Encryption key management
AssigneeKasten, Inc.
InventorsDeepika Dixit, Julio Lopez, Thomas Manville, Vaibhav Kamra
Life of this patent
Estimating the term…
Abstract
Disclosed herein are system, method, and computer program product embodiments for encryption key management. An embodiment operates by executing an initial non-backup instance of an application and generates a primary key using a cryptographic algorithm. The embodiment requests a customer to create a passphrase configured to encrypt and decrypt the primary key. The embodiment generates a derived key using a cryptographic algorithm and the customer passphrase as input. The embodiment then encrypts the primary key using the generated derived key and stores the encrypted primary key in a catalog.
Claims15
A computer-implemented method, comprising:
- executing an initial non-backup instance of an application;
- generating a primary key using a cryptographic algorithm;
- receiving a passphrase configured to encrypt and decrypt the primary key;
- generating a derived key from the passphrase using the cryptographic algorithm;
- encrypting the primary key using the derived key, thereby producing an encrypted primary key;
- storing the encrypted primary key in a catalog;
- executing a first instance of the application for backup;
- decrypting the encrypted primary key in the catalog, thereby retrieving the primary key;
- determining that the primary key is to be used for a first purpose of a backup repository end point for the first instance of the application;
- and
- generating a derived key for the first instance of the application based on the primary key and the first purpose, wherein the derived key for the first instance of the application is distinct from a derived key for a second instance of the application, wherein the derived key for the second instance of the application is to be used for a second purpose of a policy for an operation for the second instance of the application.
A system, comprising:
- a memory;
- and
- at least one processor coupled to the memory and configured to:
- execute an initial non-backup instance of an application;
- generate a primary key using a cryptographic algorithm;
- receive a passphrase configured to encrypt and decrypt the primary key;
- generate a derived key from the passphrase using the cryptographic algorithm;
- encrypt the primary key using the derived key, thereby producing an encrypted primary key;
- store the encrypted primary key in a catalog;
- execute a first instance of the application for backup;
- decrypt the encrypted primary key in the catalog, thereby retrieving the primary key;
- determine that the primary key is to be used for a first purpose of a backup repository end point for the first instance of the application;
- and
- generate a derived key for the first instance of the application based on the primary key and the first purpose, wherein the derived key for the first instance of the application is distinct from a derived key for a second instance of the application, wherein the derived key for the second instance of the application is to be used for a second purpose of a policy for an operation for the second instance of the application.
A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
- executing an initial non-backup instance of an application;
- generating a primary key using a cryptographic algorithm;
- receiving a passphrase configured to encrypt and decrypt the primary key;
- generating a derived key from the passphrase using the cryptographic algorithm;
- encrypting the primary key using the generated derived key, thereby producing an encrypted primary key;
- storing the encrypted primary key in a catalog;
- executing a first instance of the application for backup;
- decrypting the encrypted primary key in the catalog, thereby retrieving the primary key;
- determining that the primary key is to be used for a first purpose of a backup repository end point for the first instance of the application;
- and
- generating a derived key for the first instance of the application based on the primary key and the first purpose, wherein the derived key for the first instance of the application is distinct from a derived key for a second instance of the application, wherein the derived key for the second instance of the application is to be used for a second purpose of a policy for an operation for the second instance of the application.
Dependencies are inferred from the claim text.