Distributed key management system with a key lookup service

A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause operations to be performed comprising:

• receiving, at a first intermediate key management system (KMS) server of a distributed KMS, a first key lookup service (KLS) query from a KMS client for determining an identity of one or more of a plurality of KMS servers that are capable of performing a first operation with a first managed key, wherein the first intermediate KMS server is one of the plurality of intermediate KMS servers of the distributed KMS;
• determining the identity of one or more of the plurality of KMS servers that are capable of performing the first operation with the first managed key;
• transmitting a first KLS response to the KMS client that includes the identity of one or more of the plurality of KMS servers that are capable of performing the first operation with the first managed key, wherein the first intermediate KMS server is not one of the one or more of the plurality of KMS servers that are capable of performing the first operation with the first managed key;
• receiving, at the first intermediate KMS server, a second KLS query from the KMS client for determining an identity of one or more of the plurality of KMS servers that are capable of performing a second operation with a second managed key, wherein the second operation is different from the first operation;
• determining the identity of one or more of the plurality of KMS servers that are capable of performing the second operation with the second managed key;
• and
• transmitting a second KLS response to the KMS client that includes the identity of one or more of the plurality of KMS servers that are capable of performing the second operation with the second managed key, wherein the first intermediate KMS server is not one of the one or more of the plurality of KMS servers that are capable of performing the second operation with the second managed key.

A first intermediate key management system (KMS) server of a plurality of intermediate KMS servers of a distributed KMS, comprising:

• a processor;
• and
• a non-transitory machine-readable storage medium that provides instructions that, when executed by the processor, will cause the first intermediate KMS server to carry out operations including:
• receiving, at the first KMS server of the distributed KMS, a first key lookup service (KLS) query from a KMS client for determining an identity of one or more of a plurality of KMS servers that are capable of performing a first operation with a first managed key;
• determining the identity of one or more of the plurality of KMS servers that are capable of performing the first operation with the first managed key;
• transmitting a first KLS response to the KMS client that includes the identity of one or more of the plurality of KMS servers that are capable of performing the first operation with the first managed key, wherein the first intermediate KMS server is not one of the one or more of the plurality of KMS servers that are capable of performing the first operation with the first managed key;
• receiving, at the first intermediate KMS server, a second KLS query from the KMS client for determining an identity of one or more of the plurality of KMS servers that are capable of performing a second operation with a second managed key, wherein the second operation is different from the first operation;
• determining the identity of one or more of the plurality of KMS servers that are capable of performing the second operation with the second managed key;
• and
• transmitting a second KLS response to the KMS client that includes the identity of one or more of the plurality of KMS servers that are capable of performing the second operation with the second managed key, wherein the first intermediate KMS server is not one of the one or more of the plurality of KMS servers that are capable of performing the second operation with the second managed key.