Distributed Cryptographic Key Pool Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed cloud storage systems, accessing encrypted data is delayed when a single Key Management Service (KMS) is unavailable, as users cannot retrieve cryptographic keys backed by multiple KMS regions simultaneously.
Innovation Solution
A distributed cryptosystem that maintains a pool of encryption materials, periodically evaluates their health, and uses a robust refreshment regime to generate and encrypt data keys across multiple KMS regions, ensuring encryption and decryption operations can proceed even if one KMS fails, by requiring a minimum quorum of CMKs for data key encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are backed by multiple KMS regions for fault tolerance, then system reliability is improved, but access latency increases when a single KMS is unavailable
Solution Approach 1:
The system pre-generates data encryption keys and encrypts them with multiple customer master keys from different KMS regions before storing them. This preliminary action ensures that when decryption is needed, the system can immediately use the pre-prepared encrypted keys without waiting for cross-region KMS operations, thus maintaining fault tolerance while reducing access latency.
Solution Approach 2:
The cryptographic key management is segmented across multiple independent KMS regions, each holding a portion of the key material. The data encryption key is split and encrypted by different CMKs from different regions, allowing the system to retrieve decryption capability from any single available region rather than requiring all regions to be accessible.
2Device complexity
If a single KMS is used for cryptographic operations, then system complexity is reduced, but availability decreases when that KMS becomes unavailable
Solution Approach 1:
The system creates a universal encryption scheme where data encryption keys are encrypted by multiple customer master keys from different KMS regions. This multi-functional approach allows the same encrypted data key to be decrypted by any one of multiple KMS regions, providing service availability across different geographic locations without requiring complex regional key management policies.
3Reliability
If cryptographic operations wait for all KMS regions to be available, then key security is improved, but operational speed decreases
Solution Approach 1:
The system uses a quorum-based approach where decryption can proceed with keys from a minimum number of KMS regions rather than requiring all regions. This partial action approach maintains security by using multiple key sources while improving productivity by not waiting for all regions to be available, allowing operations to complete as long as the required quorum is met.
Data Source
AI summary
The present invention relates to a computer implemented method, software product and computer system for managing a cryptographic service. The computer implemented method comprises: establishing a pool of encryption materials; periodically updating the pool of encryption materials; and responsive to an encryption request from an encrypting application: selecting encryption materials from the pool; encrypting payload data included in the encryption request using the selected encryption materials; and returning encrypted payload data to the encrypting application.