Encryption Key Management for Data Residency

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current systems for managing encryption keys and data residency in group-based communication systems require separate systems in each geopolitical area, leading to inefficiencies and duplicated resources, as they need to balance data storage compliance with encryption for privacy.

Innovation Solution

A method that allows for the storage and retrieval of encrypted messages in arbitrary geopolitical areas using customer-managed encryption keys, with a central access point for coordination, enabling encryption key management across different regions while maintaining data residency compliance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If separate systems are implemented in each geopolitical area to maintain data residency compliance, then data privacy and regulatory compliance are improved, but system complexity and resource duplication increase

Engineering Contradiction:
Improvedata privacy complianceVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system is segmented into geographically distributed key servers and data stores, where each component operates independently in its designated geopolitical area. Key servers in different regions (e.g., US, EU, Asia) manage encryption keys locally, and data stores are similarly distributed. This segmentation allows each region to maintain data residency compliance while the overall system remains coordinated through standardized protocols, reducing the need for a single complex centralized system.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

A centralized coordination system acts as an intermediary between distributed key servers and data stores. This coordinator manages key lifecycle operations (generation, rotation, revocation) and directs encryption/decryption requests to appropriate regional components. The intermediary abstracts the complexity of distributed key management, allowing organizations to benefit from both centralized control and distributed compliance without implementing complex coordination logic in each regional system.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If data is stored in encrypted form with customer-managed keys, then data privacy is improved, but access complexity and retrieval time increase

Engineering Contradiction:
Improvedata privacyVSAvoidaccess time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

Encryption keys are pre-generated and stored in key servers located in the same geopolitical area as the data stores before any encryption or decryption operations occur. When data needs to be encrypted, the key is already available locally in the key server, eliminating the need for key generation or retrieval from remote locations. Similarly, decryption keys are pre-positioned in key caches at data access points, enabling rapid decryption without waiting for key retrieval from distant key servers.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

Key caches serve as intermediary components between key servers and data access points. These caches store frequently used decryption keys locally at the edge, close to where data retrieval operations occur. When a decryption request is made, the key cache checks for the required key locally before contacting the remote key server, significantly reducing access time for frequently accessed data while maintaining the security benefits of customer-managed keys.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3933606A1Encryption key management for international data residency
Publication Date: 2022.01.05 SALESFORCE INC
  • EP3933606A1 patent drawingFigure 1A
  • EP3933606A1 patent drawingFigure 1B
  • EP3933606A1 patent drawingFigure 2

AI summary

Media, method, and system for providing encryption key management for international data residency. Organizations using a group-based communication system can designate a particular geopolitical area where that organization's data can be stored and another geopolitical area (which may be the same or different) where encryption keys used to encrypt and decrypt that data should be stored. Users of that organization can post message or access messages previously posted on the group-based communication system from any geopolitical area, causing the system to automatically store and retrieve messages and encryption keys from the appropriate regions to allow the users to transparently access the group-based communication system while maintaining security and data residency requirements.