Lightweight key management system for multi-tenant cloud environment

1. A method for key management, the method comprising:

generating a root key pair including a public key and a private key;

generating metadata for keys associated with a tenant, wherein the metadata includes a key tag, a key version, and a tenant identifier;

deriving a tenant key from the root key pair and the metadata; and

outputting the tenant key.

2. The method of claim 1 , wherein the tenant identifier is immutable once a user session is established.

3. The method of claim 1 , wherein the tenant key is derived on-the-fly during runtime.

4. The method of claim 1 , wherein deriving the tenant key further comprises:

validating input parameters including the tenant identifier, the key tag and the key version;

determining a length of the tenant identifier;

determining a length of the key tag;

generating a random number for the key version;

computing a first message digest based on a secure hash algorithm (SHA) using the input parameters, the length of the tenant identifier, the length of the key tag, and the random number for the key version;

signing the first message digest with the private key to produce a digital signature;

computing a second message digest using the digital signature; and

truncating the second message digest to produce a key value of the tenant key.

5. The method of claim 1 , further comprising performing data encryption using the tenant key, including:

encrypting data using the tenant key to obtain encrypted data;

determining a key tag and a key version associated with the tenant key;

concatenating the key tag and the key version with the encrypted data; and

storing the concatenation in a data store.

6. The method of claim 5 , further comprising performing data decryption using the tenant key, including:

removing the key tag and the key version from the encrypted data;

retrieving the tenant key corresponding to the key tag and the key version; and

decrypting the encrypted data to plaintext.

7. The method of claim 1 , wherein the metadata includes a refresh period indicating a predetermined period of time after which the key version is incremented.

8. A system comprising:

a processor; and

a memory in communication with the processor, the memory storing program instructions, the processor operative with the program instructions to perform the operations of:

generating a root key pair including a public key and a private key;

generating metadata for keys associated with a tenant, wherein the metadata includes a key tag, a key version, and a tenant identifier that is immutable once a user session is established;

deriving a tenant key from the root key pair and the metadata; and

outputting the tenant key.

9. The system of claim 8 , wherein the tenant key is derived on-the-fly during runtime.

10. The system of claim 8 , wherein deriving the tenant key further comprises:

validating input parameters including the tenant identifier, the key tag and the key version;

determining a length of the tenant identifier;

determining a length of the key tag;

generating a random number for the key version;

computing a first message digest based on a secure hash algorithm (SHA) using a concatenation of the input parameters, the length of the tenant identifier, the length of the key tag, and the random number for the key version;

signing the first message digest with the private key to produce a digital signature;

computing a second message digest using the digital signature; and

truncating the second message digest to produce a key value of the tenant key.

11. The system of claim 8 , further comprising performing data encryption using the tenant key, including:

encrypting data using the tenant key to obtain encrypted data;

determining a key tag and a key version associated with the tenant key;

concatenating the key tag and the key version with the encrypted data; and

storing the concatenation in a data store.

12. The system of claim 11 , further comprising performing data decryption using the tenant key, including:

removing the key tag and the key version from the encrypted data;

retrieving the tenant key corresponding to the key tag and the key version; and

decrypting the encrypted data to plaintext.

13. The system of claim 8 , wherein the metadata includes a refresh period indicating a predetermined period of time after which the key version is incremented.

14. A non-transitory computer readable medium having stored therein instructions that when executed cause a computer to perform a method comprising:

generating a root key pair including a public key and a private key;

generating metadata for keys associated with a tenant, wherein the metadata includes a key tag, a key version, and a tenant identifier;

deriving a tenant key from the root key pair and the metadata; and

outputting the tenant key.

15. The non-transitory computer-readable medium of claim 14 , wherein the tenant identifier is immutable once a user session is established.

16. The non-transitory computer-readable medium of claim 14 , wherein the tenant key is derived on-the-fly during runtime.

17. The non-transitory computer-readable medium of claim 14 , wherein deriving the tenant key further comprises:

validating input parameters including the tenant identifier, the key tag and the key version;

determining a length of the tenant identifier;

determining a length of the key tag;

generating a random number for the key version;

computing a first message digest based on a secure hash algorithm (SHA) using the input parameters, the length of the tenant identifier, the length of the key tag, and the random number for the key version;

signing the first message digest with the private key to produce a digital signature;

computing a second message digest using the digital signature; and

truncating the second message digest to produce a key value of the tenant key.

18. The non-transitory computer-readable medium of claim 14 , further comprising performing data encryption using the tenant key, including:

encrypting data using the tenant key to obtain encrypted data;

determining a key tag and a key version associated with the tenant key;

concatenating the key tag and the key version with the encrypted data; and

storing the concatenation in a data store.

19. The non-transitory computer-readable medium of claim 18 , further comprising performing data decryption using the tenant key, including:

removing the key tag and the key version from the encrypted data;

retrieving the tenant key corresponding to the key tag and the key version; and

decrypting the encrypted data to plaintext.

20. The non-transitory computer-readable medium of claim 14 , wherein the metadata includes a refresh period indicating a predetermined period of time after which the key version is incremented.