Multi-Tenant Key Encryption Key Rotation Without Downtime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant computing environments, key rotation for encryption keys (KEKs) often results in undesirable downtime, as conventional methods require decryption and re-encryption of Data Encryption Keys (DEKs), disrupting service operations and being prohibitive for business-critical applications.
Innovation Solution
A method that allows for the rotation of a Key Encryption Key (KEK) without downtime by encrypting a new KEK using the existing KEK, caching decrypted DEKs in secure local memory, and re-encrypting them with the new KEK, maintaining accessibility and minimizing service disruption through batch processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional key rotation methods are used to change the KEK, then the encryption key is successfully rotated, but service downtime occurs and operations are disrupted
Solution Approach 1:
The patent applies preliminary action by pre-generating the new KEK and encrypting it with the existing KEK before the rotation is needed. The encrypted new KEK is stored in the data store in advance, so when rotation is required, the system can seamlessly switch to the pre-prepared new KEK without interruption to service operations.
Solution Approach 2:
The patent uses an intermediary approach by maintaining both the old KEK and the encrypted new KEK in the system simultaneously during the transition period. The system can decrypt data with the old KEK while also having the new KEK ready (encrypted with the old one), allowing seamless handover without service disruption.
2Reliability
If the KEK is rotated by decrypting and re-encrypting DEKs, then the new KEK is implemented, but service operations are interrupted
Solution Approach 1:
The system performs preliminary encryption of the new KEK with the existing KEK and stores it in advance. This pre-preparation eliminates the need for time-consuming decryption and re-encryption operations during actual key rotation, maintaining high service operation efficiency while ensuring reliable key updates.
3Reliability
If conventional key rotation is performed, then the encryption key is updated, but system downtime is required
Solution Approach 1:
The new KEK is generated and encrypted with the existing KEK in advance, and the encrypted version is stored in the data store before rotation is needed. This preliminary preparation ensures that when key rotation is triggered, the system can immediately switch to the pre-prepared new KEK without requiring system downtime, thus maintaining both key security and continuous system availability.
Solution Approach 2:
The system maintains continuous availability by keeping the encrypted new KEK ready in the data store, allowing the key rotation process to occur without interrupting service operations. The useful action of key management continues uninterrupted throughout the rotation process.
Data Source
AI summary
An example method facilitates enabling Key Encryption Key (KEK) rotation for a running multi-tenant system without requiring system downtime or interruption. The example method facilitates decrypting a set of one or more DEKs using a preexisting KEK; using a new KEK to re-encode the DEKs using the new KEK, all while simultaneously enabling servicing of tenant requests. This is enabled in part, by strategic caching of tenant DEKs in a secure local memory, wherein the cached tenant DEKs are maintained in the clear and are readily accessible to running processes that are using the DEKs to decrypt and access tenant data, irrespective of the state of a background process used to implement the KEK rotation to the new KEK.