Encrypted communication channels for distributed database systems

1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a processor to:

in response to a receipt of a query, communicate, via a first encrypted channel using a first key, first encrypted data between a plurality of nodes of a distributed database system, the first encrypted data comprising query metadata and a second key;

communicate, via a second encrypted channel, second encrypted data between the plurality of nodes of the distributed database system, the second encrypted channel using the second key included in the first encrypted data, the second encrypted data comprising query data; and

generate, by the plurality of nodes of the distributed database system, results for the query based on the query data in the second encrypted data.

2. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions further cause the processor to:

prior to the receipt of the query, communicate the first key to each of the plurality of nodes of the distributed database system via a third encrypted channel.

3. The non-transitory machine-readable storage medium of claim 2 , wherein the third encrypted channel uses Secure Copy Protocol (SCP) to encrypt the first key.

4. The non-transitory machine-readable storage medium of claim 2 , wherein the instructions further cause the processor to:

generate an updated first key; and

communicate the updated first key between the plurality of nodes of the distributed database system via the first encrypted channel.

5. The non-transitory machine-readable storage medium of claim 4 , wherein:

the first key is associated with a first unique identifier;

the updated first key is associated with a second unique identifier; and

the instructions further cause the processor to, responsive to a receipt of the updated first key, update a mapping of identifiers and keys associated with the first encrypted channel.

6. The non-transitory machine-readable storage medium of claim 1 , wherein the query metadata comprises an execution plan for the query.

7. The non-transitory machine-readable storage medium of claim 1 , wherein the first key and the second key are symmetric encryption keys.

8. The non-transitory machine-readable storage medium of claim 1 , wherein the second key is valid only for a duration of an execution of the query by the plurality of nodes of the distributed database system.

9. A computer implemented method comprising:

receiving a query to be executed by a distributed database system;

in response to a receipt of the query, communicating, via a first encrypted channel, first encrypted data between a set of nodes of the distributed database system, the first encrypted channel using a first key, the first encrypted data comprising query metadata and a second key;

communicating, via a second encrypted channel, second encrypted data between the set of nodes of the distributed database system, the second encrypted channel using the second key included in the first encrypted data, the second encrypted data comprising query data; and

generating, by the set of nodes of the distributed database system, results for the query based on the query metadata and the query data in the second encrypted data.

10. The computer implemented method of claim 9 , further comprising:

prior to the receipt of the query, establishing the first encrypted channel between a plurality of nodes in the set of nodes of the distributed database system.

11. The computer implemented method of claim 10 , wherein establishing the first encrypted channel comprises communicating the first key to each of the plurality of nodes in the set of nodes of the distributed database system via a third encrypted channel.

12. The computer implemented method of claim 9 , wherein the query metadata comprises an execution plan for the query.

13. The computer implemented method of claim 9 , wherein the query data comprises partial query results generated by one node of the set of nodes of the distributed database system.

14. The computer implemented method of claim 9 , wherein the first encrypted channel is based on Transport Layer Security (TLS), and the first key is a TLS private key.

15. A computing device comprising:

a hardware processor; and

a machine-readable storage medium storing instructions, the instructions executable by the hardware processor to:

in response to a receipt of a query, communicate, via a first encrypted channel using a first key, first encrypted data between a plurality of nodes of a distributed database system, the first encrypted data comprising query metadata and a second key;

transmit, via a second encrypted channel, second encrypted data between the plurality of nodes of the distributed database system, the second encrypted channel using the second key included in the first encrypted data, the second encrypted data comprising query data; and

generate, by the plurality of nodes of the distributed database system, results for the query based on the query metadata and the query data in the second encrypted data.

16. The computing device of claim 15 , the instructions executable by the hardware processor to:

prior to the receipt of the query, transmit the first key to each of the plurality of nodes of the distributed database system via a third encrypted channel.

17. The computing device of claim 16 , wherein the third encrypted channel uses Secure Copy Protocol (SCP) to encrypt the first key.

18. The computing device of claim 15 , wherein the query metadata comprises an execution plan for the query.

19. The computing device of claim 15 , wherein the first key and the second key are symmetric encryption keys.

20. The computing device of claim 15 , wherein the second key is valid only for a duration of an execution of the query by the plurality of nodes of the distributed database system.