Abstract: Aspects of the disclosure generate independent encryption keys for objects (e.g., virtual machine disks (VMDKs)) without requiring the management of multiple keys. An encryption manager obtains a primary encryption key, an object identifier (ID) comprising a globally unique ID (GUID) for an object, a data salt comprising the object ID and a data salt string, and a metadata salt comprising the object ID and a metadata salt string. A data encryption key is generated using the primary encryption key, the data salt, and a one-way function. A metadata encryption key is generated using the primary encryption key, the metadata salt, and the one-way function. Because the data salt string and metadata salt string differ, the data encryption and metadata encryption keys differ. Object IDs for different objects differ, so each object and its metadata have globally unique keys. Key generation (other than the primary key) is deterministic, simplifying key management.

Abstract: An example method for a first host, being an owner of an object stored in a virtual storage area network (vSAN) cluster, to perform encryption and decryption operations during a rekey in the vSAN cluster is disclosed. The method includes obtaining a first encryption key and a first key identifier (ID) of the first encryption key; transmitting the first key ID and an active key index to a second host; using the first encryption key to perform encryption and decryption operations; and in response to a determination of receiving a key change notification from a master node of the vSAN cluster, terminating a connection with the second host.

Abstract: An example method for a first host, being an owner of an object stored in a virtual storage area network (vSAN) cluster, to perform encryption and decryption operations during a rekey in the vSAN cluster is disclosed. The method includes obtaining a first encryption key and a first key identifier (ID) of the first encryption key; transmitting the first key ID and an active key index to a second host; using the first encryption key to perform encryption and decryption operations; and in response to a determination of receiving a key change notification from a master node of the vSAN cluster, terminating a connection with the second host.