Secure memory sharing
A computer-implemented method includes, receiving, by a source node, a request from a destination node for data stored in a region of shared memory controlled by the source node. The data is encrypted in a local key of the source node. The method includes decrypting, by the source node, the locally encrypted data using the local key and encrypting, by the source node, the decrypted data using a first key for generating first encrypted data. The method also includes encrypting, by the source node, the first encrypted data using a second key for generating second encrypted data, and sending, by the source node, the second encrypted data to the destination node. A computer program product includes one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media. The program instructions includes program instructions to perform the foregoing method.
1 . A computer-implemented method, comprising:
receiving, by a source node, a request from a destination node for data stored in a region of shared memory controlled by the source node, the data being encrypted in a local key of the source node, the request originating from the destination node, wherein the shared memory has a plurality of other regions, the other regions being associated with other destination nodes, wherein data stored in the other regions of memory are protected by unique local keys associated with the other regions;
decrypting, by the source node, the locally encrypted data using the local key;
encrypting, by the source node, the decrypted data using a first key for generating first encrypted data;
encrypting, by the source node, the first encrypted data using a second key for generating second encrypted data; and
sending, by the source node, the second encrypted data to the destination node.
2 . The computer-implemented method of claim 1 , comprising sending, by the source node, the second key to the destination node, wherein the destination node is able to access the data without access to the local key of the source node.
3 . The computer-implemented method of claim 1 , wherein the region of shared memory is requestable by a plurality of destination nodes, wherein at least two of the destination nodes are associated with a different second key that is different than the second key used to generate the second encrypted data.
4 . The computer-implemented method of claim 1 , wherein the destination node is configured to decrypt the second encrypted data using the second key to obtain the first encrypted data, wherein the destination node is configured to decrypt the first encrypted data using the first key to obtain the data.
5 . A computer-implemented method, comprising:
receiving, by a destination node, second encrypted data sent by a source node in response to a request sent to the source node by the destination node,
wherein the second encrypted data is data that has been encrypted in a first key to create first encrypted data that is then encrypted in a second key to create the second encrypted data;
receiving, by the destination node, the second key;
receiving, by the destination node, the first key from a key manager located remotely from the source and destination nodes;
decrypting, by the destination node, the second encrypted data using the second key to obtain the first encrypted data; and
decrypting, by the destination node, the first encrypted data using the first key to obtain the data,
wherein the second encrypted data corresponds to data stored in a region of shared memory controlled by a source node, the region being associated with the destination node, the shared memory having a plurality of other regions associated with other destination nodes, wherein the data stored in the other regions of memory are protected by different first keys that are different than the first key.
6 . The computer-implemented method of claim 5 , wherein a local key used to encrypt the data when stored on the source node is ephemeral whereby a power outage on memory results in destruction of the local key, wherein the local key is not available to the destination node.
7 . The computer-implemented method of claim 5 , wherein the first encrypted data is stored in the region of shared memory, wherein a copy of the first key on the source node is ephemeral whereby a power outage on memory results in destruction of the first key on the source node.
8 . The computer-implemented method of claim 5 , wherein the second encrypted data corresponds to data stored in a region of shared memory controlled by a source node, wherein the data stored in the shared memory is encrypted in a local key of the source node, wherein the local key is not available to the destination node.
9 . The computer-implemented method of claim 8 , wherein the local key of the source node is ephemeral whereby a power outage on memory destroys the local key.
10 . A computer-implemented method, comprising: receiving, by a destination node, second encrypted data,
wherein the second encrypted data is data that has been encrypted in a first key to create first encrypted data that is then encrypted in a second key to create the second encrypted data, wherein the first key is associated with a region of memory controlled by a source node, wherein the memory is a shared memory having a plurality of different regions, the different regions being associated with different respective destination nodes, wherein the data stored in the different regions of memory are protected by different first keys that are different than the first key, wherein the second key is associated with the destination node;
receiving, by the destination node, the second key;
receiving, by the destination node, the first key;
decrypting, by the destination node, the second encrypted data using the second key to obtain the first encrypted data; and
decrypting, by the destination node, the first encrypted data using the first key to obtain the data.
11 . The computer-implemented method of claim 10 , wherein the second key is received from the source node.
12 . The computer-implemented method of claim 10 , wherein the second encrypted data corresponds to the region of memory controlled by the source node, wherein the first key is ephemeral whereby a power outage on memory destroys the first key.
13 . The computer-implemented method of claim 10 , comprising replacing, by the destination node, the second key with a dummy key for ending data sharing between the source node and the destination node.
14 . The computer-implemented method of claim 10 , wherein the region of memory controlled by the source node is requested by a plurality of destination nodes, wherein each destination node is associated with the same second key.
15 . A computer-implemented method, comprising:
receiving, by a transcoder, second encrypted data,
wherein the second encrypted data is data stored in a region of shared memory controlled by a source node, the data being encrypted in a first key to create first encrypted data that is then encrypted in a second key to create the second encrypted data;
receiving, by the transcoder, the second key;
decrypting, by the transcoder, the second encrypted data using the second key to obtain the first encrypted data;
encrypting, by the transcoder, the first encrypted data using a third key to create third encrypted data;
sending, by the transcoder, the third key to a destination node; and
sending, by the transcoder, the third encrypted data to the destination node,
wherein the second key is received from the source node, wherein the shared memory has a plurality of other regions, the other regions being associated with other destination nodes, wherein data stored in the other regions of memory are protected by unique local keys associated with the other regions.
16 . The computer-implemented method of claim 15 , wherein the third key is received from a transcoder manager.
17 . The computer-implemented method of claim 15 , wherein the second encrypted data corresponds to the region of memory controlled by the source node.
18 . The computer-implemented method of claim 15 , wherein the region of memory controlled by the source node is requested by the destination node.
19 . The computer-implemented method of claim 15 , wherein the region of memory controlled by the source node is requested by a plurality of destination nodes, wherein each destination node is associated with the same first key, wherein at least two of the destination nodes are each associated with a different second key.
20 . The computer-implemented method of claim 15 , wherein the destination node is configured to decrypt the third encrypted data using the third key to obtain the first encrypted data, wherein the destination node is configured to decrypt the first encrypted data using the first key to obtain the data.
21 . A computer program product, the computer program product comprising:
one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to receive, by a source node, a request from a destination node for data stored in a region of shared memory of the source node, the data being encrypted in a local key of the source node, the shared memory having a plurality of other regions, the other regions being associated with other destination nodes, wherein the other regions of the shared memory are associated with distinct first keys corresponding to the other regions, wherein the other destination nodes are associated with distinct second keys corresponding to the other destination nodes;
program instructions to decrypt, by the source node, the locally encrypted data using the local key;
program instructions to encrypt, by the source node, the decrypted data using a first key for generating first encrypted data;
program instructions to encrypt, by the source node, the first encrypted data using a second key for generating second encrypted data; and
program instructions to send, by the source node, the second encrypted data to the destination node.