Cryptographic Key High Availability via Shared Master Key Failover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face challenges in maintaining high availability and security of cryptographic keys, particularly during failover events, as current methods often require synchronization and may lead to interruptions or inconsistencies in key management.
Innovation Solution
A computer system that uses a shared file system with a key database, where cryptographic keys are encrypted with a shareable master key and stored with message authentication codes to ensure integrity, and a failover mechanism that transfers a common virtual address between master key managers, ensuring uninterrupted availability and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure key managers are synchronized with failover schemes, then key security is improved, but key availability deteriorates due to time-outs and synchronization requirements
Solution Approach 1:
The patent pre-distributes cryptographic keys to multiple key managers before any failure occurs. Each key manager receives a copy of the keys in advance, so when failover is needed, the system can immediately switch to a backup key manager without waiting for key distribution or synchronization. This eliminates the time-out problem while maintaining security through distributed redundancy.
Solution Approach 2:
The patent creates and distributes copies of cryptographic keys to multiple key managers across the system. Instead of relying on a single master key manager, the system maintains identical key copies at multiple locations, allowing immediate failover to any available key manager without synchronization delays or security compromises.
2Reliability
If multiple key managers are deployed with failover schemes, then key availability is improved, but system complexity increases due to synchronization requirements
Solution Approach 1:
The patent simplifies the multi-key-manager system by distributing identical key copies to all key managers rather than requiring complex synchronization protocols. Each key manager operates independently with the same keys, eliminating the need for continuous synchronization while maintaining high availability through simple failover capability.
3Device complexity
If key managers operate independently without synchronization, then system complexity is reduced, but key consistency deteriorates
Solution Approach 1:
The patent establishes key consistency through preliminary distribution of identical key copies to all key managers before they operate independently. Since all key managers receive the same keys in advance through secure distribution channels, they maintain consistency without requiring ongoing synchronization, achieving both simplicity and reliability.
Data Source
AI summary
Shared file systems and methods ensuring high availability of cryptographic keys. The keys are encrypted with at least one shareable master key to generate corresponding encrypted cryptographic keys, which are stored in a key database in the shared file system. A master key manager with access to the key database is elected from among master key manager candidates and is assigned a common virtual address. All master key manager candidates have the shareable master key such that during a failover event the availability of the encrypted cryptographic keys is not interrupted as a new master key manager takes over the common virtual address from the previous master key manager. Additionally, a message authentication code (MAC) is deployed for testing the integrity of keys during their retrieval.