Distributed Database Client-Controlled Encryption Key Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managed databases face challenges in efficiently operating with encrypted data, particularly when clients control encryption keys, as existing systems struggle to maintain data durability and availability during key revocation and storage node failures.
Innovation Solution
A distributed database system employs a hierarchy of encryption keys where the client master encryption key is controlled by the client, allowing authorization management and revocation, with mechanisms for detecting status changes and ensuring data availability through replication and backup processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the client controls the master encryption key for enhanced security, then data security is improved, but the database system cannot operate efficiently when the key is revoked or lost
Solution Approach 1:
The encryption key hierarchy is segmented into multiple levels: client master encryption key at the top, table encryption keys at intermediate levels, and data encryption keys at the data level. This segmentation allows the system to maintain security through client-controlled master keys while enabling operational continuity through independently manageable lower-level keys that can be regenerated without client intervention.
Solution Approach 2:
The system performs preliminary actions by pre-generating and storing backup encryption keys and establishing key regeneration mechanisms before key revocation or loss occurs. When the client master encryption key is revoked or lost, the database system can immediately use pre-prepared backup keys or regenerate table encryption keys without requiring client action, thus maintaining operational efficiency.
2Reliability
If the database system stores encrypted data with client-controlled keys, then data durability is improved, but key revocation causes service interruption
Solution Approach 1:
The system introduces intermediary components including backup encryption keys and key management services that act as mediators between the client-controlled master encryption key and the encrypted data. When the master key is revoked, these intermediaries enable continuous data access and durability without service interruption by providing alternative key access paths.
Solution Approach 2:
The system changes key management parameters dynamically: it transitions from single-master-key dependency to multi-key redundancy, and from static key usage to dynamic key regeneration. These parameter changes enable the system to maintain data durability while adapting to key revocation events without service interruption.
3Ease of operation
If a single encryption key is used for simplicity, then ease of operation is improved, but security control and key revocation management become difficult
Solution Approach 1:
The encryption key system is segmented into hierarchical levels with distinct responsibilities: client master encryption keys for security control and revocation management, table encryption keys for data organization, and data encryption keys for actual encryption. This segmentation provides both security control flexibility and operational simplicity by allowing each level to be managed independently according to its specific requirements.
Solution Approach 2:
The encryption key hierarchy serves multiple functions simultaneously: it provides security control through client master keys, enables efficient data access through table-level keys, and supports key revocation through backup key mechanisms. This multi-functionality achieves both ease of operation and adaptability by consolidating multiple key management needs into a unified hierarchical system.
Data Source
AI summary
A distributed database encrypts tables using table encryption keys protected by a client master encryption key. The client may revoke authorization to access the client master encryption key. Subsequent to a revocation of authority to access the client master encryption key, the distributed database generates interim snapshots of the table using the table encryption key. Also subsequent to the revocation, the distributed database generates a backup of the table using a backup encryption key protected by the client master encryption key.