Distributed Encryption Management Across UCaaS Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing UCaaS platforms face challenges in managing and maintaining encryption keys across multiple communication channels, leading to disruptions and improper security protocols when changes occur, making encrypted content inaccessible or insecure.
Innovation Solution
Implementing a key broker server that dynamically allocates customer-controlled data encryption keys across various communication services within the UCaaS platform, using a bring-your-own-key framework and envelope encryption to ensure secure storage and access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If encryption keys are managed directly by the UCaaS platform, then security control is centralized, but customer control and onboarding flexibility are reduced
Solution Approach 1:
The patent introduces a key management service as an intermediary layer between customers and the key management servers. This service provides a standardized interface that customers interact with, while the complex key management operations are handled by the service itself. The intermediary abstracts the complexity from customers, giving them control without requiring them to understand or manage the underlying key infrastructure directly.
Solution Approach 2:
The key management system is segmented into distinct components: key management servers that generate and store keys, a key management service that handles allocation and distribution, and customer applications that consume keys through the service interface. This segmentation allows each component to be optimized independently and enables customers to control their keys through the service without managing the entire infrastructure.
2Reliability
If key management servers are changed or updated, then system improvements can be made, but encrypted content becomes inaccessible or security protocols are compromised
Solution Approach 1:
The key management service maintains continuous operation and key availability even when underlying key management servers are updated or changed. The service abstracts the server layer, allowing server infrastructure to evolve while the service interface and key distribution functionality remain stable and continuous, preventing disruptions to encrypted content access.
Solution Approach 2:
The key management service acts as a buffer between applications and key management servers. When servers are updated or replaced, the intermediary service absorbs the changes and maintains consistent key distribution, ensuring that security protocols remain stable and encrypted content remains accessible throughout the transition.
3Reliability
If multiple key management servers are used for redundancy, then system availability improves, but key allocation complexity and management overhead increase
Solution Approach 1:
Multiple key management servers are merged into a unified key management service interface. The service manages the fleet of servers as a single resource pool, automatically allocating keys from appropriate servers based on customer needs. This merging hides the multiplicity of servers from customers and simplifies key allocation while maintaining the redundancy and availability benefits of having multiple servers.
Solution Approach 2:
The key management service provides a universal interface that works with multiple different key management servers. A single service handles key allocation, management, and distribution across the entire server fleet, making the system adaptable to different server configurations and enabling seamless load balancing and failover without increasing customer-facing complexity.
4Speed
If plaintext keys are stored for quick access, then decryption speed improves, but security risks increase
Solution Approach 1:
The key management service acts as a secure intermediary that manages plaintext key storage and distribution. Rather than applications storing keys locally, the service maintains secure custody of plaintext keys and provides them temporarily during decryption operations. This intermediary approach enables fast decryption when keys are needed while centralizing security controls to minimize exposure risks.
Solution Approach 2:
The system dynamically changes the state of encryption keys based on operational needs. Keys are encrypted at rest for security, then temporarily decrypted to plaintext only when actively needed for decryption operations, and immediately re-encrypted or deleted afterward. This parameter change strategy maintains security while enabling fast access during legitimate operations.
Data Source
AI summary
Customers of a software platform, such as a unified communications as a service platform, are enabled to control their own encryption keys used to encrypt and decrypt data from various communication services in the software platform. A key broker server is employed to map encryption and decryption requests from servers in the platform to key management servers of customers based on user identifiers. Examples of data encrypted may include conference recordings, webinar recordings, phone call recordings, voicemails, emails, and calendar tokens.