Secure-Enclave Key Orchestration for Cross-Node Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In dynamic, distributed open source container orchestration frameworks like Kubernetes, sharing sensitive application data between containers on different worker nodes is challenging due to the lack of direct addressing and the secure enclaves' hardware-based security mechanisms, making data sharing highly secure but impractical.
Innovation Solution
Implementing a cryptographic key orchestration system that uses unique sealing keys derived from worker node hardware to encrypt and decrypt data encryption keys, enabling secure sharing among trusted containers through local and remote attestation processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based security mechanisms are used to seal cryptographic keys in secure enclaves, then data security and confidentiality are improved, but data sharing between containers on different worker nodes becomes impractical
Solution Approach 1:
The patent introduces a key encryption key (KEK) as an intermediary that mediates between the hardware-based secure enclave and the data encryption keys. The KEK, stored in the secure enclave, encrypts and decrypts data encryption keys, enabling secure data sharing across worker nodes without compromising the hardware security boundaries. This intermediary layer resolves the contradiction by maintaining security while enabling practical data sharing.
Solution Approach 2:
The patent segments the cryptographic key hierarchy into multiple layers: data encryption keys for individual data items, a key encryption key stored in secure enclaves, and hardware-based sealing keys. This segmentation allows each layer to serve its specific function - data encryption keys can be shared across nodes while the KEK and hardware seals maintain security boundaries, thus enabling data sharing without compromising security.
2Reliability
If unique sealing keys derived from worker node hardware are used to protect data encryption keys, then data confidentiality is improved, but the complexity of key management increases
Solution Approach 1:
The key encryption key serves multiple functions: it encrypts data encryption keys, enables secure sharing across worker nodes, and works with the hardware-based sealing mechanism. This multi-functionality reduces the need for separate key management systems for each purpose, thereby managing complexity while maintaining strong confidentiality.
Solution Approach 2:
The patent performs preliminary key setup during worker node initialization, where the key encryption key is generated and stored in the secure enclave before any data operations. Data encryption keys are pre-encrypted with the KEK and stored in encrypted form. This preliminary action eliminates the need for complex real-time key derivation and management during data operations, simplifying ongoing key management.
3Speed
If containers use direct addressing within the same worker node, then communication efficiency is improved, but containers on different worker nodes cannot directly address each other
Solution Approach 1:
The patent enables containers to access data encryption keys on different worker nodes by copying the encrypted data encryption key through the key encryption key mechanism. The receiving worker node can decrypt the data encryption key using its own secure enclave and the shared KEK, allowing the container to access encrypted data as if it were local, thus maintaining communication efficiency while enabling cross-node access.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Accessing shared sensitive information in a managed container environment is provided. Each worker node in a plurality of worker nodes has access to shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key. Each worker node in the plurality of worker nodes protects the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node.