Key managers for distributed computing systems
Examples described herein may provide local key managers on computing nodes of distributed computing systems. The local key managers may protect secrets (e.g. cryptographic keys) in the distributed system such that risk of compromise is reduced or eliminated. In some examples, secure processors, such as trusted platform modules (TPMs), may be incorporated in computing nodes of distributed computing systems described herein. The secure processor may aid in securely protect cryptographic keys in the event of disk or node theft, for example.
1. A method comprising:
generating a master key at a first node of a cluster of computing nodes connected via a local network to form a distributed computing system;
modifying the master key to provide information derived from the master key;
providing, via the local network, at least a portion of the information derived from the master key to a second node of the cluster of computing nodes connected to the first node via the local network as part of the distributed computed system for storage at the second node;
after restart of the first node, requesting, via the local network, the at least a portion of the information derived from the master key from the second node of the cluster of computing nodes; and
combining the at least a portion of the information obtained from the second node of the cluster of computing nodes with additional information stored at the first node to obtain the master key.
2. The method of claim 1 , further comprising
encrypting the master key with a key encryption key stored at the first node to provide an encrypted master key.
3. The method of claim 2 , further comprising protecting the key encryption key using at least one secure crypto processor at the first node.
4. The method of claim 3 , further comprising protecting the key encryption key using a trusted platform module (TPM) of the at least one secure crypto processor.
5. The method of claim 2 , wherein the information derived from the master key comprises the encrypted master key, and combining the at least a portion of the information with additional information comprises decrypting the encrypted master key with the key encryption key.
6. The method of claim 1 , further comprising storing the portion of the information derived from the master key at multiple nodes of the cluster of computing nodes other than the first node.
7. The method of claim 1 , further comprising:
decrypting an encrypted data encryption key using the master key to provide a data encryption key; and
encrypting data using the data encryption key to provide encrypted data.
8. The method of claim 1 , further comprising communicating with the second node utilizing an identity credential fetched using the master key.
9. The method of claim 1 , further comprising decrypting a key management services master key using the master key;
decrypting a data encryption key using the key management services master key; and
providing the data encryption key to a user application in communication with the first node.
10. A computing node comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the computing node to:
generate a master key at the computing node, wherein the computing node is part of a cluster of computing nodes connected via a local network to form a distributed computing system;
modify the master key to provide information derived from the master key;
provide, via the local network, at least a portion of the information derived from the master key to another node of the cluster of computing nodes connected to the computing node via the local network for storage at the another node;
after restart of the computing node, request, via the local network, the at least a portion of the information derived from the master key from the another node of the cluster of computing nodes; and
combine the at least a portion of the information obtained from the another node of the cluster of computing nodes with additional information stored at the computing node to obtain the master key.
11. The computing node of claim 10 , wherein the instructions further cause the computing node to
encrypt the master key with a key encryption key stored at the computing node to provide an encrypted master key.
12. The computing node of claim 11 , wherein the instructions further cause the computing node to decrypt the encrypted master key with the key encryption key using a secure crypto processor.
13. The computing node of claim 12 , wherein the instructions further cause the computing node to decrypt the encrypted master key with the key encryption key using a trusted platform module (TPM) of the secure crypto processor.
14. The computing node of claim 11 , wherein the information derived from the master key comprises the encrypted master key; and causing the computing node to combine the at least a portion of the information with additional information comprises causing the computing node to decrypt the encrypted master key with the key encryption key.
15. The computing node of claim 10 , wherein the instructions further cause the computing node to:
decrypt an encrypted data encryption key utilizing the master key to provide a data encryption key; and
encrypt data using the data encryption key to provide encrypted data.
16. The computing node of claim 10 , wherein the instructions further cause the computing node to store the portion of the information derived from the master key at multiple nodes of the distributed computing system other than the computing node.
17. The computing node of claim 10 , wherein the instructions further cause the computing node to:
decrypt, at the computing node using the master key, identity credentials received in a communication from a service of one node of the cluster of computing nodes, other than the computing node using the master key; and
authenticate the communication using the identity credentials.
18. The computing node of claim 10 , wherein the instructions further cause the computing node to:
decrypt a key management services master key using the master key;
decrypt a data encryption key using the key management services master key;
for provision to a user application in communication with the computing node.
19. A non-transitory, computer readable media encoded with instructions which, when executed, cause a computing node to perform operations comprising:
generating a master key at the computing node, wherein the computing node is included in a cluster of computing nodes connected via a local network to form a distributed computing system;
modifying the master key to provide information derived from the master key;
providing, via the local network, at least a portion of the information derived from the master key to another node of the cluster of computing nodes for storage at the another node;
after restart of the computing node, requesting, via the local network, the at least a portion of the information derived from the master key from the another node of the cluster of computing nodes; and
combining the at least a portion of the information obtained from the another node of the cluster of computing nodes with additional information stored at the computing node to obtain the master key.
20. The non-transitory, computer readable media of claim 19 , wherein the instructions further cause the computing node to perform operations comprising encrypting the master key with a key encryption key stored at the computing node to provide an encrypted master key.
21. The non-transitory, computer readable media of claim 20 , wherein the information derived from the master key comprises the encrypted master key; and wherein the instructions further cause the computing node to perform operations comprising combining the at least a portion of the information with additional information comprises causing the computing node to decrypt the encrypted master key with the key encryption key.
22. The non-transitory, computer readable media of claim 20 , wherein the instructions further cause the computing node to perform operations comprising utilizing at least one secure crypto processor to decrypt the encrypted master key with the key encryption key.
23. The non-transitory, computer readable media of claim 22 , wherein the instructions further cause the computing node to perform operations comprising utilizing a trusted platform module (TPM) of the at least one secure crypto processor to decrypt the encrypted master key with the key.
24. The non-transitory, computer readable media of claim 19 , wherein the instructions further cause the computing node to perform operations comprising:
receiving data for encryption;
decrypting an encrypted data encryption key utilizing the master key to provide a data encryption key;
encrypting the data using the data encryption key to provide encrypted data; and
storing the encrypted data at the computing node.
25. The non-transitory, computer readable media of claim 19 , wherein the instructions further cause the computing node to perform operations comprising storing the portion of the information derived from the master key at multiple nodes of the cluster of computing nodes other than the computing node.
26. The non-transitory, computer readable media of claim 19 , wherein the instructions further cause the computing node to perform operations comprising:
receiving a communication from a service at one node of the cluster of computing nodes, other than the computing node;
decrypting identity credentials at the computing node using the master key; and
authenticating the communication using the identity credentials.
27. The non-transitory, computer readable media of claim 19 , wherein the instructions further cause the computing node to perform operations comprising:
decrypting a key management services master key using the master key;
decrypting a data encryption key using the key management services master key for provision to a user application in communication with the computing node.