Encryption key management across multiple computing devices

1 . A system comprising:

a computing system having a plurality of computing devices able to communicate over a network with a key management computing device, wherein a first computing device of the plurality of computing devices is configured by executable instructions to perform operations comprising:

sending, to the key management computing device, a request for information related to at least one of an active key encryption key (KEK) associated with an entity or a pre-active KEK associated with the entity;

receiving, from the key management computing device, an indication that the key management computing device does not have an active KEK or pre-active KEK associated with the entity;

in response to the indication, sending an instruction to the key management computing device for creation of a pre-active KEK for the entity;

based on subsequently determining that there are a plurality of pre-active KEKs for the entity available from the key management computing device, sending an instruction to the key management computing device to activate the pre-active KEK having an earliest creation time; and

receiving an active KEK for the entity.

2 . The system as recited in claim 1 , the operations further comprising receiving the active KEK from the key management computing device and an indication that activation of the active KEK was performed successfully.

3 . The system as recited in claim 1 , wherein the active KEK for the entity is received from a second computing device of the plurality of computing devices.

4 . The system as recited in claim 3 , the operations further comprising receiving an indication that the instruction for activation of the pre-active KEK was unsuccessful based at least on the second computing device of the plurality of computing devices requesting activation of the pre-active KEK having the earliest creation time before the instruction was received from the first computing device.

5 . The system as recited in claim 1 , the operations further comprising sending, to the key management computing device, an instruction to destroy any remaining pre-active KEKs corresponding to the entity.

6 . The system as recited in claim 1 , the operations further comprising periodically receiving the active KEK associated with the entity and a plurality of other active KEKs associated with other entities, from at least one of the key management computing device or one of the plurality of computing devices.

7 . The system as recited in claim 1 , the operations further comprising, following expiration of a first amount of time, retiring the active KEK associated with the entity and requesting, from the key management computing device, a new active KEK associated with the entity.

8 . The system as recited in claim 7 , wherein the operation of retiring the active KEK permits the retired KEK to be used for decryption of a previously encrypted data encryption key (DEK), but not for encryption of a DEK.

9 . The system as recited in claim 7 , the operations further comprising, following expiration of a second amount of time using the retired KEK to decrypt previously encrypted data encryption keys (DEKs) and re-encrypting the DEKs with a current active KEK associated with the entity.

10 . The system as recited in claim 9 , the operations further comprising, following expiration of a third among of time, deactivating the retired KEK, wherein following deactivation, an alert is sent to a user based on the deactivated KEK being needed to decrypt a DEK that was previously encrypted using the now deactivated KEK.

11 . The system as recited in claim 1 , the operations further comprising:

storing the active KEK in a data structure including a plurality of active KEKs; and

associating each active KEK with a respective individually distinguishable identifier (ID) in the data structure.

12 . A method comprising:

sending, by a computing device, to a key management computing device, a request for information related to at least one of an active key encryption key (KEK) associated with an entity or a pre-active KEK associated with the entity, wherein the computing device is one of a plurality of computing devices included in a computing system configured to store object data;

receiving, from the key management computing device, an indication that the key management computing device does not have an active KEK or pre-active KEK associated with the entity;

in response to the indication, sending an instruction to the key management computing device for creation of a pre-active KEK for the entity;

based on subsequently determining that there are a plurality of pre-active KEKs for the entity available from the key management computing device, sending an instruction to the key management computing device to activate the pre-active KEK having an earliest creation time; and

receiving an active KEK for the entity.

13 . The method as recited in claim 12 , further comprising receiving the active KEK from the key management computing device and an indication that activation of the active KEK was performed successfully.

14 . One or more non-transitory computer-readable media storing one or more programs executable by a first computing device of a plurality of computing devices in a computing system to configure the first computing device to perform operations comprising:

sending, to a key management computing device, a request for information related to at least one of an active key encryption key (KEK) associated with an entity or a pre-active KEK associated with the entity;

receiving, from the key management computing device, an indication that the key management computing device does not have an active KEK or pre-active KEK associated with the entity;

in response to the indication, sending an instruction to the key management computing device for creation of a pre-active KEK for the entity;

based on subsequently determining that there are a plurality of pre-active KEKs for the entity available from the key management computing device, sending an instruction to the key management computing device to activate the pre-active KEK having an earliest creation time; and

receiving an active KEK for the entity.

15 . The one or more non-transitory computer-readable media as recited in claim 14 , the operations further comprising receiving the active KEK from the key management computing device and an indication that activation of the active KEK was performed successfully.