Secure key management protocol for distributed network encryption

Patent metadata

Field	Value
Publication number	US-10798073-B2
Application number	US-201715421377-A
Country	US
Kind code	B2
Filing date	Jan 31, 2017
Priority date	Aug 26, 2016
Publication date	Oct 6, 2020
Grant date	Oct 6, 2020

Abstract

For an encryption management module of a host that executes one or more data compute nodes (DCNs), some embodiments of the invention provide a method of providing key management and encryption services. The method initially receives an encryption key ticket at an encryption management module to be used to retrieve an encryption key identified by the ticket from a key manager. When the encryption key has been retrieved, the method uses the encryption key to encrypt a message sent by a data compute node executing on the host requiring encryption according to an encryption rule. The encryption key ticket, in some embodiments, is generated for an encryption management module to implement the principle of least privilege. The ticket acts as a security token in retrieving encryption keys from a key manager. Ticket distribution and encryption rule distribution are independent of each other in some embodiments.

First claim

What is claimed is:

1. A method of providing encryption services in a system comprising a plurality of host computers, the method comprising:
at a particular host computer executing (i) virtualization software and (ii) a plurality of compute nodes (CNs),
receiving, from a server that is external to the particular host computer and provides a set of encryption rules for encrypting messages on the particular host computer, a key voucher generated by the server based on a key policy defined by a manager computer that manages the plurality of host computers, the key voucher comprising a set of identifiers for identifying (i) the particular host computer and (ii) a particular encryption key associated with the particular host computer, wherein the key voucher is only generated for the particular host computer if the key policy applies to the virtualization software executed by the particular host computer;
sending a request for the particular encryption key to a key manager that is external to the particular host computer and separate from the server, said request comprising the key voucher, wherein the key manager uses the identifiers of the key voucher to authenticate the particular host computer as an authorized key requestor and retrieve the particular encryption key;
in response to the request for the particular encryption key, receiving the particular encryption key from the key manager; and
using the particular encryption key to encrypt a message sent by a compute node in the plurality of compute nodes executing on the particular host computer.

2. The method of claim 1 , wherein:
the key policy is one of a set of key policies defined by the manager computer;
each encryption rule in the set of encryption rules provided by the server refers to one key policy in the set of key policies managed by the server; and
each key policy associated with a particular key identifier (KID) identifies an encryption key for encrypting data messages according to the corresponding encryption rule.

3. The method of claim 1 , wherein:
the key policy is one of a set of key policies defined by the manager computer;
each encryption rule in the set of encryption rules refers to one key policy that specifies a key identifier to identify an encryption key to use for the encryption rule; and
the key voucher is only generated for the particular host computer after the server determines that the particular host computer will have at least one encryption rule that will refer to a key policy.

4. The method of claim 1 , wherein the server provides the set of encryption rules to each of a set of two or more host computers separately from key vouchers that the server provides to the set of host computers in order to ensure that each individual host computer only has access to key vouchers (i) that are generated for the individual host computer by the server, and (ii) that are associated with a group of encryption rules that the server determines to be applicable to the individual host computer.

5. The method of claim 1 , wherein whether the particular key policy applies to the set of virtualization software executed by the particular host computer is determined based on a set of encryption rules provided by the server, each encryption rule in the set of encryption rules referring to one key policy in a set of key policies.

6. The method of claim 5 , wherein:
each respective encryption rule in the set of encryption rules is applied to a respective
a respective key policy applies to a respective host computer if at least one encryption rule referring to the respective key policy is applied to the respective host computer.

7. The method of claim 2 , wherein each key policy in the set of key policies comprises (i) a key manager specification identifying a particular key manager from which to retrieve the encryption key identified by the key policy, (ii) a key algorithm specification specifying an encryption algorithm for the encryption key identified by the key policy, (iii) a key strength specification specifying a number of bits for the encryption key identified by the key policy, and (iv) a key rotation specification specifying how frequently a new encryption key should be automatically or manually retrieved.

8. The method of claim 1 , wherein the key voucher further comprises a virtualization software ID identifying the set of virtualization software executed by the particular host computer, an expiry parameter identifying when the particular encryption key is to expire, and a controller signature identifying a server at which the key voucher was generated.

9. The method of claim 8 , wherein the request for the particular encryption key further comprises a requested key algorithm and a requested key length.

10. The method of claim 9 , wherein:
if the key manager does not store the particular encryption key identified by the request, the key manager (i) generates the particular encryption key for the request, (ii) returns the generated particular encryption key, and (iii) stores the generated particular encryption key; and
if the key manager stores the particular encryption key identified by the request, the key manager returns the stored particular encryption key.

11. The method of claim 10 , wherein the key manager returns the particular encryption key by verifying (i) the expiry parameter to determine whether the particular encryption key is expired and (ii) the controller signature.

12. The method of claim 1 , wherein at least a set of host computers in the plurality of host computers receive key vouchers identifying a same encryption key to be retrieved by each of the host computers in the set of host computers, said same encryption key allowing for secure communication between the set of host computers.

13. The method of claim 12 , wherein:
each of the host computers in the set of host computers executes at least one CN; and
the set of host computers use the same encryption key for CN-to-CN communication.

14. A non-transitory machine-readable medium storing a program for execution by at least one processing unit of a particular host computer that executes (i) virtualization software and (ii) a plurality of compute nodes, the program for providing encryption services in a system comprising a plurality of host computers, the program comprising sets of instructions for:
receiving, from a server that is external to the particular host computer and provides a set of encryption rules for encrypting messages on the particular host computer, a key voucher generated by the server based on a key policy defined by a manager computer that manages the plurality of host computers, the key voucher comprising a set of identifiers for identifying (i) the particular host computer and (ii) a particular encryption key associated with the particular host computer, wherein the key voucher is only generated for the particular host computer if the key policy applies to the virtualization software executed by the particular host computer;
sending a request for the particular encryption key to a key manager that is external to the particular host computer and separate from the server, said request comprising the key voucher, wherein the key manager uses the identifiers of the key voucher to authenticate the particular host computer as an authorized key requestor and retrieve the particular encryption key;
in response to the request for the particular encryption key, receiving the particular encryption key from the key manager; and
using the particular encryption key to encrypt a message sent by a compute node in the plurality of compute nodes executing on the particular host

Assignees

• Nicira Inc

Inventors

• Jahid Sonia
• Chandrashekhar Ganesan
• Qian Bin
• Feroz Azeem

Classifications

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title