Virtual network replication using staggered encryption
A method includes selecting, by at least one hardware processor of a first database deployment, data for transmission to a second database deployment. The data includes a plurality of files forming a data stream. At least a first file of the plurality of files is encoded using a first encryption key which is stored in at least a second file of the plurality of files. The at least a first file is further encoded to include a second encryption key associated with at least a third file of the plurality of files. A set of nodes is identified in a virtual private network connected to the first and second database deployments. The data stream is transmitted from the first database deployment to the second database deployment via the set of nodes of the virtual private network that is connected to the first database deployment and the second database deployment.
1. A method comprising:
selecting, by at least one hardware processor of a first database deployment, data for transmission to a second database deployment, the data comprising a plurality of files forming a data stream;
encoding, by the at least one hardware processor, at least a first file of the plurality of files using a first encryption key, the first encryption key stored in at least a second file of the plurality of files;
further encoding, by the at least one hardware processor, the at least a first file to include a second encryption key associated with at least a third file of the plurality of files;
identifying, by the at least one hardware processor, a set of nodes in a virtual private network connected to the first database deployment and the second database deployment; and
causing, by the at least one hardware processor, transmission of the data stream from the first database deployment to the second database deployment via the set of nodes of the virtual private network that is connected to the first database deployment and the second database deployment.
2. The method of claim 1 , further comprising:
causing transmission of the at least a second file prior to the at least a first file; and
causing transmission of the at least a third file after the at least a first file.
3. The method of claim 1 , wherein the first encryption key is a data encryption key, and the method further comprising:
encoding the data encryption key using the first encryption key to generate an encrypted data encryption key.
4. The method of claim 3 , further comprising:
encoding the at least a first file to include the encrypted data encryption key.
5. The method of claim 1 , further comprising:
encoding the second encryption key using a public key of the second database deployment, to generate an encrypted second encryption key.
6. The method of claim 5 , further comprising:
encoding a header of the at least a first file to include the encrypted second encryption key; and
encoding a payload of the at least a first file to include the second encryption key associated with the at least a third file of the plurality of files.
7. The method of claim 6 , further comprising:
encoding the header to further include first identification (ID) of the public key and a second ID of the second encryption key; and
updating the first ID and the second ID based on detecting a key rotation at the first database deployment.
8. The method of claim 1 , wherein the first encryption key is a data encryption key, and the method further comprising:
encoding the data encryption key using the first encryption key to generate an encrypted data encryption key; and
encoding the first encryption key using a public key of the second database deployment.
9. The method of claim 8 , further comprising:
encoding the at least a first file to include the encrypted data encryption key and the public key of the second database deployment before the transmission of the data stream.
10. The method of claim 1 , further comprising:
periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key;
encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.
11. A system comprising:
one or more processors of a machine; and
at least one memory storing instructions that, when executed by the one or more processors of a first database deployment, cause the machine to perform operations comprising:
selecting data for transmission to a second database deployment, the data comprising a plurality of files forming a data stream;
encoding at least a first file of the plurality of files using a first encryption key, the first encryption key stored in at least a second file of the plurality of files;
further encoding the at least a first file to include a second encryption key associated with at least a third file of the plurality of files;
identifying a set of nodes in a virtual private network connected to the first database deployment and the second database deployment; and
causing transmission of the data stream from the first database deployment to the second database deployment via the set of nodes of the virtual private network that is connected to the first database deployment and the second database deployment.
12. The system of claim 11 , the operations further comprising:
causing transmission of the at least a second file prior to the at least a first file; and
causing transmission of the at least a third file after the at least a first file.
13. The system of claim 11 , wherein the first encryption key is a data encryption key, and the operations further comprising:
encoding the data encryption key using the first encryption key to generate an encrypted data encryption key.
14. The system of claim 13 , the operations further comprising:
encoding the at least a first file to include the encrypted data encryption key.
15. The system of claim 11 , the operations further comprising:
encoding the second encryption key using a public key of the second database deployment, to generate an encrypted second encryption key.
16. The system of claim 15 , the operations further comprising:
encoding a header of the at least a first file to include the encrypted second encryption key; and
encoding a payload of the at least a first file to include the second encryption key associated with the at least a third file of the plurality of files.
17. The system of claim 16 , the operations further comprising:
encoding the header to further include first identification (ID) of the public key and a second ID of the second encryption key; and
updating the first ID and the second ID based on detecting a key rotation at the first database deployment.
18. The system of claim 11 , wherein the first encryption key is a data encryption key, and the operations further comprising:
encoding the data encryption key using the first encryption key to generate an encrypted data encryption key; and
encoding the first encryption key using a public key of the second database deployment.
19. The system of claim 18 , the operations further comprising:
encoding the at least a first file to include the encrypted data encryption key and the public key of the second database deployment before the transmission of the data stream.
20. The system of claim 11 , the operations further comprising:
periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key;
encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.
21. A non-transitory computer-storage medium embodying instructions that, when executed by a machine of a first database deployment, cause the machine to perform operations comprising:
selecting data for transmission to a second database deployment, the data comprising a plurality of files forming a data stream;
encoding at least a first file of the plurality of files using a first encryption key, the first encryption key stored in at least a second file of the plurality of files;
further encoding the at least a first file to include a second encryption key associated with at least a third file of the plurality of files;
identifying a set of nodes in a virtual private network connected to the first database deployment and the second database deployment; and
causing transmission of the data stream from the first database deployment to the second database deployment via the set of nodes of the virtual private network that is connected to the first database deployment and the second database deployment.
22. The non-transitory computer-storage medium of claim 21 , the operations further comprising:
causing transmission of the at least a second file prior to the at least a first file; and
causing transmission of the at least a third file after the at least a first file.
23. The non-transitory computer-storage medium of claim 21 , wherein the first encryption key is a data encryption key, and the operations further comprising:
encoding the data encryption key using the first encryption key to generate an encrypted data encryption key.
24. The non-transitory computer-storage medium of claim 23 , the operations further comprising:
encoding the at least a first file to include the encrypted data encryption key.
25. The non-transitory computer-storage medium of claim 21 , the operations further comprising:
encoding the second encryption key using a public key of the second database deployment, to generate an encrypted second encryption key.
26. The non-transitory computer-storage medium of claim 25 , the operations further comprising:
encoding a header of the at least a first file to include the encrypted second encryption key; and
encoding a payload of the at least a first file to include the second encryption key associated with the at least a third file of the plurality of files.
27. The non-transitory computer-storage medium of claim 26 , the operations further comprising:
encoding the header to further include first identification (ID) of the public key and a second ID of the second encryption key; and
updating the first ID and the second ID based on detecting a key rotation at the first database deployment.
28. The non-transitory computer-storage medium of claim 21 , wherein the first encryption key is a data encryption key, and the operations further comprising:
encoding the data encryption key using the first encryption key to generate an encrypted data encryption key; and
encoding the first encryption key using a public key of the second database deployment.
29. The non-transitory computer-storage medium of claim 28 , the operations further comprising:
encoding the at least a first file to include the encrypted data encryption key and the public key of the second database deployment before the transmission of the data stream.
30. The non-transitory computer-storage medium of claim 21 , the operations further comprising:
periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key;
encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.