Distribution and update of keys
AssigneeNVIDIA Corporation
InventorScott Wilson
Life of this patent
Estimating the term…
Abstract
Cluster storage systems (100) and methods provide secure generation, distribution, and update of encryption keys (132, 142) during initial cluster formation and cluster membership changes without using readable persistent media. A cryptographic coprocessor (130) stores a key encryption key (132) in write-only memory and uses the unreadable key (132) for encryption and decryption of a data encryption key (142). Methods to securely distribute the initial or updated the key (132) to be stored in the coprocessor (130) and securely update the key (132) when cluster membership changes are provided.
Claims20
A secure storage system, comprising:
- persistent storage storing encrypted data that was encrypted using a first key and storing an encrypted key;
- and
- a processing unit controlling writes and reads to the persistent storage, the processing unit comprising:
- a volatile memory to store the first key;
- and
- a cryptographic coprocessor, wherein the cryptographic coprocessor comprises:
- an unreadable memory separate from the persistent storage and accessible by the cryptographic coprocessor in the processing unit and storing a second key;
- and
- a decryption module configured to perform a decrypt operation using the second key, wherein performing the decryption operation using the second key on the encrypted key produces the first key.
A process for operating a cluster storage system, the process comprising:
- storing in persistent storage devices of a plurality of storage nodes of the cluster storage system encrypted data that was encrypted using a first key;
- storing an encrypted key in each of the persistent storage devices, the encrypted key resulting from encryption of the first key through an encryption process using a second key;
- storing a second key in unreadable memory in each of a plurality of processing units that control the persistent storage devices, each unreadable memory being separate from the persistent storage devices and accessible by a cryptographic coprocessor in the processing unit that contains the unreadable memory and being inaccessible outside of the cryptographic coprocessor;
- operating the cryptographic coprocessors to use the second key to decrypt the encrypted key, producing the first key;
- storing the first key in volatile memory of each of the processing units;
- and
- operating each of the processing units to read encrypted data from the persistent storage device the processing unit controls and to perform a cryptographic operation using the first key to provide data to a storage user.
A processing unit comprising one or more logical units to read encrypted data from a persistent storage device separate from the processing unit by decrypting encrypted data with a first key, the first key being decrypted from an encrypted key with a second key, the encrypted key resulting from an encryption of the first key through an encryption process using a second key, the first key being stored in a volatile memory, and the second key being stored in an unreadable memory accessible only by a cryptographic coprocessor on the processing unit.
Dependencies are inferred from the claim text.