Key Proxies and Generational Indexes for Secure Cloud Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cryptographic key management techniques in cloud computing systems face challenges in securely managing and rotating cryptographic keys, particularly in distributed storage systems, as client applications must access and manage keys, which poses security risks and complexity due to key changes, rotations, and potential unauthorized access.
Innovation Solution
Implementing a cryptographic key management service using key proxies and generational indexes, where client applications do not need to access or manage cryptographic keys directly, with the key management service handling key rotations and mappings within a secure key vault, ensuring secure key handling and abstraction from client applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If client applications directly access and manage cryptographic keys, then key management functionality is available, but security risk increases and operational complexity increases
Solution Approach 1:
The patent introduces a key management service as an intermediary between client applications and cryptographic keys. The service receives encryption/decryption requests from clients, manages the cryptographic keys securely on the server side, and returns results without exposing keys to clients. This mediator architecture maintains key management functionality while eliminating direct key access by clients, thus reducing security risks.
2Reliability
If cryptographic keys are rotated and changed over time, then security is improved, but client application complexity increases and operational difficulty increases
Solution Approach 1:
The key management service automatically handles key rotation, generation, and management without requiring client application involvement. When keys need rotation for security reasons, the service generates new keys, updates mappings, and manages transitions internally. Client applications continue to use the same interface without needing to know about key changes, thus maintaining security improvements while preserving ease of operation.
3Ease of operation
If cryptographic keys are sent to client applications, then encryption/decryption functionality is enabled, but exposure to unauthorized access increases
Solution Approach 1:
The patent extracts cryptographic keys from the client application environment and keeps them exclusively on the server-side key management service. Only encryption/decryption results are transmitted to clients, never the keys themselves. This extraction eliminates the security vulnerability of key exposure while preserving the essential encryption/decryption functionality through the service interface.
Data Source
AI summary
Techniques are provided to implement a key management service using key proxies and generational indexes, which allows client applications to obtain data cryptographic services without having to utilize or otherwise have knowledge of cryptographic keys. For example, a key management service receives a data decryption request from a client application. The data decryption request includes encrypted data and a key proxy assigned to the client application. The key management service determines a generational index associated with the encrypted data. The generational index identifies a generation of a cryptographic key which is associated with the key proxy and which was used to create the encrypted data. The key management service obtains a cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index, decrypts the encrypted data using the obtained cryptographic key, and sends the decrypted data to the client application.