Shared WDEK List Synchronization for Container Key Caches
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In containerized environments, encryption key caches face issues such as cache misses and loss of unwrapped data encryption keys (DEKs) due to replica set rollovers and network outages, leading to unnecessary network traffic and overhead processing when requesting unwrapped DEKs from a key management system.
Innovation Solution
Implement a shared list data structure of wrapped data encryption keys (WDEKs) across replica sets, synchronizing local encryption key caches to minimize cache misses and reduce requests to the key management system by maintaining a synchronized list of WDEKs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If encryption keys are cached locally in containers, then decryption speed improves, but cache misses occur leading to network traffic and overhead processing
Solution Approach 1:
The system performs preliminary actions by proactively fetching and caching encryption keys in the local encryption key cache before they are actually needed for decryption operations. The cache miss handler monitors for potential cache misses and pre-loads keys into the local cache, ensuring that when decryption operations occur, the keys are already available locally, thus maintaining high decryption speed while improving cache hit rate.
2Reliability
If individual key requests are made to the key management system, then key freshness is ensured, but network traffic and overhead processing increase
Solution Approach 1:
The system merges multiple individual key requests into a single batched request to the key management system. Instead of making separate network calls for each encryption key needed, the cache miss handler consolidates multiple key fetch operations into one unified request, reducing network traffic and overhead processing while still ensuring that all required keys are fetched and cached with current values from the key management system.
3Productivity
If local encryption key caches are used, then decryption performance improves, but cache synchronization across replica sets becomes complex
Solution Approach 1:
The system introduces an intermediary component - the shared list data structure - that mediates between multiple local encryption key caches across replica sets. This shared list serves as a coordination mechanism that tracks which keys are cached where, enabling automatic cache synchronization without complex peer-to-peer communication protocols. When a key is fetched by one replica set, the shared list ensures other replica sets can discover and utilize the same cached key, simplifying the synchronization complexity while maintaining high decryption performance.
Data Source
AI summary
Encryption key management for containerized applications is provided. An application container receives a request, directed to a wrapped data encryption key (WDEK), and it is determined whether a local cache associated with the application container stores a mapping of the WDEK to an unwrapped data encryption key (DEK). In response to a cache miss, a shared list, that stores entries corresponding to WDEKs to be synchronized among a plurality of local encryption key caches of a set of application containers, is accessed to determine a set of WDEKs that are missing from the local cache. A key management service provides the WDEKs and corresponding DEKs for the set of WDEKs. The shared list data structure and the local encryption key cache are updated based on the WDEKs and DEKs obtained from the key management service, to thereby synchronize the local encryption key cache with the shared list data structure.