Processing data queries in a logically sharded data store
The present disclosure relates to processing data queries on a logically sharded data store. An example method generally includes receiving, from a client device, a query. The query generally comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data. A query processor obtains, from a key management server, a cryptographic key to use to encrypt the record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data. The query processor generates an encrypted query based on the query and the obtained cryptographic key and executes the encrypted query against the logically sharded database.
1. A method for executing queries against a logically sharded database, comprising:
receiving, from a client device, a query, wherein the query comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data;
obtaining, from a key management server, a cryptographic key to use to encrypt a record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data;
generating an encrypted query based on the query and the obtained cryptographic key; and
executing the encrypted query against the logically sharded database.
2. The method of claim 1 , wherein obtaining the cryptographic key comprises:
invoking a key derivation process at a key management server by transmitting a truncated hash and the type of the sensitive data; and
receiving the cryptographic key from the key management server.
3. The method of claim 1 , wherein the query comprises a write query, and wherein generating the encrypted query comprises encrypting the at least one of the one or more data items using the obtained cryptographic key.
4. The method of claim 1 , wherein the query comprises a search query.
5. The method of claim 4 , wherein obtaining the cryptographic key comprises:
determining, based on a flag associated with the type of the sensitive data and a truncated version of the derived data, that a key rotation procedure is executing on records associated with the truncated version of the derived data;
requesting a first cryptographic key associated with a current base key and a second cryptographic key associated with a replacement base key; and
receiving the first and second cryptographic keys from the key management server.
6. The method of claim 5 , wherein generating the encrypted query comprises generating a query including a first parameter comprising a value of the sensitive data encrypted using the first cryptographic key and a second parameter comprising a value of the sensitive data encrypted using the second cryptographic key.
7. The method of claim 6 , further comprising:
receiving an encrypted search result in response to the encrypted query;
upon determining that the encrypted search result is encrypted using the first cryptographic key, decrypting the encrypted search result using the first cryptographic key; and
upon determining that the encrypted search result is encrypted using the second cryptographic key, decrypting the encrypted search result using the second cryptographic key.
8. The method of claim 4 , further comprising:
receiving an encrypted search result in response to executing the encrypted query;
decrypting the encrypted search result using the cryptographic key; and
transmitting the decrypted search result to the client device.
9. A system, comprising:
a processor; and
a memory having instructions stored thereon which, when executed by the processor, performs an operation for executing queries against a logically sharded database, the operation comprising:
receiving, from a client device, a query, wherein the query comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data;
obtaining, from a key management server, a cryptographic key to use to encrypt a record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data;
generating an encrypted query based on the query and the obtained cryptographic key; and
executing the encrypted query against the logically sharded database.
10. The system of claim 9 , wherein obtaining the cryptographic key comprises:
invoking a key derivation process at a key management server by transmitting a truncated hash and the type of the sensitive data; and
receiving the cryptographic key from the key management server.
11. The system of claim 9 , wherein the query comprises a write query, and wherein generating the encrypted query comprises encrypting the at least one of the one or more data items using the obtained cryptographic key.
12. The system of claim 9 , wherein the query comprises a search query.
13. The system of claim 12 , wherein obtaining the cryptographic key comprises:
determining, based on a flag associated with the type of the sensitive data and a truncated version of the derived data, that a key rotation procedure is executing on records associated with the truncated version of the derived data;
requesting a first cryptographic key associated with a current base key and a second cryptographic key associated with a replacement base key; and
receiving the first and second cryptographic keys from the key management server.
14. The system of claim 13 , wherein generating the encrypted query comprises generating a query including a first parameter comprising a value of the sensitive data encrypted using the first cryptographic key and a second parameter comprising a value of the sensitive data encrypted using the second cryptographic key.
15. The system of claim 14 , wherein the operations further comprise:
receiving an encrypted search result in response to the encrypted query;
upon determining that the encrypted search result is encrypted using the first cryptographic key, decrypting the encrypted search result using the first cryptographic key; and
upon determining that the encrypted search result is encrypted using the second cryptographic key, decrypting the encrypted search result using the second cryptographic key.
16. The system of claim 12 , further comprising:
receiving an encrypted search result in response to executing the encrypted query;
decrypting the encrypted search result using the cryptographic key; and
transmitting the decrypted search result to the client device.
17. A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, performs an operation for executing queries against a logically sharded database, the operation comprising:
receiving, from a client device, a query, wherein the query comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data;
obtaining, from a key management server, a cryptographic key to use to encrypt record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data;
generating an encrypted query based on the query and the obtained cryptographic key; and
executing the encrypted query against the logically sharded database.
18. The non-transitory computer-readable medium of claim 17 , wherein the query comprises a write query, and wherein generating the encrypted query comprises encrypting the at least one of the one or more data items using the obtained cryptographic key.
19. The non-transitory computer-readable medium of claim 17 , wherein the query comprises a search query, and wherein obtaining the cryptographic key comprises:
determining, based on a flag associated with the type of the sensitive data and a truncated version of the derived data, that a key rotation procedure is executing on records associated with the truncated version of the derived data;
requesting a first cryptographic key associated with a current base key and a second cryptographic key associated with a replacement base key; and
receiving the first and second cryptographic keys from the key management server.
20. The non-transitory computer-readable medium of claim 19 , wherein generating the encrypted query comprises generating a query including a first parameter comprising a value of the sensitive data encrypted using the first cryptographic key and a second parameter comprising a value of the sensitive data encrypted using the second cryptographic key.