Authenticating key-value data pairs for protecting node related data

A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable and/or executable by a computer to cause the computer to:

• use, by the computer, a first symmetric key to encrypt a second symmetric key,
• wherein the first symmetric key is securely loaded inside a hardware security module (HSM) by a key management service before the encryption of the second symmetric key,
• wherein a cloud provider only has access to encrypted bits of the first symmetric key;
• wherein key data of a key-value-pair of the second symmetric key is used as additional authenticated data (AAD) for the encryption of the second symmetric key;
• use, by the computer, the second symmetric key to encrypt value data of the key-value-pair;
• and
• store, by the computer, the encrypted second symmetric key, the AAD used in the encryption of the second symmetric key, and tag bits created during the encryption of the second symmetric key, to thereafter use for verifying node related data.

A system, comprising:

• a hardware processor;
• and
• logic integrated with the hardware processor, executable by the hardware processor, or integrated with and executable by the hardware processor, the logic being configured to:
• use a first symmetric key to encrypt a second symmetric key,
• wherein the first symmetric key is securely loaded inside a hardware security module (HSM) by a key management service before the encryption of the second symmetric key,
• wherein securely loading the first symmetric key inside the HSM by the key management service before the encryption of the second symmetric key includes:
• loading an encrypted instance key encryption key (IKEK) of a database to the HSM;
• using a master key encryption key (MKEK) of the HSM to decrypt the encrypted IKEK in the HSM;
• loading the first symmetric key to the HSM from the database, wherein the first symmetric key is encrypted in the database;
• and
• using the decrypted IKEK to decrypt the encrypted first symmetric key,
• wherein a cloud provider only has access to encrypted bits of the first symmetric key;
• wherein key data of a key-value-pair of the second symmetric key is used as additional authenticated data (AAD) for the encryption of the second symmetric key;
• use the second symmetric key to encrypt value data of the key-value-pair;
• and
• store the encrypted second symmetric key, the AAD used in the encryption of the second symmetric key, and tag bits created during the encryption of the second symmetric key, to thereafter use for verifying node related data.