Key management for encrypted data

Patent metadata

Field	Value
Publication number	US-2022141006-A1
Application number	US-202217647697-A
Country	US
Kind code	A1
Filing date	Jan 11, 2022
Priority date	Oct 9, 2019
Publication date	May 5, 2022
Grant date	—

Abstract

Key management for encrypted data includes establishing a cache of key decryption keys and periodically evicting the keys from the cache. A pool of key encryption keys also is created and periodically, selected key encryption keys are removed from service. Notably, the rate of removal of the encryption keys differs from the rate of cache eviction for the decryption keys. Thereafter, clear data is encrypted with a cipher to produce cipher text, and the cipher is encrypted with a selected key encryption key from the pool. Finally, in response to an access request for the clear data, an attempt to locate in the cache a key decryption key for the encrypted cipher is made. If attempt fails, the key decryption key is retrieved from remote memory. Finally, the encrypted cipher is decrypted with the located key, and the cipher text decrypted to produce the clear data.

First claim

What is claimed is:

1 . A computer-implemented method when executed by data processing hardware causes the data processing hardware to perform operations comprising:
selecting, from an inventory of encryption keys comprising a set of encryption keys, a pool of encryption keys, the pool of encryption keys comprising a sub-set of the set of encryption keys; receiving a request to encrypt an object; selecting, from the pool of encryption keys, a first encryption key for encrypting the object; encrypting, using the selected first encryption key, the object; removing, from the pool of encryption keys, a second encryption key based on an encryption key removal rate; selecting, from the inventory of encryption keys, a replacement encryption key not currently within the pool of encryption keys; and placing the replacement encryption key into the pool of encryption keys.

2 . The method of claim 1 , wherein the encryption key removal rate defines a threshold number of uses for each encryption key within the pool of encryption keys.

3 . The method of claim 1 , wherein the encryption key removal rate defines a threshold number of bytes encrypted for each encryption key within the pool of encryption keys.

4 . The method of claim 1 , wherein the first encryption key is randomly selected from the pool of encryption keys.

5 . The method of claim 1 , wherein the first encryption key is selected from the pool of encryption keys in a round-robin manner.

6 . The method of claim 1 , wherein the operations further comprise:
receiving a second request to decrypt the object; determining whether a first decryption key is present within a cache of decryption keys, the first decryption key associated with the first encryption key; when the first decryption key is present within the cache of decryption keys, retrieving the first decryption key from the cache of decryption keys; and decrypting, using the first decryption key, the object.

7 . The method of claim 6 , wherein:
the first decryption key is asymmetrically related to the first encryption key; or the first decryption key is the same as the first encryption key.

8 . The method of claim 6 , wherein the operations further comprise evicting, from the cache of decryption keys, a second decryption key based on a cache eviction rate, the cache eviction rate different from the encryption key removal rate.

9 . The method of claim 8 , wherein the evicted second decryption key represents a least recently used decryption key of the cache of decryption keys.

10 . The method of claim 8 , wherein the evicted second decryption key represents a least frequently used decryption key of the cache of decryption keys.

11 . A system comprising:
data processing hardware; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
selecting, from an inventory of encryption keys comprising a set of encryption keys, a pool of encryption keys, the pool of encryption keys comprising a sub-set of the set of encryption keys;
receiving a request to encrypt an object;
selecting, from the pool of encryption keys, a first encryption key for encrypting the object;
encrypting, using the selected first encryption key, the object;
removing, from the pool of encryption keys, a second encryption key based on an encryption key removal rate;
selecting, from the inventory of encryption keys, a replacement encryption key not currently within the pool of encryption keys; and
placing the replacement encryption key into the pool of encryption keys.

12 . The system of claim 11 , wherein the encryption key removal rate defines a threshold number of uses for each encryption key within the pool of encryption keys.

13 . The system of claim 11 , wherein the encryption key removal rate defines a threshold number of bytes encrypted for each encryption key within the pool of encryption keys.

14 . The system of claim 11 , wherein the first encryption key is randomly selected from the pool of encryption keys.

15 . The system of claim 11 , wherein the first encryption key is selected from the pool of encryption keys in a round-robin manner.

16 . The system of claim 11 , wherein the operations further comprise:
receiving a second request to decrypt the object; determining whether a first decryption key is present within a cache of decryption keys, the first decryption key associated with the first encryption key; when the first decryption key is present within the cache of decryption keys, retrieving the first decryption key from the cache of decryption keys; and decrypting, using the first decryption key, the object.

17 . The system of claim 16 , wherein:
the first decryption key is asymmetrically related to the first encryption key; or the first decryption key is the same as the first encryption key.

18 . The system of claim 16 , wherein the operations further comprise evicting, from the cache of decryption keys, a second decryption key based on a cache eviction rate, the cache eviction rate different from the encryption key removal rate.

19 . The system of claim 18 , wherein the evicted second decryption key represents a least recently used decryption key of the cache of decryption keys.

20 . The system of claim 18 , wherein the evicted second decryption key represents a least frequently used decryption key of the cache of decryption keys.

Assignees

• Google Llc

Inventors

• Mistry Shaunak
• Markowitz Adam

Classifications

• H04L63/06 Primary

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/0825 Primary

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title