Centralized Key Rotation System for Database Tenants
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing the rotation of public and private encryption key pairs in a large-scale system is challenging due to the need for periodic changes to maintain security, especially in systems with a large number of users.
Innovation Solution
A system and method for centrally rotating private-public key pairs involve generating three separate key pairs for each tenant, storing the private keys in cloud-based storage, and uploading public keys to a global tenant directory, with a defined cadence for rotation, where the past key is discarded, the present key becomes the new past key, and a new future key is generated, ensuring keys are rotated at most once in 24 hours and spaced 30 days apart.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key pairs are rotated periodically to maintain security, then security is improved, but the complexity of managing key rotation increases
Solution Approach 1:
The system enables automated key rotation where the key management service automatically generates, distributes, and rotates encryption keys without manual intervention. The service monitors key expiration and performs rotation based on defined cadences, allowing the system to self-manage its security credentials
Solution Approach 2:
Future keys are generated in advance before they are needed. The system creates a rolling window of keys (past, present, future) so that when rotation is needed, the future key is already available for immediate activation, eliminating delays and ensuring continuous security
2Reliability
If all key pairs are rotated immediately to ensure security, then security is improved, but the time and resources required increase significantly
Solution Approach 1:
Instead of rotating all keys simultaneously, the system implements periodic rotation with a defined cadence. Keys are rotated at scheduled intervals (e.g., daily, weekly) based on their age and usage, distributing the rotation workload over time rather than requiring immediate rotation of all keys
Solution Approach 2:
Future keys are generated in advance, creating a ready-to-use rotation pipeline. This preliminary key generation ensures that when rotation occurs, it can be executed quickly without the overhead of generating keys during the rotation process itself
3Adaptability or versatility
If multiple key pairs are maintained for each tenant, then key rotation capability is improved, but the storage and management overhead increases
Solution Approach 1:
The key management system segments keys into distinct roles (past, present, future) within a structured hierarchy. Each tenant has an organized key collection with clearly defined segments, allowing efficient management and rotation of only the necessary keys at any given time rather than managing all keys uniformly
Data Source
AI summary
A system and method for rotating private encryption keys for tenants of a database system has been developed. First, three separate public-private encryption keys are generated for a tenant of the database system. The three separate private encryption keys for the tenant are then stored in cloud-based storage. A defined cadence is created to rotate the private encryption keys for the tenant. The three separate private encryption keys for the tenant are defined as a a past private key, a present private key and a future private key. Next, the public encryption key is stored for the tenant in a global tenant directory. The present private key and the public encryption key are retrieved to encrypt and decrypt data from the tenant. The three separate private encryption keys are rotated at the defined cadence, where the past private key is discarded, the present private key becomes a new past private key, the future private key becomes a new present private key, and a new future private key is generated. The new past private key, the new present private key and the new future private key for the tenant are then stored in cloud-based storage.