Hierarchical key management for cross-region replication
Novel techniques are described for performing hierarchical key management involving an end-to-end file storage replication between different cloud infrastructure regions. The novel hierarchical key management comprises three different keys, a first security key for the source region, a session key, valid only for a session, for the transfer of data between two different regions, and a second security key for the target region. Novel techniques are also described for using different file keys for different files of a file system in each region.
1. A method, comprising:
generating, by a computing device, a first security key associated with a source file system, based at least in part on a first master key, for encrypting and decrypting a plurality of file keys in the source file system, the source file system being configured to send snapshot deltas during a replication process, and the snapshot deltas being identified between two snapshots of the source file system;
generating, by the computing device, a second security key associated with a target file system, based at least in part on a second master key, for encrypting and decrypting a plurality of file keys in the target file system, the target file system being configured to receive the snapshot deltas during the replication process; and
generating, by the computing device, a session key, based at least in part on a third master key, for encrypting and decrypting the snapshot deltas transferred between the source file system and the target file system during the replication process, the session key being valid for a session;
wherein the first master key, the second master key, and the third master key are different keys.
2. The method of claim 1 , wherein the session is a duration between the start of the replication process in the source file system and the end of the replication process in the target file system.
3. The method of claim 1 , wherein the snapshot deltas transferred between the source file system and the target file system further comprises an object storage configured to receive the snapshot deltas from the source file system, and forward the snapshot deltas to the target file system.
4. The method of claim 3 , further comprising encrypting the snapshot deltas using the session key before transferring the snapshot deltas to the object storage, and decrypting the snapshot deltas using the session key after transferring the snapshot deltas to the target file system.
5. The method of claim 1 , further comprising transferring the session key from a control plane of the source file system to a control plane of the target file system.
6. The method of claim 1 , wherein the session key is associated with a globally unique resource identification.
7. The method of claim 1 , wherein each file key of the plurality of file keys in the source file system is associated with a particular file in the source file system and for encrypting and decrypting file data of the particular file in the source file system, and each file key of the plurality of file keys in the target file system is associated with a particular file in the target file system and for encrypting and decrypting file data of the particular file in the target file system.
8. The method of claim 1 , further comprising:
authenticating a key requester in the source file system for requesting the use of the first security key; and
authenticating a key requester in the target file system for requesting the use of the second security key.
9. The method of claim 8 , wherein authenticating the key requester in the source file system comprises checking an identification number of the replication process and an identification number of the source file system.
10. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
generating, by a computing device, a first security key associated with a source file system, based at least in part on a first master key, for encrypting and decrypting a plurality of file keys in the source file system, the source file system being configured to send snapshot deltas during a replication process, and the snapshot deltas being identified between two snapshots of the source file system;
generating, by a computing device, a second security key associated with a target file system, based at least in part on a second master key, for encrypting and decrypting a plurality of file keys in the target file system, the target file system being configured to receive the snapshot deltas during the replication process; and
generating, by a computing device, a session key, based at least in part on a third master key, for encrypting and decrypting the snapshot deltas transferred between the source file system and the target file system during the replication process, the session key being valid for a session;
wherein the first master key, the second master key, and the third master key are different keys.
11. The non-transitory computer-readable medium of claim 10 , wherein the session is a duration between the start of the replication process in the source file system and the end of the replication process in the target file system.
12. The non-transitory computer-readable medium of claim 10 , wherein the snapshot deltas transferred between the source file system and the target file system further comprises an object storage configured to receive the snapshot deltas from the source file system, and forward the snapshot deltas to the target file system.
13. The non-transitory computer-readable medium of claim 12 , further comprising encrypting the snapshot deltas using the session key before transferring the snapshot deltas to the object storage, and decrypting the snapshot deltas using the session key after transferring the snapshot deltas to the target file system.
14. The non-transitory computer-readable medium of claim 10 , further comprising transferring the session key from a control plane of the source file system to a control plane of the target file system.
15. The non-transitory computer-readable medium of claim 10 , wherein each file key of the plurality of file keys in the source file system is associated with a particular file in the source file system and for encrypting and decrypting file data of the particular file in the source file system, and each file key of the plurality of file keys in the target file system is associated with a particular file in the target file system and for encrypting and decrypting file data of the particular file in the target file system.
16. A system, comprising:
one or more processors; and
one or more non-transitory computer readable media storing computer-executable instructions that, when executed by the one or more processors, cause the system to perform:
generating, by a computing device, a first security key associated with a source file system, based at least in part on a first master key, for encrypting and decrypting a plurality of file keys in the source file system, the source file system being configured to send snapshot deltas during a replication process, and the snapshot deltas being identified between two snapshots of the source file system;
generating, by a computing device, a second security key associated with a target file system, based at least in part on a second master key, for encrypting and decrypting a plurality of file keys in the target file system, the target file system being configured to receive the snapshot deltas during the replication process; and
generating, by the computing device, a session key, based at least in part on a third master key, for encrypting and decrypting the snapshot deltas transferred between the source file system and the target file system during the replication process, the session key being valid for a session;
wherein the first master key, the second master key, and the third master key are different keys.
17. The system of claim 16 , wherein the session is a duration between the start of the replication process in the source file system and the end of the replication process in the target file system.
18. The system of claim 16 , wherein the session key is associated with a globally unique resource identification.
19. The system of claim 16 , further comprising:
authenticating a key requester in the source file system for requesting the use of the first security key; and
authenticating a key requester in the target file system for requesting the use of the second security key.
20. The system of claim 19 , wherein authenticating the key requester in the source file system comprises checking an identification number of the replication process and an identification number of the source file system.