Dynamic space allocation for cryptographic key management

One or more non-transitory computer-readable media storing computer-executable instructions which, when executed by a processor on a computer system, perform a method for dynamically allocating hardware security module (HSM) disk space for a data encryption key lifecycle, the method comprising:

• receiving a request from an application to generate a data encryption key;
• scanning a set of logical partitions at an HSM;
• when a partition in the set of logical partitions comprises disk space for three keys:
• generating a set of three key versions;
• generating metadata for a first key version in the set of three key versions comprising an active state;
• and
• generating metadata for a second key version and a third key version in the set of three key versions comprising a pre-active state;
• when no partition in the set of logical partitions comprises space for three keys, initiating a new logical partition at the HSM;
• when a new logical partition is not available at the HSM, initiating a new logical partition at another HSM;
• and
• when another HSM is not available, terminating generation of a data encryption key.

A system for dynamically allocating hardware security module (HSM) disk space for a data encryption key lifecycle, the system comprising a processor configured to:

• receive a request from an application to generate a data encryption key;
• scan a set of logical partitions at an HSM;
• when a partition in the set of logical partitions comprises disk space for three keys, generate a set of three key versions;
• at a database associated with the HSM:
• generate metadata for a first key version in the set of three key versions comprising an active state;
• and
• generate metadata for a second key version and a third key version in the set of three key versions comprising a pre-active state;
• when no partition in the set of logical partitions comprises space for three keys, initiate a new logical partition at the HSM;
• when a new logical partition is not available at the HSM, initiate a new logical partition at another HSM;
• and
• when another HSM is not available, terminate the request to generate a data encryption key.

A method for dynamically allocating hardware security module (HSM) disk space for a data encryption key lifecycle, the method comprising:

• scanning a plurality of logical partitions at an HSM;
• when a partition in the plurality of logical partitions comprises disk space for three keys, generating a set of three key versions;
• generating metadata for a first key version in the set of three key versions comprising an active state;
• and
• generating metadata for a second key version and a third key version in the set of three key versions comprising a pre-active state;
• at a first key rotation:
• scanning partition metadata to locate a key version in a pre-active state;
• updating metadata for the second key version from the pre-active state to a deleted state and deleting the second key version;
• generating a fourth key version and storing the fourth key version in a partition space previously used by the second key version;
• generating metadata for the fourth key version comprising an active state;
• and
• updating metadata for the first key version from the active state to a deactivated state;
• and
• at a second key rotation:
• scanning key metadata to locate a key version in a pre-active state;
• updating the metadata for the third key version from the pre-active state to a deleted state and deleting the third key version;
• generating a fifth key version and storing the fifth key version in a partition space previously used by the third key version;
• generating metadata for the fifth key version comprising an active state;
• updating metadata for the fourth key version from the active state to a deactivated state;
• and
• updating metadata for the first key version from the deactivated state to a locked state.