External KMS Key Protection Framework for Secure Key Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database management platforms lack flexibility and security in key management, particularly when a single administrator manages both the database and application layers, exposing encrypted data and cryptographic keys to potential compromise.
Innovation Solution
A key protection framework that includes a key protection engine and a key rotation sensor thread, allowing customers to select their preferred external Key Management System (KMS) and encryption service, encrypting configurations, and automatically re-encrypting cryptographic keys upon detection of master key changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a common administrator manages both database layer and application layer, then ease of operation is improved, but security is worsened due to potential compromise of both cryptographic key and encrypted data
Solution Approach 1:
The patent divides the administrator roles into two separate entities: a database administrator (DBA) who manages the database layer and an application administrator who manages the application layer. This segmentation ensures that no single administrator has access to both the cryptographic key and the encrypted data, thereby maintaining security while simplifying operational management through clear role separation.
Solution Approach 2:
The patent extracts the cryptographic key management from the database layer and places it in the application layer. The cryptographic key is stored separately in the application layer's database, while the encrypted data remains in the database layer. This extraction prevents a single point of compromise and enhances security.
2Adaptability or versatility
If external key management system is integrated, then adaptability is improved, but device complexity is worsened due to additional system integration requirements
Solution Approach 1:
The patent implements a universal key management interface that can work with multiple external key management systems (KMS) from different vendors. The application administrator can select from various KMS options (e.g., AWS KMS, Azure Key Vault, Google Cloud KMS) through a standardized interface, providing adaptability and flexibility without requiring separate integration code for each KMS provider.
Solution Approach 2:
The patent introduces an intermediary component that sits between the application layer and external key management systems. This intermediary handles the complexity of KMS integration, providing a simplified interface for key operations while managing the underlying system complexity. The intermediary abstracts the differences between various KMS providers and presents a unified interface to the application administrator.
Data Source
AI summary
A key protection framework for a platform includes a key protection engine for interfacing between an external key management system (KMS) and an external encryption service. A customer of the platform can select an existing external KMS and external encryption service to use with the framework. The key protection engine can onboard the external KMS with the platform by obtaining a configuration for the external KMS. Information extracted from the configuration can be used to establish a connection between the key protection engine and the external KMS, via which the key protection engine can interface with the external KMS to initiate rotation of a cryptographic key at the external KMS. Responsive to detection of a new version of a master key, the key protection engine can transmit a request to the external KMS to re-encrypt the cryptographic key with the new version of the master key.