Virtual key management and isolation of data deployments in multi-tenant environments

Patent metadata

Field	Value
Publication number	US-9292673-B2
Application number	US-201313838524-A
Country	US
Kind code	B2
Filing date	Mar 15, 2013
Priority date	Mar 15, 2013
Publication date	Mar 22, 2016
Grant date	Mar 22, 2016

Abstract

Tenants in a multi-tenant shared deployment are provided their own distinct key spaces over which they control a key management system. In this manner, virtual key management domains are created on a per-tenant (per-customer) basis so that, whenever a particular customer's data is co-tenanted, stored, transmitted or virtualized in the IT infrastructure of the provider's datacenter(s), it is secured using key management materials specific to that customer. This assures that the entirety of a tenant's data remains secure by cryptographically isolating it from other tenants' applications. The virtual key management domains are established using a broadcast encryption (BE) protocol and, in particular, a multiple management key variant scheme of that protocol. The broadcast encryption-based virtual key management system (VKMS) and protocol achieves per-tenant (as well as per-application) secured isolation of data and can be used across any combination of resources in or across all levels of a co-tenanted IT infrastructure.

First claim

The invention claimed is:

1. A method of key management in a multi-tenant computing infrastructure, comprising:
creating a distinct virtual key management domain for each of first and second tenants, the virtual key management domain having associated therewith key materials specific to each respective tenant, the key materials including a virtual key management block from which a set of virtual key management variants are derivable by one or more devices in the multi-tenant computing infrastructure to which data and applications associated with the respective tenant are allocated or provisioned;
providing the key materials to the tenant; and
using the distinct virtual key management domains to isolate first data that has been secured by key materials specific to the first tenant from second data that has been secured by key materials specific to the second tenant.

2. The method as described in claim 1 wherein the first data and the second data are associated with a same co-tenanted resource in the multi-tenant computing infrastructure.

3. The method as described in claim 1 wherein a respective tenant's virtual key management domain is associated with a given portion of the multi-tenant computing infrastructure.

4. The method as described in claim 1 wherein the key materials specific to the tenant further include a set of one or more device keys, and a set of one or more device identifiers, wherein a device key is a cryptographic key used to derive a key management variant of the set of virtual key management variants from the virtual management key block, and a device identifier is associated with a component within the multi-tenant computing infrastructure and is used to determine a cryptographic path within the virtual management key block to apply a given one of the device keys.

5. The method as described in claim 4 further including using the one or more management key variants to associate one or more trust levels to resources within the multi-tenant computing infrastructure.

6. The method as described in claim 5 wherein a component within a given trust level validates security for at least one device within a trust level that is less secure than the given trust level.

7. The method as described in claim 1 wherein the virtual key management domain is created using a broadcast encryption scheme.

8. Apparatus, comprising:
a processor;
computer memory holding computer program instructions that when executed by the processor perform a method of key management in a multi-tenant computing infrastructure, the method comprising:
creating a distinct virtual key management domain for each of first and second tenants, the virtual key management domain having associated therewith key materials specific to each respective tenant, the key materials including a virtual key management block from which a set of virtual key management variants are derivable by one or more devices in the multi-tenant computing infrastructure to which data and applications associated with the respective tenant are allocated or provisioned;
providing the key materials to the tenant; and
using the distinct virtual key management domains to isolate first data that has been secured by key materials specific to the first tenant from second data that has been secured by key materials specific to the second tenant.

9. The apparatus as described in claim 8 wherein the first data and the second data are associated with a same co-tenanted resource in the multi-tenant computing infrastructure.

10. The apparatus as described in claim 8 wherein a respective tenant's virtual key management domain is associated with a given portion of the multi-tenant computing infrastructure.

11. The apparatus as described in claim 8 wherein the key materials specific to the tenant further include a set of one or more device keys, and a set of one or more device identifiers, wherein a device key is a cryptographic key used to derive a key management variant of the set of virtual key management variants from the virtual management key block, and a device identifier is associated with a component within the multi-tenant computing infrastructure and is used to determine a cryptographic path within the virtual management key block to apply a given one of the device keys.

12. The apparatus as described in claim 11 wherein the method further includes using the one or more management key variants to associate one or more trust levels to resources within the multi-tenant computing infrastructure.

13. The apparatus as described in claim 12 wherein a component within a given trust level validates security for at least one device within a trust level that is less secure than the given trust level.

14. The apparatus as described in claim 8 wherein the virtual key management domain is created using a broadcast encryption scheme.

15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method of key management in a multi-tenant computing infrastructure, the method comprising:
creating a distinct virtual key management domain for each of first and second tenants, the virtual key management domain having associated therewith key materials specific to each respective tenant, the key materials including a virtual key management block from which a set of virtual key management variants are derivable by one or more devices in the multi-tenant computing infrastructure to which data and applications associated with the respective tenant are allocated or provisioned;
providing the key materials to the tenant; and
using the distinct virtual key management domains to isolate first data that has been secured by key materials specific to the first tenant from second data that has been secured by key materials specific to the second tenant.

16. The computer program product as described in claim 15 wherein the first data and the second data are associated with a same co-tenanted resource in the multi-tenant computing infrastructure.

17. The computer program product as described in claim 15 wherein a respective tenant's virtual key management domain is associated with a given portion of the multi-tenant computing infrastructure.

18. The computer program product as described in claim 15 wherein the key materials specific to the tenant further include a set of one or more device keys, and a set of one or more device identifiers, wherein a device key is a cryptographic key used to derive a key management variant of the set of virtual key management variants from the virtual management key block, and a device identifier is associated with a component within the multi-tenant computing infrastructure and is used to determine a cryptographic path within the virtual management key block to apply a given one of the device keys.

19. The computer program product as described in claim 18 wherein the method further includes using the one or more management key variants to associate one or more trust levels to resources within the multi-tenant computing infrastructure.

20. The computer program product as described in claim 19 wherein a component within a given trust level validates security for at least one device within a trust level that is less secure than the given trust level.

21. The apparatus as described in claim 15 wherein the virtual key management domain is created using a broadcast encryption

Assignees

• IBM

Inventors

• Rutkowski Matthew Francis
• Bassett Ronald W
• Bellwood Thomas Alexander

Classifications

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/31 Primary

  User authentication · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L2209/601

  Broadcast encryption · CPC title