Distributed Encryption Keys for Cloud Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current industry solutions for key synchronization of cryptographic keys across multiple cloud availability zones in cloud environments, such as OpenStack, do not scale effectively, leading to inconsistencies and latency issues when users access services across different zones, as replication services can fail and sensitive data encryption becomes problematic.
Innovation Solution
A method for distributing encryption keys involves the storage system receiving an access request with a token containing a payload and a current user cryptographic key, authenticating the user, updating the cryptographic key in the keystore, and sending the token with the current key to the storage system, allowing seamless access across availability zones without relying on synchronization between keystores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Stability of the object's composition
If traditional replication services are used to synchronize cryptographic keys across availability zones, then key consistency can be achieved, but system reliability deteriorates due to replication link failures and latency issues
Solution Approach 1:
The patent extracts the cryptographic key from the centralized keystore and embeds it directly into the authentication token. This eliminates the need for replication services to synchronize keys across availability zones, as each zone can independently validate tokens containing the embedded keys, thus resolving the contradiction between key consistency and system reliability
Solution Approach 2:
The token serves as an intermediary that carries the cryptographic key from the identity service to the storage system across availability zones. Instead of relying on replication links between keystores, the token mediates the key distribution, allowing seamless access without synchronization issues
2Stability of the object's composition
If replication services are deployed to synchronize keystores across availability zones, then key synchronization is achieved, but device complexity increases due to additional infrastructure requirements
Solution Approach 1:
The patent removes the need for complex replication infrastructure by extracting the cryptographic key from the centralized keystore and embedding it directly in tokens. This eliminates the entire replication service layer, including replication links, synchronization protocols, and associated infrastructure, thereby reducing device complexity while maintaining key synchronization
Solution Approach 2:
Instead of maintaining live replication links between keystores, the patent creates a copy of the cryptographic key and embeds it within each token. This copy mechanism is simpler than replication services, as it requires no ongoing synchronization infrastructure, thus reducing device complexity while achieving key consistency
3Stability of the object's composition
If centralized keystore synchronization is implemented across availability zones, then key consistency improves, but access speed deteriorates due to synchronization latency
Solution Approach 1:
The patent performs preliminary action by embedding the cryptographic key into the token during the authentication phase at the identity service. This pre-loading of the key eliminates the need for real-time synchronization during data access operations, thereby improving access speed while maintaining key consistency across availability zones
Solution Approach 2:
By extracting the cryptographic key from the centralized keystore and embedding it in the token, the patent eliminates the need for synchronous key lookup operations during data access. The key is already present in the token, removing synchronization latency and improving access speed
Data Source
AI summary
Authentication of tokens and associated are used to provide a just-in-time key synchronization for user access to a service in a cloud computing environment which includes a plurality of availability zones with an identity service, a storage system, and a keystore. The encryption keys are distributed by the storage system based on a user access request containing a token with a payload and a current user cryptographic key. The token is then sent to the keystore to authenticate the user. The keystore authenticates the user and sends the token with the current cryptographic key to the storage system. The storage system receives the token with the current cryptographic key and grants access to the user for the service.