Native Key Provider Bootstrapping Encrypted VSAN Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for enabling a virtual storage area network (VSAN) with encryption on a single node are complex and involve undesirable data movement, as they require a virtual server to generate keys and perform disk format conversion, which is time-consuming and affects customer workloads.
Innovation Solution
The implementation of a native key provider (NKP) on a single host allows for the simultaneous enablement of VSAN and encryption, eliminating the need for a virtual server to generate keys and enabling a shallow rekey to switch to a Key Management Interoperability Protocol (KMIP) Key Management Server (KMS), thereby minimizing data movement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a virtual server is used to generate keys and perform disk format conversion for enabling VSAN encryption on a single node, then encryption can be enabled, but the process becomes complex and time-consuming with undesirable data movement
Solution Approach 1:
The patent extracts the key generation function from the virtual server and places it directly on the host system. The host can now generate encryption keys locally without requiring a virtual server, thereby simplifying the overall process while maintaining encryption capability.
Solution Approach 2:
The patent segments the encryption enabling process into independent steps: key generation on the host, VSAN cluster creation, and optional shallow rekeying. This segmentation allows each step to be performed independently without requiring complex coordination between virtual server and host operations.
2Reliability
If disk format conversion is performed to enable encryption, then encryption is achieved, but data movement increases and workloads are affected
Solution Approach 1:
The patent applies preliminary action by generating encryption keys on the host before creating the VSAN cluster. This allows the encryption infrastructure to be pre-configured, eliminating the need for time-consuming disk format conversion and data movement after cluster creation.
Solution Approach 2:
The patent skips the traditional disk format conversion step entirely. By using shallow rekeying instead of full format conversion, the system rushes through the encryption enablement process in a fraction of the time, minimizing impact on customer workloads.
3Reliability
If a virtual server is required to generate keys, then key management is centralized, but the process becomes more complex and time-consuming
Solution Approach 1:
The patent enables the host to perform key generation self-service without requiring a virtual server. The host independently generates and manages its own encryption keys, which eliminates the overhead of virtual server involvement and accelerates the encryption enablement process.
4Loss of time
If shallow rekeying is used to switch to KMIP KMS, then data movement is minimized, but the transition process requires careful coordination
Solution Approach 1:
The patent performs preliminary key generation on the host before initiating the shallow rekeying process to KMIP KMS. This preliminary setup simplifies the transition coordination by ensuring all necessary cryptographic material is already in place, reducing the complexity of the switch-over process.
Data Source
AI summary
The present disclosure relates to bootstrapping an encrypted single node VSAN cluster. One method includes receiving a request to create an encrypted VSAN cluster from a single host in a software-defined datacenter, deploying a virtual server on a VSAN datastore of the software-defined datacenter, registering a native key provider (NKP) in the virtual server, creating an empty VSAN cluster encrypted by the NKP, adding the single host to the encrypted empty cluster to create a one-host encrypted cluster, registering a KMIP KMS in the virtual server, switching encryption of the one-host encrypted cluster from the NKP to the KMIP KMS, and adding another host to the one-host encrypted cluster to create the encrypted cluster.