Parallel Key Rotation Framework for Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key rotation and replacement techniques in client-server systems require significant compute resources and cause substantial database downtime, providing a window for malicious actors to compromise data during security breaches, as they are inefficient and disrupt services.
Innovation Solution
A system for parallelized key rotation and replacement that assigns worker processes to decrypt and re-encrypt data records in subsets, using composite values with key names and versions for enhanced indexing, allowing granular segmenting and minimizing downtime by distributing compute resources effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key rotation and replacement techniques are used to encrypt large amounts of data records, then security is improved, but significant compute resources are required and substantial database downtime occurs
Solution Approach 1:
The patent divides the database into multiple partitions and assigns different encryption keys to different partitions. This segmentation allows key rotation to be performed on individual partitions independently, rather than requiring system-wide key rotation. Worker processes can process different partitions in parallel, significantly improving efficiency while maintaining security through distributed key management.
Solution Approach 2:
The system pre-generates multiple versions of encryption keys and stores them in advance. When key rotation is needed, the new keys are already available and can be immediately deployed to worker processes without waiting for generation or validation, reducing downtime and improving the speed of key rotation operations.
2Reliability
If traditional key rotation techniques are used, then encryption keys are updated, but significant database downtime prevents services and clients from accessing data
Solution Approach 1:
By partitioning the database and allowing different partitions to use different key versions simultaneously, the system enables continuous access to data in partitions that have not yet undergone key rotation. This eliminates the need for complete database downtime and allows incremental key rotation across partitions.
Solution Approach 2:
The system dynamically manages multiple key versions across different partitions and allows worker processes to adaptively select which key version to use based on the partition being processed. This dynamic approach enables seamless key rotation without requiring the entire system to stop operations.
3Reliability
If key rotation is performed on large amounts of encrypted data records, then security is enhanced, but the process requires substantial computational resources
Solution Approach 1:
The patent divides the computational workload of key rotation into smaller tasks distributed across multiple worker processes, each handling specific partitions or subsets of data records. This parallel processing approach reduces the computational burden on any single resource and improves overall efficiency through distributed computing.
Solution Approach 2:
The system combines multiple worker processes that can simultaneously perform key rotation operations on different partitions. By merging these parallel operations, the system achieves the security enhancement goal while distributing and optimizing the use of computational resources across the entire system rather than concentrating the load.
Data Source
AI summary
Techniques are described herein for efficiently and expeditiously performing key rotation and key replacement. In an embodiment, a key replacement request is received that specifies one or more key names of a plurality of key names. A location-to-key-name mapping that maps the plurality of key names to a plurality of encrypted-data locations is used to determine one or more encrypted-data locations that are mapped to the one or more key names. A first set of messages is generated where each message identifies a table that is associated with the one or more encrypted-data locations. The first set of messages is stored in a queue for processing by a first plurality of worker processes. Each worker process of the first plurality of worker processes retrieves a message of the first set of messages from the queue and generates a message of a second set of messages that identifies a subset of encrypted data records from the table identified in the message of the first set of messages. Each message of the second set of messages is stored in a distinct queue which is assigned to a worker process of a second plurality of worker processes. Each worker process of the second plurality of worker processes retrieves the message from the assigned queue, decrypts the subset of encrypted data records identified in the respective message, re-encrypts the decrypted data records using a new encryption key that corresponds to a new key name, and stores the re-encrypted data records in a database.