Cryptographic key management using key proxies and generational indexes

An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code is executable by one or more processors to implement a method comprising:

• receiving, by a key management service executing on a first computing system, a data decryption request from a client application executing on a second computing system, wherein the data decryption request comprises encrypted data, a generational index associated with the encrypted data, and a key proxy assigned to the client application, wherein the key proxy comprises a unique identifier of a set of one or more cryptographic keys associated with the key proxy assigned to the client application;
• determining, by the key management service, the generational index associated with the encrypted data, wherein the generational index identifies a generation of a given cryptographic key which is included in the set of one or more cryptographic keys associated with the key proxy and which was used to create the encrypted data;
• obtaining, by the key management service, the generation of the cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index;
• decrypting, by the key management service, the encrypted data using the obtained cryptographic key to generate decrypted data;
• and
• sending, by the key management service, the decrypted data to the client application.

A computing system, comprising:

• at least one processor;
• and
• a system memory configured to store program code, wherein the program code is executable by the at least one processor to instantiate a key management service, wherein the key management service is configured to:
• receive a data decryption request from a client application executing on a second computing system, wherein the data decryption request comprises encrypted data, a generational index associated with the encrypted data, and a key proxy assigned to the client application, wherein the key proxy comprises a unique identifier of a set of one or more cryptographic keys associated with the key proxy assigned to the client application;
• determine the generational index associated with the encrypted data, wherein the generational index identifies a generation of a given cryptographic key which is included in the set of one or more cryptographic keys associated with the key proxy and which was used to create the encrypted data;
• obtain the generation of the cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index;
• decrypt the encrypted data using the obtained cryptographic key to generate decrypted data;
• and
• send the decrypted data to the client application.