Method and apparatus to rotate data encryption keys in databases with no down time

A computer implemented method for automating database encryption updates, comprising:

• establishing, with a policy manager computing device, a first instance of a database and a second instance of the database on one or more computing devices,
• wherein the first instance of the database and the second instance of the database are encrypted with an old encryption key;
• designating the first instance of the database as a primary instance of the database,
• wherein the primary instance of the database receives database queries and database change information from a user computing device,
• designating the second instance of the database as a mirror instance of the database,
• wherein the mirror instance of the database is configured to synchronize with the primary instance of the database to provide a redundant instance of the primary instance of the database;
• rotating encryption characteristics of the primary instance of the database and the mirror instance of the database by repeatedly:
• copying the primary instance of the database or the mirror instance of the database to create a new instance of the database that is different than the primary instance of the database and that is different than the mirror instance of the database;
• decrypting the new instance of the database from the old encryption key that was used to encrypt the primary instance of the database;
• generating a new encryption key that is different than the old encryption key;
• encrypting the new instance of the database with the new encryption key;
• designating the new instance of the database as the primary instance of the database that receives database queries and database change information from the user computing device;
• reassigning the new encryption key as the old encryption key;
• and
• allowing a predetermined period of time to elapse in accordance with an encryption policy executed by the policy manager computing device.

A system for providing uninterrupted access to a database while rotating encryption keys to the database, the system comprising:

• at least one processor;
• and
• at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing uninterrupted access to the database while rotating encryption keys to the database, the process including:
• encrypting a first instance of the database with a first encryption key and a second instance of the database with the first encryption key,
• wherein the second instance of the database is synchronized with the first instance of the database,
• wherein the first instance of the database is designated as a primary recipient of database queries from user computing devices;
• creating a third instance of the database by copying the first instance of the database or the second instance of the database,
• wherein, upon creation, the third instance of the database includes contents that are encrypted with the first encryption key;
• decrypting the third instance of the database to disassociate the contents of the third instance of the database from the first encryption key;
• encrypting the third instance of the database with a second encryption key;
• designating the third instance of the database as the primary recipient of database queries from user computing devices;
• encrypting the first instance of the database or the second instance of the database with the second encryption key;
• and
• decommissioning the first instance of the database or the second instance of the database that is not encrypted with the second encryption key.

A system for automating database encryption updates, comprising:

• at least one processor;
• and
• at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for automating database encryption updates, the process including:
• establishing a first instance of a database and a second instance of the database on one or more computing devices,
• wherein the first instance of the database and the second instance of the database are encrypted with an old encryption key;
• designating the first instance of the database as a primary instance of the database,
• wherein the primary instance of the database receives database queries and database change information from a user computing device,
• designating the second instance of the database as a mirror instance of the database,
• wherein the mirror instance of the database is configured to synchronize with the primary instance of the database to provide a redundant instance of the primary instance of the database;
• rotating encryption characteristics of the database by repeatedly:
• copying the primary instance of the database or the mirror instance of the database to create a new instance of the database;
• decrypting the new instance of the database from the old encryption key that was used to encrypt the primary instance of the database;
• generating a new encryption key that is different than the old encryption key;
• encrypting the new instance of the database with the new encryption key;
• designating the new instance of the database as the primary instance of the database that receives database queries and database change information from the user computing device;
• reassigning the new encryption key as the old encryption key;
• and
• allowing a predetermined period of time to elapse in accordance with an encryption policy.

A system for providing uninterrupted access to a database while rotating encryption keys to the database, the system comprising:

• a first instance of a database, the first instance of the database being encrypted with a first encryption key;
• a second instance of the database, the second instance of the database being encrypted with a first encryption key;
• the second instance of the database being synchronized with the first instance of the database;
• at least one processor;
• and
• at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing uninterrupted access to the database while rotating encryption keys to the database, the process including:
• designating the first instance of the database as a primary recipient of database queries from user computing devices;
• creating a third instance of the database by copying the first instance of the database or the second instance of the database,
• wherein, upon creation, the third instance of the database includes contents that are encrypted with the first encryption key;
• decrypting the third instance of the database to disassociate the contents of the third instance of the database from the first encryption key;
• encrypting the third instance of the database with a second encryption key;
• designating the third instance of the database as the primary recipient of database queries from user computing devices;
• encrypting the first instance of the database or the second instance of the database with the second encryption key;
• and
• decommissioning the first instance of the database or the second instance of the database that is not encrypted with the second encryption key.