Data policy implementation in a tag-based policy architecture
A technique implements data policy deployed in a tag-based policy architecture of a virtualized computing environment. Implementation of the data policy may include applying volume tags to data stored on virtualized storage resources, such as disks organized as volumes, based on instances that generate the data, contents of the data, and/or sensitivity of the data. The volume tags may be applied in a cryptographically strong manner to prevent tampering of the tagged data. To that end, the volume tags are cryptographically associated with the data, wherein such association is effected by binding the tags to a data encryption key stored on the volumes (disks) and used to encrypt/decrypt the data stored on the volumes.
1. A method comprising:
generating a data encryption key for a volume attached to an intermediary manager coupled to a network of a computing environment;
computing volume metadata for the attached volume at a control plane coupled to the network, the volume metadata including volume tags associated with data stored on the attached volume;
encrypting the data encryption key using an authenticated encryption algorithm at the control plane, the authenticated encryption algorithm including the volume tags as additional data to cryptographically bind the volume tags to the encrypted data encryption key wherein encrypting the data encryption key comprises: generating an authentication tag using the authenticated encryption algorithm including the volume tags and the data encryption key; and
applying the volume tags to the attached volume in a secure manner by storing the encrypted data encryption key and the cryptographically bound volume tags on the attached volume.
2. The method of claim 1 further comprising:
sending a request for the volume metadata from the intermediary manager to the control plane, wherein the request includes a certificate with an extension containing a token with instance tags of the intermediary manager.
3. The method of claim 2 wherein computing the volume metadata further comprises:
processing the token and the instance tags with a data policy configured for the attached volume to compute the volume metadata.
4. The method of claim 3 further comprising:
returning a response from the control plane to the intermediary manager, wherein the response includes the token containing the volume tags of the computed volume metadata.
5. The method of claim 1 wherein applying the volume tags to the attached volume comprises:
writing the encrypted data encryption key, the volume tags, and the authentication tag to a label of the attached volume.
6. A method comprising:
receiving a request to decrypt a data encryption key for a volume that is encrypted at a control coupled to a network of a computing environment plane by generating an authentication tag using the authenticated encryption algorithm including the volume tags and the data encryption key, wherein the request includes the encrypted data encryption key, instance tags of a requesting instance of the computing environment, volume tags associated with data stored on the volume, and an authentication tag representative of cryptographic binding of the volume tags to the data encryption key;
providing the encrypted data encryption key, the volume tags, and the
authentication tag as input information to an authenticated encryption algorithm; and
performing a cryptographic operation on the information, as well as a check that the authentication tag is valid, to determine any tampering of the volume tags.
7. The method of claim 6 further comprising:
in response to determining there has not been any tampering, examining a data policy configured for the attached volume to determine whether the volume tags and the instance tags match the policy.
8. The method of claim 7 wherein examining the data policy further comprises:
verifying that the requesting instance associated with the instance tags can access the volume associated with the volume tags.
9. The method of claim 7 further comprising:
in response to determining that the volume tags and the instance tags match the policy, decrypting the encrypted data encryption key at the control plane.
10. A system comprising:
an intermediary manager of a first computer coupled to a network, the intermediary manager configured to generate a data encryption key for an attached volume; and
a control plane of a second computer coupled to the network, the control plane configured to compute volume metadata for the attached volume, wherein the volume metadata includes volume tags associated with data stored on the attached volume, the control plane further configured to receive the data encryption key from the intermediary manager and encrypt the data encryption key using an authenticated encryption algorithm including the volume tags as additional data to cryptographically bind the volume tags to the data encryption key, wherein volume tags are cryptographically bound to the data encryption key as an authentication tag generated from the authenticated encryption algorithm using the volume tags and the data encryption key, the control plane further configured to return the encrypted data encryption key to the intermediary manager for storage on the attached volume in a secure manner.
11. The system of claim 10 wherein the intermediary manager is further configured to send a volume metadata request for the volume metadata to the control plane, wherein the request includes a certificate with an extension containing a token with instance tags of the intermediary manager.
12. The system of claim 11 wherein the control plane is further configured to process the token and the instance tags with a data policy configured for the attached volume to compute the volume metadata.
13. The system of claim 10 wherein intermediary manager stores the encrypted data encryption key on the attached volume by writing the encrypted data encryption key to a label of the attached volume.
14. The system of claim 10 wherein the intermediary manager is further configured to send a key decryption request to decrypt the encrypted data encryption key to the control plane, wherein the request includes instance tags of a requesting instance, the encrypted data encryption key, the volume tags and the authentication tag.
15. The system of claim 14 wherein the control plane is further configured to provide the encrypted data encryption key, the volume tags and the authentication tag as input information to the authenticated encryption algorithm and perform a cryptographic operation on the information, as well as a check that the authentication tag is valid, to determine any tampering of the volume tags.
16. The system of claim 15 wherein the control plane is further configured to, in response to determining there has not been any tampering, examine a data policy configured for the attached volume to determine whether the volume tags and the instance tags match the policy.
17. The system of claim 16 wherein the control plane is further configured to, in response to determining that the volume tags and the instance tags match the policy, decrypt the encrypted data encryption key and return the decrypted data encryption key to the intermediary manager.
18. A non-transitory computer readable media containing instructions for execution on a processor for a method comprising:
generating a data encryption key for a volume attached to an intermediary manager coupled to a network of a computing environment;
computing volume metadata for the attached volume at a control plane coupled to the network, the volume metadata including volume tags associated with data stored on the attached volume;
encrypting the data encryption key using an authenticated encryption algorithm at the control plane, the authenticated encryption algorithm including the volume tags as additional data to cryptographically bind the volume tags to the encrypted data encryption key wherein encrypting the data encryption key comprises: generating an authentication tag using the authenticated encryption algorithm including the volume tags and the data encryption key; and
applying the volume tags to the attached volume in a secure manner by storing the encrypted data encryption key, the cryptographically bound volume tags, and the authentication tag on the attached volume.
19. The method of claim 18 further comprising:
sending a request for the volume metadata from the intermediary manager to the control plane, wherein the request includes a certificate with an extension containing a token with instance tags of the intermediary manager.
20. The method of claim 19 wherein computing the volume metadata further comprises:
processing the token and the instance tags with a data policy configured for the attached volume to compute the volume metadata.