# US 2019/0173674 A1 · Key encryption key (kek) rotation for multi-tenant (mt) system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173674 A1
- Document ID: US20190173674A1
- Status: Published application
- Kind: A1
- Application number: 15/948,405
- Filed: 2018-04-09
- Published: 2019-06-06
- Earliest claimed: 2017-12-01
- Assignees: Oracle International Corporation
- Applicants: Oracle International Corporation
- Inventors: Amit Agarwal; Rohit Koul; Srikant Krishnapuram Tirumalai; Jie Wang; Xinnong Wang
- Web page: https://patentgrep.com/patent/US20190173674A1

## CPC

- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0822: {using key encryption key}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An example method facilitates enabling Key Encryption Key (KEK) rotation for a running multi-tenant system without requiring system downtime or interruption. The example method facilitates decrypting a set of one or more DEKs using a preexisting KEK; using a new KEK to re-encode the DEKs using the new KEK, all while simultaneously enabling servicing of tenant requests. This is enabled in part, by strategic caching of tenant DEKs in a secure local memory, wherein the cached tenant DEKs are maintained in the clear and are readily accessible to running processes that are using the DEKs to decrypt and access tenant data, irrespective of the state of a background process used to implement the KEK rotation to the new KEK.

## Claims

### Claim 1

A non-transitory processor-readable storage device including logic for execution by one or more processors and when executed operable for facilitating changing an existing encryption key (Key Encryption Key) in a multi-tenant computing environment, wherein the existing encryption key is used to encrypt one or more second encryption keys of the multi-tenant computing environment, by performing the following acts:
decrypting one or more second encryption keys using an existing encryption key, the existing encryption key representing a first encryption key, resulting in one or more decrypted second encryption keys;
storing the one or more decrypted second encryption keys in local memory;
employing the one or more decrypted second encryption keys from the local memory, in combination with a new encryption key from a persistent data store, to encrypt the one or more second encryption keys using the new encryption key, resulting in a newly encrypted set of one or more second encryption keys;
maintaining the newly encrypted set of one or more second encryption keys in the persistent data store; and
subsequently using the new encryption key for encrypting and decrypting the one or more second encryption keys when storing and retrieving, respectively, the one or more second encryption keys from the persistent data store.

### Claim 2 (depends on 1)

The non-transitory processor-readable storage device of claim 1, further including:
determining that the first encryption key is to be changed to the new encryption key, wherein the first encryption key encodes the one or more second encryption keys, wherein the one or more second encryption keys include one or more tenant encryption keys used by one or more tenants of the multi-tenant computing environment;
using the first encryption key to encrypt the new encryption key, resulting in an encrypted new key; and
storing the encrypted new key in the persistent data store.

### Claim 3 (depends on 2)

The non-transitory processor-readable storage device of claim 2, wherein determining further includes:
receiving a request from one or more administrator systems to rotate the first encryption key.

### Claim 4 (depends on 3)

The non-transitory processor-readable storage device of claim 3, wherein the first encryption key represents a Key Encryption Key (KEK).

### Claim 5 (depends on 4)

The non-transitory processor-readable storage device of claim 4, wherein the one or more second encryption keys include one or more Data Encryption Keys (DEKs).

### Claim 7 (depends on 5)

The non-transitory processor-readable storage device of claim 5, wherein the one or more DEKs are usable to encrypt data associated with one or more respective tenants.

### Claim 8 (depends on 7)

The non-transitory processor-readable storage device of claim 7, wherein the one or more respective tenants include customers of a cloud service.

### Claim 9 (depends on 8)

The non-transitory processor-readable storage device of claim 8, wherein the one or more respective tenants further include computing resources of the cloud service that are allocated to different tenants of the one or more respective tenants.

### Claim 10 (depends on 8)

The non-transitory processor-readable storage device of claim 8, wherein the data associated with one or more respective tenants includes one or more tokens used by one or more computing resources allocated for use by the one or more respective tenants.

### Claim 11

A method for facilitating changing an encryption key (Key Encryption Key) in a multi-tenant computing environment, wherein the encryption key is used to encrypt one or more tenant encryption keys used by one or more tenants of the multi-tenant computing environment, the method comprising:
decrypting one or more second encryption keys using an existing encryption key, the existing encryption key representing a first encryption key, resulting in one or more decrypted second encryption keys;
storing the one or more decrypted second encryption keys in local memory;
employing the one or more decrypted second encryption keys from the local memory, in combination with a new encryption key from a persistent data store, to encrypt the one or more second encryption keys using the new encryption key, resulting in a newly encrypted set of one or more second encryption keys;
maintaining the newly encrypted set of one or more second encryption keys in the persistent data store; and
subsequently using the new encryption key for encrypting and decrypting the one or more second encryption keys when storing and retrieving, respectively, the one or more second encryption keys from the persistent data store.

### Claim 12 (depends on 11)

The method of claim 11, further including:
determining that the first encryption key is to be changed to the new encryption key, wherein the first encryption key encodes the one or more second encryption keys, wherein the one or more second encryption keys include one or more tenant encryption keys used by one or more tenants of the multi-tenant computing environment;
using the first encryption key to encrypt the new encryption key, resulting in an encrypted new key; and
storing the encrypted new key in the persistent data store.

### Claim 13 (depends on 12)

The method of claim 12, wherein determining further includes:
receiving a request from one or more administrator systems to rotate the first encryption key.

### Claim 14 (depends on 13)

The method of claim 13, wherein the first encryption key represents a Key Encryption Key (KEK).

### Claim 15 (depends on 14)

The method of claim 14, wherein the one or more second encryption keys include one or more Data Encryption Keys (DEKs).

### Claim 17 (depends on 15)

The method of claim 15, wherein the one or more DEKs are usable to encrypt data associated with one or more respective tenants.

### Claim 18 (depends on 17)

The method of claim 17, wherein the one or more respective tenants include customers of a cloud service.

### Claim 19 (depends on 18)

The method of claim 18, wherein the one or more respective tenants further include computing resources of the cloud service that are allocated to different tenants of the one or more respective tenants.

### Claim 20

An apparatus comprising:
one or more processors;
logic encoded in one or more non-transitory media for execution by the one or more processors and when executed operable for:
determining that an existing encryption key is to be changed to a new encryption key, wherein the existing encryption key represents a first encryption key, and wherein the first encryption key encodes one or more second encryption keys;
using the existing encryption key to encrypt the new encryption key, resulting in an encrypted new key;
storing the encrypted new key in a persistent data store;
decrypting the one or more second encryption keys using the existing encryption key, resulting in one or more decrypted second encryption keys;
storing the one or more decrypted second encryption keys in local memory;
employing the one or more decrypted second encryption keys from the local memory, in combination with the new encryption key from the persistent data store, to encrypt the one or more second encryption keys using the new encryption key, resulting in a newly encrypted set of one or more second encryption keys;
maintaining the newly encrypted set of one or more second encryption keys in the persistent data store; and
subsequently using the new encryption key for encrypting and decrypting the one or more second encryption keys when storing and retrieving, respectively, the one or more second encryption keys from the persistent data store.