US 2023/0145340 A1 · DISTRIBUTING AND SYNCHRONIZING ENCRYPTED DATA FOR MULTI-REGIONAL ACCESSIBILITY

Abstract

This disclosure describes one or more implementations of systems, non-transitory computer-readable media, and methods that create a secured, versioned, and resilient multi-region caching of digital secrets and application credentials that facilitates scalability of digital secrets without compromising the security of the digital secrets. In particular, in one or more embodiments, the disclosed systems leverage envelope encryption along with management keys of a key management system to cache encrypted data packages that include encrypted digital secrets and encrypted envelope keys at regional storage servers. Furthermore, in some embodiments, the disclosed systems access encrypted digital secrets through regional storage servers by decrypting envelope keys through a key management system and utilizing the envelope keys to extract digital secrets from the encrypted data packages.

Claims20

Dependent claims

A system comprising:

one or more memory devices comprising an envelope key and a digital secret;
and
one or more processors configured to cause the system to:
generate, utilizing the envelope key, an encrypted digital secret from the digital secret;
determine an encrypted envelope key comprising the envelope key encrypted utilizing a management key of a key management system;
generate an encrypted data package comprising the encrypted digital secret and the encrypted envelope key;
and
provide the encrypted data package to a regional storage server such that a regional computing device decrypts the encrypted envelope key via the management key of the key management system and utilizes the envelope key to decrypt the encrypted digital secret.

5 more elements

A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause a computing device to:

retrieve an encrypted data package from a regional storage server, the encrypted data package comprising an encrypted digital secret reflecting a digital secret encrypted utilizing an envelope key and an encrypted envelope key reflecting the envelope key encrypted utilizing a management key hosted on a key management system;
determine the envelope key from the encrypted envelope key utilizing the management key hosted on the key management system;
and
extract the digital secret from the encrypted data package by decrypting the encrypted digital secret utilizing the determined envelope key.

1 more element

A computer-implemented method comprising:

generating a first encrypted data package comprising a first encrypted digital secret from a digital secret obtained from a digital secret vault server and a first encrypted envelope key generated from a first envelope key;
generating a second encrypted data package comprising a second encrypted digital secret from the digital secret obtained from the digital secret vault server and a second encrypted envelope key generated from a second envelope key;
providing the first encrypted data package to a first regional storage server such that a first regional computing device decrypts the first encrypted envelope key via a first management key of a key management system and utilizes the first envelope key to decrypt the first encrypted digital secret;
and
providing the second encrypted data package to a second regional storage server such that a second regional computing device decrypts the second encrypted envelope key via a second management key of the key management system and utilizes the second envelope key to decrypt the second encrypted digital secret.

2 more elements

Dependencies are inferred from the claim text.

Distributing and synchronizing encrypted data for multi-regional accessibility

Life of this patent

Distributing and synchronizing encrypted data for multi-regional accessibility

Life of this patent

Abstract

Claims20