Tenant Key Management via Segmented Storage and Temporary Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional key management systems (KMS) struggle to manage a large number of cryptographic keys efficiently, leading to performance issues and security breaches when handling tens of thousands to millions of user accounts, as they incur high computational loads and network traffic, making them unsuitable for software as a service (SAAS) environments.
Innovation Solution
The system stores encrypted account keys locally and uses a key management system (KMS) to decrypt them using an organization key, temporarily storing the decrypted key for fast access and security, reducing network traffic and computational overhead, and employing redundancy by encrypting account keys with multiple organization keys to mitigate key loss or errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key management systems manage a large number of cryptographic keys, then security coverage increases, but computational load and network traffic increase excessively
Solution Approach 1:
The system segments key management into two parts: encrypted account keys are stored locally in the SAAS environment, while only decryption operations are performed by the KMS. This segmentation allows local access to keys without transferring actual key material, reducing computational load on the KMS while maintaining security coverage across multiple user accounts.
Solution Approach 2:
The patent introduces an intermediary mechanism where encrypted account keys serve as a bridge between local storage and KMS management. The encrypted keys can be accessed locally without KMS involvement, but can also be decrypted by KMS when needed, acting as an intermediary that reduces network traffic and computational overhead while maintaining security.
2Speed
If traditional key management systems decrypt and store keys for fast access, then access speed improves, but security risk increases due to key exposure
Solution Approach 1:
The system uses temporary storage for decrypted account keys that automatically evicts or deletes keys after use. The decrypted keys exist only transiently in memory and are removed after the encryption/decryption operation completes, reducing the window of vulnerability while maintaining fast access speeds.
Solution Approach 2:
The patent implements local quality by storing encrypted account keys locally in the SAAS environment rather than centrally in the KMS. This allows fast local access to encrypted keys without exposing decrypted keys, while the KMS retains only the organization keys needed for decryption when absolutely necessary.
3Ease of operation
If encrypted account keys are stored centrally in KMS, then key management is simplified, but network traffic and server load increase
Solution Approach 1:
The system segments key storage from key management: encrypted account keys are stored locally in the SAAS environment where they are needed, while the KMS manages only the organization keys. This segmentation eliminates the need to transfer numerous encrypted account keys over the network, reducing network traffic while maintaining operational simplicity.
Solution Approach 2:
The SAAS environment performs self-service by locally storing and accessing encrypted account keys without requiring constant KMS intervention. The local system can retrieve and use encrypted keys independently, reducing network traffic and server load while maintaining ease of operation through automated local management.
Data Source
AI summary
There is provided a computer implemented method encrypting and/or decrypting data, comprising: accessing data for encryption and/or decryption, wherein the data is of a user account of a plurality of user accounts, obtaining an account key in an encrypted state, the account key is obtained from an account key dataset storing at least one encrypted account key for each of the user accounts, providing over the network, the encrypted account key to a key management system(s) (KMS) hosted by a server, receiving over the network, a decrypted account key from the server hosting the KMS(s), wherein the KMS(s) decrypts the encrypted account key using an organization key stored and managed by the KMS(s), storing the decrypted account key in a data storage device set to provide temporary storage for decrypted account keys, and encrypting and/or decrypting the data associated with the user account using the decrypted account key.