Client-Controlled Encryption Key Hierarchy for Distributed Database Availability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managed databases face challenges in efficiently operating with encrypted data, particularly when clients control encryption keys, as existing solutions struggle to maintain data durability and availability during key revocation and storage node failures.
Innovation Solution
A distributed database system employs a hierarchy of encryption keys where the client master encryption key is controlled by the client, allowing authorization management and revocation, with mechanisms for detecting status changes and ensuring data availability through replication and backup processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the client controls the master encryption key for enhanced security, then data security is improved, but the database cannot operate background services like snapshots and backups after key revocation
Solution Approach 1:
The encryption key hierarchy is segmented into multiple levels: client master encryption key at the top, table encryption keys in the middle, and row encryption keys at the bottom. This segmentation allows the system to maintain security through client-controlled master keys while enabling independent operation of individual table encryption keys for background services even after master key revocation.
Solution Approach 2:
The system performs preliminary actions by creating and storing table encryption keys and encrypted data before the master encryption key is revoked. These pre-established encryption layers remain valid and functional after revocation, allowing background services to continue operating with the previously established encryption infrastructure.
2Adaptability or versatility
If the master encryption key is revoked to enhance security control, then authorization management is improved, but data availability is worsened as the database cannot access encrypted data
Solution Approach 1:
The encryption architecture is segmented so that table encryption keys are derived from but independent of the master encryption key. When the master key is revoked, the segmentation allows table encryption keys to remain functional for data access, while the revocation affects only new key derivation operations, thus maintaining data availability while enforcing authorization control.
Solution Approach 2:
The system creates copies of encryption functionality through the key hierarchy structure. Table encryption keys serve as functional copies that can operate independently after master key revocation, allowing data access to continue while the master key's authorization control is enforced for new operations.
3Reliability
If encryption is implemented to protect data, then data security is improved, but database operation efficiency is worsened due to additional encryption/decryption overhead
Solution Approach 1:
Encryption operations are segmented and distributed across multiple key levels. The hierarchy allows encryption to occur at different granularities (table-level and row-level), which optimizes performance by avoiding full data re-encryption while maintaining security through layered encryption validation.
Solution Approach 2:
Encryption keys and encrypted data structures are established in advance during table creation and data insertion. This preliminary encryption setup eliminates the need for repeated full-data encryption operations during normal database operations, reducing overhead while maintaining security through the pre-established encryption framework.
Data Source
AI summary
A distributed database encrypts tables using table encryption keys protected by a client master encryption key. The client may revoke and subsequently restore authorization to access the client master encryption key. A sweeper process of the distributed database examines encrypted tables and identifies changes to the status of a corresponding client master encryption key. A response to an identified change in status is initiated.