US 11,641,275 B2 · Encryption key rotation framework

Abstract

Techniques are described herein for performing key rotation and key replacement. In an embodiment, a request is received that specifies key names. A first set of messages is generated, where each message identifies a table that is associated with the encrypted-data locations, and stored in a queue for processing by a first plurality of worker processes. Each worker process retrieves a message from the queue and generates a second message that identifies a subset of encrypted data records from the table. Each second message is stored in a distinct queue which is assigned to a worker process of a second plurality of worker processes. Each worker process retrieves the message from the assigned queue, decrypts the subset of encrypted data records, re-encrypts the decrypted data records using a new encryption key that corresponds to a new key name, and stores the re-encrypted data records in a database.

Claims26

Dependent claims

A computer-implemented method for key rotation, comprising:

storing one or more encrypted data records at one or more encrypted-data locations of a plurality of encrypted-data locations;
wherein each encrypted data record of the one or more encrypted data records comprises a composite value that includes:
a key version that is unencrypted,
a payload that has been encrypted with an encryption key, and
a key name that is unencrypted;
receiving a key rotation request that specifies one or more key names of a plurality of key names, a source key version, and a target key version;
for each key name of the one or more key names:
obtaining a particular encrypted data record of the one or more encrypted data records that is associated with a key name of the one or more key names and the source key version;
generating a particular decrypted data record by decrypting the payload of the particular encrypted data record using an encryption key that corresponds to the source key version;
generating a particular re-encrypted data record by encrypting the particular decrypted data record using an encryption key that corresponds to the target key version.

7 more elements

One or more non-transitory computer-readable media storing instructions which, when executed by one or more processors, cause:

generating a first set of messages, each message of the first set of messages identifying a table associated with one or more encrypted-data locations of a plurality of encrypted-data locations;
generating, by each worker process of a first plurality of worker processes, one or more messages of a second set of messages, each of the one or more messages of the second set of messages identifying a subset of encrypted data records included in a table identified in a message of the first set of messages;
generating, by each worker process of a second plurality of worker processes, decrypted data records by decrypting the subset of encrypted data records identified in a message of the second set of messages;
generating, by each worker process of the second plurality of worker processes, re-encrypted data records by encrypting the decrypted data records that were decrypted by the respective worker process of the second plurality of worker processes;
wherein the re-encrypted data records are generating using new encryption keys to encrypt the decrypted data records.

2 more elements

Dependencies are inferred from the claim text.

Encryption key rotation framework

Life of this patent

Encryption key rotation framework

Life of this patent

Abstract

Claims26