Lightweight Key Management System for Multi-Tenant Cloud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key management systems (KMS) are not tailored for multi-tenant cloud environments, require expensive hardware resources, and entail significant maintenance and operation overhead, making them inefficient for managing cryptographic keys in cloud storage.
Innovation Solution
A lightweight key management system that generates and manages tenant-specific keys on-the-fly using a root key and immutable tenant identifiers, eliminating the need for persistent key storage and minimizing hardware and software resource requirements, while adhering to the Key Management Interoperability Protocol (KMIP) standards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key management systems are deployed in multi-tenant cloud environments, then data security and key management capability are improved, but hardware resource requirements and operational overhead increase significantly
Solution Approach 1:
The patent uses cryptographic copying where a master key is used to derive multiple tenant-specific keys through key derivation functions. Instead of storing multiple physical key copies, the system generates cryptographic copies on-demand, reducing hardware storage requirements while maintaining security isolation between tenants.
Solution Approach 2:
The patent replaces traditional hardware-based key management systems (HSMs) with software-based cryptographic operations. Key derivation, encryption, and decryption are performed through cryptographic algorithms rather than mechanical hardware operations, significantly reducing hardware resource requirements while maintaining security.
2Adaptability or versatility
If traditional key management systems are deployed in multi-tenant cloud environments, then key management capability is improved, but maintenance and operation overhead increase significantly
Solution Approach 1:
The patent implements a universal key derivation mechanism where a single master key can derive keys for multiple tenants with different requirements. The same key derivation function serves multiple purposes: generating tenant keys, rotating keys, and managing different key types, eliminating the need for separate key management systems for each tenant or key type.
Solution Approach 2:
The system enables self-service key management where tenants can independently generate and manage their own derived keys using the key derivation function. Each tenant's key material is generated locally through cryptographic operations rather than requiring centralized key distribution and management, reducing operational overhead.
3Reliability
If cryptographic keys are persisted for each tenant, then key recovery capability is improved, but storage overhead and attack surface increase
Solution Approach 1:
The patent extracts and removes the need for persistent key storage by deriving all tenant keys on-demand from a master key. Instead of extracting and storing individual tenant keys for recovery, the system extracts only the master key for secure storage and regenerates tenant keys through cryptographic operations when needed, eliminating the storage overhead of individual key persistence.
Solution Approach 2:
The patent implements key recovery through cryptographic reconstruction rather than physical retrieval. When key recovery is needed, the system discards the need to store individual tenant keys and instead recovers them by re-running the key derivation function with the master key and tenant identifiers, achieving recovery without persistent storage.
Data Source
AI summary
A method includes generating a root key pair including a public key and a private key, generating metadata for keys associated with a tenant, wherein the metadata includes a key tag, a key version, and a tenant identifier, deriving a tenant key from the root key pair and the metadata, and outputting the tenant key.