Key encryption key (kek) rotation for multi-tenant (mt) system

A method for facilitating changing an encryption key (Key Encryption Key) in a multi-tenant computing environment, wherein the encryption key is used to encrypt one or more tenant encryption keys used by one or more tenants of the multi-tenant computing environment, the method comprising:

• decrypting one or more second encryption keys using an existing encryption key, the existing encryption key representing a first encryption key, resulting in one or more decrypted second encryption keys;
• storing the one or more decrypted second encryption keys in local memory;
• employing the one or more decrypted second encryption keys from the local memory, in combination with a new encryption key from a persistent data store, to encrypt the one or more second encryption keys using the new encryption key, resulting in a newly encrypted set of one or more second encryption keys;
• maintaining the newly encrypted set of one or more second encryption keys in the persistent data store;
• and
• subsequently using the new encryption key for encrypting and decrypting the one or more second encryption keys when storing and retrieving, respectively, the one or more second encryption keys from the persistent data store.

An apparatus comprising:

• one or more processors;
• logic encoded in one or more non-transitory media for execution by the one or more processors and when executed operable for:
• determining that an existing encryption key is to be changed to a new encryption key, wherein the existing encryption key represents a first encryption key, and wherein the first encryption key encodes one or more second encryption keys;
• using the existing encryption key to encrypt the new encryption key, resulting in an encrypted new key;
• storing the encrypted new key in a persistent data store;
• decrypting the one or more second encryption keys using the existing encryption key, resulting in one or more decrypted second encryption keys;
• storing the one or more decrypted second encryption keys in local memory;
• employing the one or more decrypted second encryption keys from the local memory, in combination with the new encryption key from the persistent data store, to encrypt the one or more second encryption keys using the new encryption key, resulting in a newly encrypted set of one or more second encryption keys;
• maintaining the newly encrypted set of one or more second encryption keys in the persistent data store;
• and
• subsequently using the new encryption key for encrypting and decrypting the one or more second encryption keys when storing and retrieving, respectively, the one or more second encryption keys from the persistent data store.