Key rotation for sensitive data tokenization

Patent metadata

Field	Value
Publication number	US-11849036-B2
Application number	US-202217808327-A
Country	US
Kind code	B2
Filing date	Jun 23, 2022
Priority date	Sep 24, 2019
Publication date	Dec 19, 2023
Grant date	Dec 19, 2023

Abstract

This document describes techniques for rotating keys used to tokenize data stored in a streaming data store where data is stored for a maximum time [W]. In some embodiments, a data layer of such a data store can encrypt arriving original data values twice. The original data value is first encrypted with a first key, producing a first token. The original data value is encrypted with a second key, producing a second token. Each encrypted token can be stored separately in the data store. A field may be associated with two database columns, one holding the value encrypted with the first key and the second holding the value encrypted with the second key. Keys are rotated after time [K], which is at least equal to and preferably longer than [W]. Rotation can involve discarding the older key and generating a new key so that two keys are still used.

First claim

The invention claimed is:

1. A method for performing a read operation in a data store of a data layer, the method comprising:
within the data layer providing data services to external client applications:
receiving a request for a field;
identifying first and second columns in the data store associated with the field, the first column holding a first encrypted value that was encrypted with a first key, and the second column holding a second encrypted value that was encrypted with a second key;
selecting one of the first and second columns to read based at least in part on a difference in time between a current date-time and a date-time of a prior key rotation;
upon selection of the first column, ignoring the second column, decrypting the first encrypted value using the first key, and sending the result in a response to the request for the field; and,
upon selection of the second column, ignoring the first column, decrypting the second encrypted value using the second key rather, and sending the result in a response to the request for the field.

2. The method of claim 1 , wherein the first and second keys are each time-limited keys.

3. The method of claim 1 , wherein the date-time of the prior key rotation is a date-time of a most recent key rotation in the data layer.

4. The method of claim 1 , wherein the selecting one of the first and second columns to read, based at least in part on the difference in time between the current date-time and the date-time of a prior key rotation, comprises:
if the difference is greater than a maximum data lifetime in the data layer, selecting the first column; and,
if the difference is less than the maximum data lifetime in the data layer, selecting the second column.

5. The method of claim 1 , wherein the first key comprises a current key and the second key comprises a prior key.

6. A system, comprising one or more computers having circuitry forming one or more processors and memory holding computer program instructions for execution on the one or more processors to form a data layer that has a data store, the computer program instructions when executed causing the one or more computers to perform a read operation, the read operation comprising:
within the data layer, which provides data services to external client applications:
receive a request for a field;
identify first and second columns in the data store associated with the field, the first column holding a first encrypted value that was encrypted with a first key, and the second column holding a second encrypted value that was encrypted with a second key;
select one of the first and second columns to read based at least in part on a difference in time between a current date-time and a date-time of a prior key rotation;
upon selection of the first column, ignore the second column, decrypting the first encrypted value using the first key, and sending the result in a response to the request for the field; and,
upon selection of the second column, ignore the first column, decrypting the second encrypted value using the second key rather, and sending the result in a response to the request for the field.

7. The system of claim 6 , wherein the first and second keys are each time-limited keys.

8. The system of claim 6 , wherein the date-time of the prior key rotation is a date-time of a most recent key rotation in the data layer.

9. The system of claim 6 , wherein the selection one of the first and second columns to read, based at least in part on the difference in time between the current date-time and the date-time of a prior key rotation, comprises:
if the difference is greater than a maximum data lifetime in the data layer, selecting the first column; and,
if the difference is less than the maximum data lifetime in the data layer, selecting the second column.

10. The system of claim 6 , wherein the first key comprises a current key and the second key comprises a prior key.

Assignees

• Akamai Tech Inc

Inventors

• Neystadt Eugene (John)
• Herzog Jonathan
• Dror Ittay
• Ben-Zvi Elisha

Classifications

• H04L9/0869 Primary

  involving random numbers or seeds · CPC title

• G06F21/629

  to features or functions of an application · CPC title

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title