Cloud-native global file system with constant-time rekeying
A cloud-native global file system in which a local filer creates objects and forward them to a cloud-based object store is augmented to include constant-time rekeying (CTR). At volume creation time on the filer, a random Intermediate Key (IK) is generated. The IK is encrypted using one or more public key(s) for the volume in question, and then stored in encrypted form in a volume metadata file (e.g., cloudvolume.xml) alongside the other volume information. Once created, the IK is treated like any other volume metadata. During startup of a volume manager on the filer, the one or more per-volume IK blobs (present) are decrypted using an appropriate secret key, and then cached in memory. All objects sent to the cloud are then symmetrically encrypted to the current IK for that volume. All objects read from the cloud are decrypted using the locally-cached IK.
1. A method of key management in association with a cloud-based object store accessible from local filers, comprising:
upon receipt of a public key pair for a volume, the private key pair comprising a private key and its associated public key, generating an intermediate key using the public key;
adding the intermediate key to a volume metadata file;
selectively sharing the volume metadata file including the intermediate key with one or more remote systems that share the volume managed by a global lock; and
selectively encrypting and decrypting objects intended for storage in the volume in the cloud-based object store using the intermediate key.
2. The method as described in claim 1 further including applying the operations retroactively to a volume whose objects have been stored without encryption with the intermediate key.
3. The method as described in claim 1 wherein the intermediate key is a random key associated to the volume.
4. The method as described in claim 3 further including encrypting the random key using the public key of a public key to create an encrypted random key, wherein adding the intermediate key to the volume metadata file stores the encrypted random key in the volume metadata file.
5. The method as described in claim 4 further including using the private key of the public key pair to decrypt and recover the random key from the encrypted random key upon a given occurrence.
6. The method as described in claim 5 wherein the given occurrence is receipt of a request by which an object encrypted by the encrypted random key is returned from the cloud-based object store to a local filer.
7. The method as described in claim 5 further including decrypting one or more random key encrypted objects using the private key of the public key pair.
8. The method as described in claim 7 further including using a public key of the new public key to update the intermediate key for the volume.
9. The method as described in claim 4 further including discarding the encrypted random key upon receipt of an updated public key pair for the volume.
10. The method as described in claim 1 wherein the method is carried out as a rekeying operation on the volume.
11. The method as described in claim 1 wherein the intermediate key is generated at volume creation time.
12. Apparatus, comprising:
a hardware processor;
computer memory storing computer program code executed by the hardware processor to provide key management in association with a cloud-based object store accessible from local filers, the computer program code comprising computer program instructions configured to:
upon receipt of a public key pair for a volume, the private key pair comprising a private key and its associated public key, generate an intermediate key using the public key;
add the intermediate key to a volume metadata file;
selectively share the volume metadata file including the intermediate key with one or more remote systems that share the volume managed by a global lock; and
selectively encrypt and decrypt objects intended for storage in the volume in the cloud-based object store using the intermediate key.