Dynamic generation of key for encrypting data in management node
In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may be a service processor. The service processor generates a first encryption key at runtime based on unique device data of the service processor and a first logic. The service processor refrains from storing the first encryption key in the storage device. The service processor further encrypts target data based on the encryption key and an encryption algorithm to obtain first encrypted data. The service processor then stores the first encrypted data in a storage device of the service processor.
1. A method of operating a service processor, comprising:
generating a first encryption key at runtime based on unique device data of the service processor and a first logic, wherein the first logic is provided by firmware of the service processor;
encrypting target data based on the first encryption key and an encryption algorithm to obtain first encrypted data; and
storing the first encrypted data in a storage device of the service processor;
updating the firmware, the updated firmware including a second logic;
generating a second encryption key at runtime based on the unique device data of the service processor and the second logic;
decrypting the first encrypted data with the first encryption key and the encryption algorithm to obtain the target data prior to updating the firmware;
encrypting the target data based on the second encryption key and the encryption algorithm to obtain second encrypted data subsequent to updating the firmware; and
storing the second encrypted data in the storage device of the service processor.
2. The method of claim 1 , wherein the unique device data are a unique chip identifier of a processor of the service processor.
3. The method of claim 1 , further comprising: refraining from storing the first encryption key in the storage device.
4. The method of claim 1 , further comprising:
receiving a request to retrieve the target data;
obtaining the unique device data;
generating the first encryption key at runtime based on the unique device data and the first logic;
retrieving the first encrypted data from the storage device;
decrypting the first encrypted data based on the first encryption key and the encryption algorithm to obtain the target data; and
returning the target data in response to the request.
5. An apparatus, the apparatus being a service processor, comprising:
a memory; and
at least one processor coupled to the memory and configured to:
generate a first encryption key at runtime based on unique device data of the service processor and a first logic, wherein the first logic is provided by firmware of the service processor;
encrypt target data based on the first encryption key and an encryption algorithm to obtain first encrypted data;
store the first encrypted data in a storage device of the service processor;
update the firmware, the updated firmware including a second logic;
generate a second encryption key at runtime based on the unique device data of the service processor and the second logic;
decrypt the first encrypted data with the first encryption key and the encryption algorithm to obtain the target data prior to updating the firmware;
encrypt the target data based on the second encryption key and the encryption algorithm to obtain second encrypted data subsequent to updating the firmware; and
store the second encrypted data in the storage device of the service processor.
6. The apparatus of claim 5 , wherein the unique device data are a unique chip identifier of a processor of the service processor.
7. The apparatus of claim 5 , wherein the at least one processor is further configured to refrain from storing the first encryption key in the storage device.
8. The apparatus of claim 5 , wherein the at least one processor is further configured to:
receive a request to retrieve the target data;
obtain the unique device data;
generate the first encryption key at runtime based on the unique device data and the first logic;
retrieve the first encrypted data from the storage device;
decrypt the first encrypted data based on the first encryption key and the encryption algorithm to obtain the target data; and
return the target data in response to the request.
9. A non-transitory computer-readable medium storing computer executable code for operating a service processor, comprising code to:
generate a first encryption key at runtime based on unique device data of the service processor and a first logic;
encrypt target data based on the first encryption key and an encryption algorithm to obtain first encrypted data;
store the first encrypted data in a storage device of the service processor;
update the firmware, the updated firmware including a second logic;
generate a second encryption key at runtime based on the unique device data of the service processor and the second logic;
decrypt the first encrypted data with the first encryption key and the encryption algorithm to obtain the target data prior to updating the firmware;
encrypt the target data based on the second encryption key and the encryption algorithm to obtain second encrypted data subsequent to updating the firmware; and
store the second encrypted data in the storage device of the service processor.
10. The non-transitory computer-readable medium of claim 9 , wherein the unique device data are a unique chip identifier of a processor of the service processor.
11. The non-transitory computer-readable medium of claim 9 , wherein the code is further configured to refrain from storing the first encryption key in the storage device.