Wrapped DEK Authorization for Multi-Tenant Cloud Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key management systems in cloud environments face challenges in efficiently managing and authorizing access to a large number of cryptographic keys, particularly in multi-tenant scenarios, where millions of keys may be involved, and require explicit user-supplied additional authenticated data for decryption, which is inefficient and prone to errors.
Innovation Solution
The system embeds custom attributes in the wrapped data encryption key (DEK) using a JSON Web Encryption (JWE) structure, allowing implicit authorization based on embedded tags and values, eliminating the need for external data and optimizing the authorization process by validating these attributes before decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If explicit user-supplied additional authenticated data is required for decryption, then authorization can be verified, but the process becomes inefficient and error-prone
Solution Approach 1:
The wrapped DEK structure enables self-service authorization by embedding all necessary authorization attributes (tenant ID, jurisdiction, data classification) directly within the key wrapper. The decryption process automatically validates these embedded attributes without requiring external user-supplied data, making the system both reliable and efficient
Solution Approach 2:
Authorization attributes are preliminarily embedded into the wrapped DEK during key generation. This preliminary action ensures that all authorization information is prepared in advance and embedded in the key structure, eliminating the need for runtime user input and reducing errors
2Reliability
If millions of cryptographic keys are managed in multi-tenant scenarios, then comprehensive security coverage is achieved, but computational load increases
Solution Approach 1:
The system segments keys into hierarchical groups (customer keys, data keys, object keys) with embedded authorization attributes at each level. This segmentation allows the decryption process to validate only relevant embedded attributes rather than checking all million+ keys, significantly reducing computational load while maintaining comprehensive security
Solution Approach 2:
Each wrapped DEK contains locally embedded authorization attributes specific to its context (tenant ID, jurisdiction, data classification). This local quality enables fast, context-specific validation without requiring global verification across the entire key management system
3Measurement precision
If custom attributes are embedded in wrapped DEK, then authorization precision is improved, but key structure complexity increases
Solution Approach 1:
The wrapped DEK structure serves multiple functions simultaneously: it encrypts the DEK, embeds authorization attributes, and provides self-validation. This multi-functionality achieves high authorization precision without proportionally increasing complexity, as the same structure performs multiple security functions
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments are directed to managing cryptographic keys in a multi-tenant cloud based system. Embodiments receive from a client a request for a wrapped data encryption key ("DEK"). Embodiments generate a random key and fetch encryption context that corresponds to the client. Embodiments generate the wrapped DEK including the random key and the encryption context encoded in the wrapped DEK. Embodiments then return the wrapped DEK to the client.