Dynamic Crypto Key Management for Cloud Mobility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, managing and updating encryption keys can cause service interruptions and incur excessive costs due to frequent key upgrades and the need for agile compliance with changing policies and standards, especially when relying on Hardware Security Modules (HSMs) that charge per access.
Innovation Solution
Implementing a dynamic encryption key management system that uses a master tenant key from a cloud-based key vault to securely manage other keys, reducing the need for frequent access to HSMs and minimizing costs by storing keys in a layered approach with multiple levels of abstraction, allowing for efficient key generation, encryption, and provisioning across enrollment servers and devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored in a key vault and frequently upgraded to maintain security compliance, then security compliance is improved, but service interruption time increases and system availability deteriorates
Solution Approach 1:
The system performs preliminary key generation and validation actions before actual key rotation is needed. Validation keys are pre-generated and stored in the key vault, allowing the system to quickly switch to backup keys if compromise is detected, minimizing service interruption time while maintaining security compliance.
Solution Approach 2:
The patent introduces validation keys as an intermediary mechanism between the primary encryption keys and the key management process. These validation keys enable secure verification and rotation without requiring direct manipulation of the primary keys, thereby reducing service disruption while maintaining security standards.
2Reliability
If Hardware Security Modules (HSMs) are used to securely manage encryption keys, then security is improved, but access costs increase due to per-access charging
Solution Approach 1:
The system extracts the most critical security functions from frequent HSM accesses. By pre-generating validation keys and storing them in the key vault, the system minimizes the number of expensive HSM accesses required, keeping only essential key operations within the HSM while performing other operations locally.
Solution Approach 2:
The patent employs short-lived validation keys that can be generated and discarded more economically than permanent encryption keys. These temporary validation keys handle frequent operations that would otherwise require expensive HSM accesses, reducing overall cost while maintaining security through their limited lifespan and scope.
3Reliability
If encryption keys are frequently rotated and upgraded, then security compliance is improved, but system complexity increases due to key management overhead
Solution Approach 1:
The key management system is segmented into distinct components: primary encryption keys stored securely, validation keys stored in the key vault, and local key caching mechanisms. This segmentation allows each component to be managed independently with appropriate security measures, reducing overall management complexity while maintaining compliance.
Solution Approach 2:
The system changes the parameters of key management by introducing validation keys with different properties than primary keys - shorter lifespan, different storage location, and different usage patterns. This parameter differentiation simplifies management by allowing automated policies to be applied based on key type and lifecycle stage.
Data Source
AI summary
Aspects of the disclosure relate to dynamic crypto key management for mobility in a cloud environment. A computing platform may receive a request to generate a new tenant master key and a new server recovery key. Subsequently, the computing platform may send to a cloud-based key vault server, the new tenant master key and the new server recovery key. The computing platform may send to a tenant database, the encrypted server recovery key. As a result, the computing platform may provision the enrollment servers with the encrypted server recovery key. In some embodiments, the enrollment servers are configured to manage enrollment of policy-managed devices in a policy enforcement scheme and to authenticate with the key update service based on the encrypted server recovery key.