vSAN Key Management Synchronous Rekey Coordination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computing environments, the rekey process for changing encryption keys is time-consuming and often results in decryption failures due to the coexistence of old and new keys, leading to inconsistencies between hosts in a vSAN cluster.
Innovation Solution
Implement a key management system that coordinates key changes across hosts in a vSAN cluster, ensuring that all hosts update their active key indices synchronously to prevent decryption failures by managing the lifecycle of encryption keys and notifying hosts of key changes through a cluster monitoring membership and directory service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rekey process is performed to change encryption keys, then security level is improved, but time consumption increases and decryption failures occur
Solution Approach 1:
The system performs preliminary actions by pre-generating new encryption keys and maintaining both old and new keys in the key management system before the actual rekey operation. This allows hosts to switch keys without interruption, as the new keys are already prepared and available, eliminating the time-consuming sequential key replacement process.
Solution Approach 2:
The key management system acts as an intermediary that coordinates the rekey process across all hosts. It manages the lifecycle of encryption keys, notifies hosts of key changes through cluster monitoring membership and directory service, and ensures synchronous updates of active key indices, thereby preventing decryption failures during the transition.
2Adaptability or versatility
If old and new keys coexist during rekey, then key transition is enabled, but decryption failures occur due to inconsistencies between hosts
Solution Approach 1:
The system implements feedback mechanisms where the key management system notifies hosts of key changes through cluster monitoring membership and directory service. Hosts provide feedback by updating their active key indices synchronously, ensuring all hosts are aware of and coordinated with the current key state, thereby preventing decryption failures caused by key inconsistencies.
Solution Approach 2:
The key management system serves as an intermediary that coordinates the rekey process across all hosts. It manages the lifecycle of encryption keys, notifies hosts of key changes through cluster monitoring membership and directory service, and ensures synchronous updates of active key indices, thereby preventing decryption failures during the transition.
3Reliability
If synchronous key update is implemented across hosts, then decryption failures are prevented, but system complexity increases
Solution Approach 1:
The key management system serves as an intermediary that coordinates the rekey process across all hosts. It manages the lifecycle of encryption keys, notifies hosts of key changes through cluster monitoring membership and directory service, and ensures synchronous updates of active key indices, thereby preventing decryption failures during the transition.
Solution Approach 2:
Hosts automatically update their active key indices upon receiving notifications from the key management system through the cluster monitoring membership and directory service. This self-service mechanism eliminates the need for manual coordination between hosts, achieving synchronous key updates while keeping the system complexity manageable through automation.
Data Source
AI summary
An example method for a first host, being an owner of an object stored in a virtual storage area network (vSAN) cluster, to perform encryption and decryption operations during a rekey in the vSAN cluster is disclosed. The method includes obtaining a first encryption key and a first key identifier (ID) of the first encryption key; transmitting the first key ID and an active key index to a second host; using the first encryption key to perform encryption and decryption operations; and in response to a determination of receiving a key change notification from a master node of the vSAN cluster, terminating a connection with the second host.