Shared Key Derivation for Cross-Node Encrypted Data Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing systems, data management flexibility is poor due to the inability of target processing nodes to recover encrypted data from storage nodes because secure storage keys derived from different hardware unique keys (HUKs) of source and target processors are not compatible.
Innovation Solution
Implement a data management method where processing nodes obtain a secure storage key based on a shared external keying material, allowing seamless decryption of encrypted data by both the source and target nodes, ensuring compatibility and flexibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using secure storage keys derived from hardware unique keys (HUKs) of processing nodes, then data security is improved, but data management flexibility deteriorates because target processing nodes cannot decrypt data after migration
Solution Approach 1:
The patent introduces a key management node as an intermediary that manages secure storage keys across processing nodes. The key management node stores master keys and enables derivation of secure storage keys for different processing nodes, allowing data encrypted on one node to be decrypted on another node through the intermediary's key management service.
Solution Approach 2:
The secure storage key derivation mechanism is designed to be universal across multiple processing nodes. By using a key derivation function that takes a master key and processing node identifier, the system can generate compatible secure storage keys for any processing node, making the encryption scheme multi-functional and node-independent.
2Reliability
If secure storage keys are derived from hardware unique keys (HUKs) of processors, then key uniqueness and security are improved, but compatibility between source and target processing nodes deteriorates
Solution Approach 1:
The key generation process is segmented into two independent parts: a master key stored in the key management node and a processing node identifier. The secure storage key is derived by combining these two elements through a key derivation function, separating the security function from the hardware-specific function.
Solution Approach 2:
The system changes the parameter used for key derivation from hardware-specific HUKs to a combination of master key and node identifier. This parameter change allows the same master key to generate different secure storage keys for different nodes while maintaining compatibility through the shared derivation function.
Data Source
AI summary
A data management method comprises a first processing node that obtains a secure storage key based on a first external keying material corresponding to the first processing node, encrypts data corresponding to an application program in the first processing node, and sends encrypted data to a second processing node. The second processing node obtains a secure storage key based on a second external keying material corresponding to the second processing node, and decrypts the encrypted data that corresponds to the application program and that is sent by the first processing node. The second external keying material is the same as the first external keying material, whereby the second processing node and the first processing node may obtain a same secure storage key, and the second processing node may successfully decrypt the encrypted data that corresponds to the application program and that is sent by the first processing node.