Key Synchronization in Multi-Cloud Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key management services in multi-cloud environments are unable to exchange keys directly and often restrict the import of externally generated keys, making it difficult to synchronize encryption and signing keys across different cloud environments for large enterprises.
Innovation Solution
A method and system for key synchronization in multi-cloud environments, where a synching computer application generates and stores data encryption keys and key encryption key pairs in respective key management services, encrypts the data encryption key with the public key, and stores it in a database in another cloud environment, allowing for secure decryption and data access across environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key management services are used in multi-cloud environments, then encryption and signing keys can be stored in each cloud environment for resiliency and latency reasons, but the key management services are incapable of exchanging keys with each other directly and some services restrict import of externally generated keys
Solution Approach 1:
The patent introduces a key synchronization service as an intermediary component that operates between different cloud environments. This service captures keys from one cloud environment, encrypts them using keys from another cloud environment, and stores the encrypted keys. The intermediary enables key exchange between incompatible key management services without requiring direct integration between them, resolving the contradiction between maintaining separate key stores for reliability and enabling cross-environment key sharing.
Solution Approach 2:
The patent implements key copying through encryption. Instead of directly transferring keys between cloud environments, the system creates an encrypted copy of the key using a key pair from the destination environment. The encrypted key is stored in the destination cloud environment's database, allowing the key to be copied across environments while maintaining security. This copying mechanism enables key synchronization without direct key exchange between incompatible services.
2Reliability
If encryption keys are kept in each cloud environment for resiliency, then data protection is improved, but key management complexity increases
Solution Approach 1:
The patent segments the key management function into separate components: local key stores in each cloud environment for data protection, and a centralized key synchronization service for key distribution. This segmentation allows each cloud environment to maintain its own keys for resiliency while the synchronization service handles the complexity of key exchange and management across environments, reducing overall system complexity.
Solution Approach 2:
The key synchronization service operates autonomously to manage key distribution between cloud environments. It automatically captures keys from source environments, encrypts them using destination environment keys, and stores them in the destination databases without requiring manual intervention. This self-service mechanism reduces key management complexity by automating what would otherwise be manual key synchronization processes.
Data Source
AI summary
Systems and methods for key synchronization in multi-cloud environments are disclosed. A method may include: (1) generating, by a synching computer application and using a first key management service in a first cloud environment, a data encryption key and storing the data encryption key in the first key management service; (2) generating, by the synching computer application and using a second key management service in a second cloud environment, a key encryption key pair comprising a private key and a public key and storing the key encryption key pair in the second key management service; (3) fetching, by the synching computer application, the public key from the second key management service; (4) encrypting, by the synching computer application, the data encryption key with the public key; and (5) storing, by the synching computer application, the encrypted data encryption key in a database in the second cloud environment.