HIERARCHICAL KEY MANAGEMENT FOR CROSS-REGION REPLICATION

Smart overview of the Invention

The application describes a novel method for hierarchical key management in cross-region file storage replication within cloud infrastructures. This system utilizes a three-key architecture to ensure secure data transfer and storage across different cloud regions. The keys include a source region security key, a session key for data transfer, and a target region security key. Each region employs unique file keys for different files within its file system, enhancing security and management flexibility.

Key Management Process

The process begins with generating a security key for the source file system, which encrypts and decrypts file keys within that system. A session key is also generated for encrypting data during its transfer between regions, valid only for the duration of the session. The target file system has a separate security key for managing its file keys. These keys are derived from distinct master keys, ensuring that each region maintains its security protocol independently.

Replication and Security

During replication, snapshot deltas—changes detected between two snapshots—are transferred from the source to the target region. These deltas are encrypted with the session key before being sent to an object storage, which then forwards them to the target system. The session key is shared between the control planes of both file systems, ensuring secure data handling throughout the replication process. Each file in both source and target systems is associated with a specific file key for data encryption.

Authentication and Unique Identification

The system includes authentication measures for key requesters in both source and target file systems. This involves verifying identification numbers associated with the replication process and the respective file systems. The session key is linked to a globally unique resource identification, ensuring that each replication session is distinct and securely managed.

Technical Components

Several technical components are integral to the system. A replicator fleet manages the uploading and downloading of deltas, while a delta generator extracts and applies these changes. A shared database facilitates communication between different system components, and a file system communicator manages file operations. These elements work in tandem to ensure efficient and secure cross-region replication.