KEY ROTATION AND SELECTIVE RE-ENCRYPTION FOR DATA SECURITY
Systems and methods for maintaining data security through encryption key retirement and selective re-encryption are presented. A method of selectively re-encrypting a subset of encrypted values includes storing each encrypted value together with the key profile number for the encryption key that was used to generate that encrypted value. When a key is compromised, its associated key profile number allows the efficient identification of all the encrypted values that were created using the now-compromised key. Once identified, the encrypted values may be decrypted using the compromised key and re-encrypted using a new key, without changing other related data such as the token associated with the encrypted value.
1 . A method of selectively re-encrypting a subset of encrypted data values, for use in a data processing operation for protecting sensitive data, said method comprising the computer-implemented steps of:
establishing a data store for storing a plurality of records, wherein each record comprises an encrypted value associated with original sensitive data, and a key profile number associated with an encryption key that was used to generate said encrypted value;
identifying a compromised key and a compromised key profile number associated therewith;
generating a new key and a new key profile number associated therewith;
identifying in said data store a subset of records, wherein said subset is characterized by a key profile number that matches said compromised key profile number, and for each record in said subset:
(a) de-encrypting said encrypted value using said compromised key to reveal said original sensitive data;
(b) re-encrypting said original sensitive data using said new key to generate a new encrypted data value;
(c) replacing said encrypted value with said new encrypted data value; and
(d) replacing said compromised key profile number with said new key profile number.
2 . The method of claim 1 , wherein each said record further comprises a token value associated with said original sensitive data, and wherein said method is executed without changing said token value.
3 . The method of claim 1 , wherein said step of generating said new key includes generating an activation date associated therewith, and wherein said step of identifying occurs after said activation date.
4 . A method for activating a new encryption key on a future date, for use in a data processing operation for protecting sensitive data, said method comprising the computer-implemented steps of:
establishing a data processing operation comprising a key manager for generating encryption keys, a token manager for encrypting sensitive data, and a data vault for storing encrypted data;
establishing a key management data store, in communication with said key manager, for storing a plurality of records, wherein each record comprises an encryption key, a key profile number, and an activation date;
generating a new record, comprising a new encryption key, a new key profile number, a new activation date; and
distributing said new record to said token manager for implementation of said new encryption key and said new key profile number upon reaching said activation date.
5 . A method of encryption key retirement for use in a data processing operation for protecting sensitive data, said method comprising the computer-implemented steps of:
establishing a data processing operation comprising a key manager for generating encryption keys, a token manager for encrypting sensitive data, and a data vault for storing encrypted data;
establishing a data store, in communication with said data vault, for storing a plurality of records, wherein each record comprises an encrypted value associated with original sensitive data, and a key profile number associated with an encryption key that was used to generate said encrypted value;
identifying a compromised key and a compromised key profile number associated therewith;
generating a new key and a new key profile number associated therewith;
identifying in said data store a subset of records, wherein said subset is characterized by a key profile number that matches said compromised key profile number, and for each record in said subset:
(a) de-encrypting said encrypted value using said compromised key to reveal said original sensitive data;
(b) re-encrypting said original sensitive data using said new key to generate a new encrypted data value;
(c) replacing said encrypted value with said new encrypted data value; and
(d) replacing said compromised key profile number with said new key profile number.
6 . The method of claim 5 , wherein each said record further comprises a token value associated with said original sensitive data, and wherein said method is executed without changing said token value.
7 . The method of claim 5 , wherein said step of generating said new key includes generating an activation date associated therewith, and wherein said step of identifying occurs after said activation date.