Network bound encryption for orchestrating workloads with sensitive data
The technology disclosed herein provides network bound encryption that enables a node management device to orchestrate workloads with encrypted data without sharing the decryption key. An example method may include: obtaining an asymmetric key pair comprising a public asymmetric key and a private asymmetric key; establishing a symmetric key using a key establishment service, wherein the symmetric key is established in view of the private asymmetric key of a first computing device and a public asymmetric key of the key establishment service; transmitting sensitive data encrypted using the symmetric key to a persistent storage device accessible to a second computing device; initiating a creation of an execution environment on the second computing device; and providing, by the first computing device, the public asymmetric key and the location data to the second computing device, wherein the location data corresponds to the key establishment service.
1. A method comprising:
receiving, by a node device from a management device, a public asymmetric key of the management device;
generating, by the node device, first combined key data comprising the public asymmetric key of the management device and an ephemeral public asymmetric key of the node device;
transmitting, by the node device, the first combined key data to a key establishment server;
receiving, by the node device, second combined key data from the key establishment server, wherein the second combined key data comprises a private asymmetric key of the key establishment server that is obfuscated by combining the private asymmetric key of the key establishment server with the ephemeral public asymmetric key of the node device;
extracting, by the node device, the private asymmetric key of the key establishment server from the second combined key data using an ephemeral private asymmetric key of the node device that is paired to the ephemeral public asymmetric key of the node device;
generating, by the node device, a symmetric key based on the private asymmetric key of the key establishment server; and
decrypting, by the node device, encrypted data received from the management device using the symmetric key.
2. The method of claim 1 , wherein the encrypted data comprises configuration data for a virtual machine, a container, or a trusted execution environment.
3. The method of claim 2 , further comprising:
configuring, by the node device, the virtual machine, the container, or the trusted execution environment within the node device using the configuration data.
4. The method of claim 1 ,
wherein the second combined key data comprises the public asymmetric key of the management device, the ephemeral public asymmetric key of the node device, and the private asymmetric key of the key establishment server.
5. The method of claim 4 , further comprising:
discarding, by the node device, the public asymmetric key of the management device, the ephemeral public asymmetric key of the node device, and the private asymmetric key of the key establishment server.
6. The method of claim 1 , wherein the node device is one of a plurality of node devices within a distributed computing network and the management device manages the plurality of node devices within the distributed computing network.
7. A node device comprising:
a memory; and
a processing device communicably coupled to the memory, wherein the processing device is to:
receive, from a management device, a public asymmetric key of the management device;
generate first combined key data comprising the public asymmetric key of the management device and an ephemeral public asymmetric key of the node device;
transmit the first combined key data to a key establishment server;
receive second combined key data from the key establishment server, wherein the second combined key data comprises a private asymmetric key of the key establishment server that is obfuscated by combining the private asymmetric key of the key establishment server with the ephemeral public asymmetric key of the node device;
extract the private asymmetric key of the key establishment server from the second combined key data using an ephemeral private asymmetric key of the node device that is paired to the ephemeral public asymmetric key of the node device;
generate a symmetric key based on the private asymmetric key of the key establishment server; and
decrypt encrypted data received from the management device using the symmetric key.
8. The node device of claim 7 , wherein the encrypted data comprises configuration data for a virtual machine, a container, or a trusted execution environment.
9. The node device of claim 8 , wherein the processing device is further to:
configure the virtual machine, the container, or the trusted execution environment within the node device.
10. The node device of claim 7 , wherein the second combined key data comprises the public asymmetric key of the management device, the ephemeral public asymmetric key of the node device, and the private asymmetric key of the key establishment server.
11. The node device of claim 10 , wherein the processing device is further to:
discard the public asymmetric key of the management device, the ephemeral public asymmetric key of the node device, and the private asymmetric key of the key establishment server.
12. The node device of claim 7 , wherein the node device is one of a plurality of node devices within a distributed computing network and the management device manages the plurality of node devices within the distributed computing network.
13. A non-transitory machine-readable storage medium storing instructions which, when executed, cause a processing device of a node device to: receive, from a management device, a public asymmetric key of the management device;
generate first combined key data comprising the public asymmetric key of the management device and an ephemeral public asymmetric key of the node device;
transmit the first combined key data to a key establishment server;
receive second combined key data from the key establishment server, wherein the second combined key data comprises a private asymmetric key of the key establishment server that is obfuscated by combining the private asymmetric key of the key establishment server with the ephemeral public asymmetric key of the node device;
extract the private asymmetric key of the key establishment server from the second combined key data using an ephemeral private asymmetric key of the node device that is paired to the ephemeral public asymmetric key of the node device;
generate a symmetric key based on the private asymmetric key of the key establishment server; and
decrypt encrypted data received from the management device using the symmetric key.
14. The non-transitory machine-readable storage medium of claim 13 , wherein the encrypted data comprises configuration data for a virtual machine, a container, or a trusted execution environment.
15. The non-transitory machine-readable storage medium of claim 13 , wherein the second combined key data comprises the public asymmetric key of the management device, the ephemeral public asymmetric key of the node device, and a private asymmetric key of the key establishment server.
16. The non-transitory machine-readable storage medium of claim 15 , wherein the processing device is further to:
discard the public asymmetric key of the management device, the ephemeral public asymmetric key of the node device, and the private asymmetric key of the key establishment server.
17. The non-transitory machine-readable storage medium of claim 13 , wherein the node device is one of a plurality of node devices within a distributed computing network and the management device manages the plurality of node devices within the distributed computing network.