Distributed key caching for encrypted keys
Methods, systems, and devices for distributed caching of encrypted encryption keys are described. Some multi-tenant database systems may support encryption of data records. To efficiently handle multiple encryption keys across multiple application servers, the database system may store the encryption keys in a distributed cache accessible by each of the application servers. To securely cache the encryption keys, the database system may encrypt (e.g., wrap) each data encryption key (DEK) using a second encryption key (e.g., a key encryption key (KEK)). The database system may store the DEKs and KEKs in separate caches to further protect the encryption keys. For example, while the encrypted DEKs may be stored in the distributed cache, the KEKs may be stored locally on application servers. The database system may further support “bring your own key” (BYOK) functionality, where a user may upload a tenant secret or tenant-specific encryption key to the database.
1. A method for data encryption, comprising:
receiving, at a distributed cache, a data encryption key request;
receiving, at the distributed cache, a first encryption key parameter associated with a tenant and based at least in part on receiving the data encryption key request;
receiving, at the distributed cache or an application server, a second encryption key parameter associated with the first encryption key parameter;
transmitting, to a key derivation server, the first encryption key parameter and the second encryption key parameter;
receiving, from the key derivation server, an encrypted encryption key associated with the first encryption key parameter and encrypted using an encryption key associated with the second encryption key parameter; and
transmitting, to the application server, the encrypted encryption key in response to the data encryption key request.
2. The method of claim 1 , further comprising:
storing, at the distributed cache, the encrypted encryption key;
receiving, from the application server, an additional data encryption key request for the encrypted encryption key; and
transmitting, to the application server, the encrypted encryption key based at least in part on the additional data encryption key request and storing the encrypted encryption key at the distributed cache.
3. The method of claim 1 , further comprising:
receiving, from the application server, a destruction request message to destroy the first encryption key parameter;
determining that the encrypted encryption key associated with the first encryption key parameter is stored at the distributed cache; and
removing the encrypted encryption key from the distributed cache based at least in part on the destruction request message.
4. The method of claim 1 , wherein receiving the first encryption key parameter comprises receiving the first encryption key parameter from a database.
5. The method of claim 4 , further comprising:
receiving, from the application server, a first destruction request message to destroy the first encryption key parameter; and
sending, to the database, a second destruction request message to remove the first encryption key parameter from the database.
6. The method of claim 1 , wherein receiving the first encryption key parameter comprises receiving, from a user, the first encryption key parameter as a user input.
7. The method of claim 6 , further comprising:
receiving, from the application server, a request message associated with the first encryption key parameter; and
sending, to the user, a call out message requesting the first encryption key parameter based at least in part on the request message, wherein receiving, from the user, the first encryption key parameter is based at least in part on the call out message.
8. The method of claim 6 , wherein the first encryption key parameter is received from the user based at least in part on an upload periodicity or an upload schedule.
9. The method of claim 6 , further comprising:
sending, to the user, a first call out message requesting the first encryption key parameter, wherein receiving, from the user, the first encryption key parameter is based at least in part on the first call out message; and
sending, to the user, a second call out message requesting an updated encryption key parameter based at least in part on a time-to-live parameter or a destruction request message received from the user.
10. The method of claim 6 , further comprising:
determining whether the first encryption key parameter comprises a tenant-specific encryption key or a tenant secret based at least in part on metadata associated with the user input.
11. The method of claim 1 , wherein the encrypted encryption key is encrypted using a key wrap algorithm.
12. A method for data encryption, comprising:
receiving, from a distributed cache, an encrypted encryption key, wherein the encrypted encryption key comprises a first encryption key encrypted using a second encryption key;
attempting to retrieve, at an application server, the second encryption key from a local cache of the application server;
determining that the second encryption key is not stored in the local cache of the application server;
retrieving, from a database, a second encryption key parameter for the second encryption key;
transmitting, to a key derivation server, the second encryption key parameter;
receiving, from the key derivation server and at the application server, the second encryption key;
decrypting the encrypted encryption key using the second encryption key to obtain the first encryption key; and
transmitting the first encryption key to another application server or an application.
13. The method of claim 12 , further comprising:
receiving a first request message for the first encryption key; and
transmitting, to the distributed cache, a second request message for the first encryption key.
14. The method of claim 12 , further comprising:
storing the second encryption key in the local cache of the application server based at least in part on receiving, from the key derivation server, the second encryption key; and
retrieving the second encryption key from the local cache of the application server.
15. The method of claim 12 , further comprising:
receiving a first destruction request message for the first encryption key; and
sending, to the distributed cache, a second destruction request message for the first encryption key based at least in part on the first destruction request message.
16. The method of claim 14 , further comprising:
removing the second encryption key from the local cache based at least in part on a least recently used (LRU) algorithm.
17. The method of claim 12 , wherein:
the first encryption key comprises a data encryption key (DEK); and
the second encryption key comprises a key encryption key (KEK).
18. An apparatus for data encryption, comprising:
a processor;
memory in electronic communication with the processor; and
instructions stored in the memory and operable, when executed by the processor, to cause the apparatus to:
receive, at a distributed cache, a data encryption key request;
receive, at the distributed cache, a first encryption key parameter associated with a tenant and based at least in part on receiving the data encryption key request;
receive, at the distributed cache or an application server, a second encryption key parameter associated with the first encryption key parameter;
transmit, to a key derivation server, the first encryption key parameter and the second encryption key parameter;
receive, from the key derivation server, an encrypted encryption key associated with the first encryption key parameter and encrypted using an encryption key associated with the second encryption key parameter; and
transmit, to the application server, the encrypted encryption key in response to the data encryption key request.
19. The apparatus of claim 18 , wherein the instructions are further executable by the processor to:
store, at the distributed cache, the encrypted encryption key;
receive, from the application server, an additional data encryption key request for the encrypted encryption key; and
transmit, to the application server, the encrypted encryption key based at least in part on the additional data encryption key request and storing the encrypted encryption key at the distributed cache.
20. An apparatus for data encryption, comprising:
a processor;
memory in electronic communication with the processor; and
instructions stored in the memory and operable, when executed by the processor, to cause the apparatus to:
receive, from a distributed cache, an encrypted encryption key, wherein the encrypted encryption key comprises a first encryption key encrypted using a second encryption key;
attempt to retrieve, at an application server, the second encryption key from a local cache of the application server;
determine that the second encryption key is not stored in the local cache of the application server;
retrieve, from a database, a second encryption key parameter for the second encryption key;
transmit, to a key derivation server, the second encryption key parameter;
receive, from the key derivation server and at the application server, the second encryption key;
decrypt the encrypted encryption key using the second encryption key to obtain the first encryption key; and
transmit the first encryption key to another application server or an application.