Key Encryption Key Caching Across Multi-Device Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in minimizing the number of key encryption keys (KEKs) while ensuring data security and avoiding data loss, particularly in multi-node environments where key management and security consume significant resources.
Innovation Solution
Implementing a system where each computing device maintains a local cache of KEKs and interacts independently with a key management computing device to create and manage KEKs, ensuring only one active KEK per entity, and using pre-active KEKs when needed, with caching and efficient key rotation strategies to minimize network traffic and key usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple KEKs are created for each entity to ensure data security and availability, then data security and decryption capability are improved, but the number of keys to manage increases and resource consumption increases
Solution Approach 1:
The system creates pre-active KEKs in advance before they are needed. When a computing device needs a KEK for an entity, it checks if a pre-active KEK already exists. If not, the system creates one and activates it, ensuring availability without requiring multiple active keys simultaneously. This preliminary preparation reduces the need for multiple KEKs while maintaining security and decryption capability.
2Adaptability or versatility
If multiple computing devices independently manage KEKs, then key management flexibility and availability are improved, but network traffic and key management overhead increase
Solution Approach 1:
Each computing device independently manages its own KEK cache and activation process. When a device needs a KEK, it first checks its local cache. If the KEK is not available locally, the device independently requests creation and activation from the key management service. This self-service approach eliminates the need for coordination between multiple devices, reducing network traffic while maintaining flexible key management.
3Ease of manufacture
If KEKs are created on-demand without pre-active keys, then key creation simplicity is maintained, but key acquisition time and system response time increase
Solution Approach 1:
The system pre-creates KEKs and maintains them in a pre-active state ready for immediate activation. When a computing device requests a KEK, if a pre-active KEK already exists, the system can quickly activate and provide it without requiring time-consuming key generation. This preliminary action significantly reduces key acquisition time while maintaining the simplicity of on-demand key creation through a single standardized API call.
Data Source
AI summary
In some examples, a first computing device of a plurality of computing devices may send, to a key management (KM) device, a request for information related to at least one of an active key encryption key (KEK) or a pre-active KEK associated with an entity. The first computing device may receive, from the KM device, an indication that the KM device does not have an active KEK or pre-active KEK. In response, the first computing device may send an instruction to the KM device for creation of a pre-active KEK for the entity. Based on subsequently determining that there are a plurality of pre-active KEKs for the entity available from the KM device, the first computing device may send an instruction to the KM device to activate the pre-active KEK having an earliest creation time, and the first computing device may receive an active KEK for the entity.