Encryption key management and transparent decryption

Abstract

A system and method are provided for encryption key management, transparent decryption, and secure key sharing within a secure distributed storage environment. A master encryption key is generated for a user and encrypted using a wrapper key. Database keys are generated and encrypted using the master key, and then stored at a user-associated storage instance. In response to a query, the encrypted database key is decrypted using the master key and used to decrypt encrypted data. Masking policies may determine whether decrypted or encrypted data is returned to the user. Format-preserving encryption may be applied using a tweak value. Encrypted keys may be securely shared across independent encryption domains by re-encrypting under a temporary session master key. At no point is raw key material exposed to untrusted systems. The techniques improve key lifecycle security, enable policy-based access, and support multi-tenant data environments such as cloud-hosted data warehouses.

Dependencies are inferred from the claim text.