure.
Solution Approach 2:
The KEK acts as an intermediary between different DEKs used by various hosts. Instead of requiring direct decryption and re-encryption when migrating data between hosts with different DEKs, the standardized KEK serves as a common mediator that enables seamless key translation and eliminates the performance penalty associated with repeated encryption/decryption operations.
3Productivity
If cluster-wide KEK and DEK are used for all hosts, then data migration efficiency is improved, but key management complexity increases
Solution Approach 1:
The patent segments key management into two distinct hierarchical levels: cluster-wide KEKs for inter-host key translation and host-specific DEKs for actual data encryption. This segmentation allows each level to be managed independently, reducing overall complexity while enabling efficient data migration across the cluster.
Solution Approach 2:
The patent extracts the key management complexity into a separate key management service that handles KEK generation, distribution, and rotation independently from data operations. This extraction allows the core data migration functionality to benefit from simplified key usage while the complex key management tasks are handled by a specialized service.
Data Source
AI summary
A method for encryption in a distributed datastore is provided. The method generally includes receiving random data from a virtualization management platform as a wrapped data encryption key (DEK), retrieving a key encryption key (KEK) from a key management server (KMS), decrypting the wrapped DEK using the KEK to determine a blank DEK, where the blank DEK is common to a plurality of hosts of a host cluster accessing a distributed datastore; encrypting first data using the blank DEK, and storing the encrypted first data in one or more disks of the distributed datastore, the one or more disks belonging to the plurality of hosts.