Staggered Encryption Keys for Cross-Cloud Database Replication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database replication systems face challenges in securely transmitting data between different database deployments, especially across incongruent cloud providers, while ensuring data remains within specified geographic regions and avoiding open Internet transfer, and managing encryption keys at enterprise scales.
Innovation Solution
Implementing a replication manager and channel manager that use internal message keys and virtual private networks (VPNs) to encrypt and transfer data between databases, independent of HSM and VPC configurations, employing staggered encryption keys to ensure secure and efficient data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are used to authenticate and encrypt data between database systems, then data security is improved, but computational efficiency deteriorates
Solution Approach 1:
The patent segments the encryption key management into multiple components: data encryption keys (DEKs) for actual data encryption, wrapping replication keys (WRKs) for key management, and asymmetric key pairs for secure key exchange. This segmentation allows each component to be optimized for its specific function, improving overall computational efficiency while maintaining security.
Solution Approach 2:
The patent introduces an intermediary key wrapping mechanism where WRKs act as intermediaries between asymmetric keys and DEKs. This intermediary layer enables efficient symmetric encryption to be used for data transmission while maintaining the security benefits of asymmetric key exchange, thus resolving the contradiction between security and computational efficiency.
2Reliability
If encryption keys are replicated across multiple locations, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-distributing WRKs to target database systems before actual data replication occurs. This allows DEKs to be encrypted with WRKs in advance, and the encrypted DEKs to be stored with the data. When data is replicated, the decryption and decryption processes are streamlined, reducing the complexity of real-time key management while maintaining security across multiple locations.
3Adaptability or versatility
If data is transmitted over open Internet, then transmission flexibility is improved, but security and compliance deteriorate
Solution Approach 1:
The patent applies local quality by implementing different security measures for different transmission scenarios. Data can be transmitted over open Internet with full encryption using DEKs and WRKs when flexibility is needed, or through private networks with simplified key exchange when maximum security is required. The system adapts the encryption approach to the specific transmission context, maintaining both flexibility and security/compliance.
Data Source
AI summary
A method includes encoding, by at least one hardware processor, database data in a first portion of a first data file of a plurality of data files. The encoding of the database data is based on a first encryption key. The method further includes encoding the first encryption key in a second portion of the first data file. The encoding of the first encryption key is based on a second encryption key associated with a second data file of the plurality of data files. The method further includes causing transmission of the plurality of data files from a first database deployment to a second database deployment.