Securing a path at a selected node
A path is secured from one node to another node of the computing environment. The one node obtains a first encryption key and a second encryption key. A shared key is obtained by the one node from a key server, and the shared key is used to encrypt a message. The encrypted message includes the first encryption key and the second encryption key. The encrypted message and an identifier of the shared key is sent from the one node to the other node, and a response message is received by the one node. The response message at least provides an indication that the other node received the encrypted message and obtained the shared key.
1. A computer program product for facilitating processing in a computing environment, the computer program product comprising:
one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media to perform a method comprising:
securing a path from one node of the computing environment to another node of the computing environment, the securing the path comprising:
obtaining, by the one node, a first encryption key and a second encryption key;
obtaining, by the one node, a shared key from a key server coupled to the one node, the one node having a secure connection with the key server;
using the shared key to encrypt a message providing an encrypted message, the encrypted message including the first encryption key and the second encryption key;
sending the encrypted message and an identifier of the shared key from the one node to the other node; and
receiving by the one node a response message to the encrypted message, the response message at least providing an indication that the other node received the encrypted message and obtained the shared key to be used to decrypt the encrypted message, wherein a secure path over a link coupling the one node and the other node is provided.
2. The computer program product of claim 1 , wherein the securing the path further comprises obtaining, by the one node, one or more first parameters for transmission of data from the one node to the other node, and one or more second parameters for reception of data from the other node.
3. The computer program product of claim 2 , wherein the encrypted message further includes the one or more first parameters and the one or more second parameters.
4. The computer program product of claim 1 , wherein the response message is encrypted and the securing the path further comprises:
decrypting the response message using the shared key; and
processing the response message that has been decrypted.
5. The computer program product of claim 4 , wherein the processing the response message includes obtaining a security parameters index associated with the second encryption key and a salt of one or more parameters obtained by the one node.
6. The computer program product of claim 5 , wherein the securing the path further includes using the second encryption key, the salt and the security parameters index to decrypt subsequent command data received at the one node from the other node.
7. The computer program product of claim 1 , wherein the securing the path further includes using the first encryption key and one or more parameters obtained by the one node to securely send subsequent command data to the other node.
8. The computer program product of claim 1 , wherein the securing the path further comprises establishing by the one node the secure connection with the key server, the establishing the secure connection using one or more certificates of authentication.
9. The computer program product of claim 8 , wherein at least one certificate of authentication includes a name associated with the other node to enable the key server to trust the other node.
10. The computer program product of claim 1 , wherein the using the shared key comprises using the shared key in a cryptographic technique to encrypt the message.
11. A computer system for facilitating processing in a computing environment, the computer system comprising:
a memory; and
a processor in communication with the memory, wherein the computer system is configured to perform a method, the method comprising:
securing a path from one node of the computing environment to another node of the computing environment, the securing the path comprising:
obtaining, by the one node, a first encryption key and a second encryption key;
obtaining, by the one node, a shared key from a key server coupled to the one node, the one node having a secure connection with the key server;
using the shared key to encrypt a message providing an encrypted message, the encrypted message including the first encryption key and the second encryption key;
sending the encrypted message and an identifier of the shared key from the one node to the other node; and
receiving by the one node a response message to the encrypted message, the response message at least providing an indication that the other node received the encrypted message and obtained the shared key to be used to decrypt the encrypted message, wherein a secure path over a link coupling the one node and the other node is provided.
12. The computer system of claim 11 , wherein the response message is encrypted and the securing the path further comprises:
decrypting the response message using the shared key; and
processing the response message that has been decrypted.
13. The computer system of claim 12 , wherein the processing the response message includes obtaining a security parameters index associated with the second encryption key and a salt of one or more parameters obtained by the one node.
14. The computer system of claim 13 , wherein the securing the path further includes using the second encryption key, the salt and the security parameters index to decrypt subsequent command data received at the one node from the other node.
15. The computer system of claim 11 , wherein the securing the path further includes using the first encryption key and one or more parameters obtained by the one node to securely send subsequent command data to the other node.
16. A computer-implemented method of facilitating processing in a computing environment, the computer-implemented method comprising:
securing a path from one node of the computing environment to another node of the computing environment, the securing the path comprising:
obtaining, by the one node, a first encryption key and a second encryption key;
obtaining, by the one node, a shared key from a key server coupled to the one node, the one node having a secure connection with the key server;
using the shared key to encrypt a message providing an encrypted message, the encrypted message including the first encryption key and the second encryption key;
sending the encrypted message and an identifier of the shared key from the one node to the other node; and
receiving by the one node a response message to the encrypted message, the response message at least providing an indication that the other node received the encrypted message and obtained the shared key to be used to decrypt the encrypted message, wherein a secure path over a link coupling the one node and the other node is provided.
17. The computer-implemented method of claim 16 , wherein the response message is encrypted and the securing the path further comprises:
decrypting the response message using the shared key; and
processing the response message that has been decrypted.
18. The computer-implemented method of claim 17 , wherein the processing the response message includes obtaining a security parameters index associated with the second encryption key and a salt of one or more parameters obtained by the one node.
19. The computer-implemented method of claim 18 , wherein the securing the path further includes using the second encryption key, the salt and the security parameters index to decrypt subsequent command data received at the one node from the other node.
20. The computer-implemented method of claim 16 , wherein the securing the path further includes using the first encryption key and one or more parameters obtained by the one node to securely send subsequent command data to the other node.