Systems and methods for hierarchical key management in encrypted distributed databases
According to one aspect, methods and systems are provided for modifying an encryption scheme in a database system. The methods and systems can include at least one internal database key; at least one database configured to be encrypted and decrypted using the at least one internal database key; a memory configured to store a master key; a key management server interface configured to communicate with a key management server; and a database application configured to receive, into the memory, the master key from the key management server via the key management server interface, and encrypt and decrypt the at least one internal database key using the master key.
1. A method for modifying an encryption scheme of a database system, comprising acts of:
selecting a first secondary node of a replica set, the replica set comprising at least a primary node and a plurality of secondary nodes, and disabling read and write access to at least one database instance hosted on the first secondary node of the replica set;
decrypting an internal database key using a first master key for the at least one database instance on the node of a replica set;
obtaining a second master key via a key management interface;
for the at least one database on the first secondary node of the replica set, encrypting the internal database key using the second master key;
restoring read and write access to the first secondary node of the replica set;
triggering key rotation for the other nodes of the replica set responsive to validating proper encryption of a prior node of the replica set; and
wherein the act of triggering key rotation for the other nodes of the replica set includes executing key rotation on at least one secondary node of the replica set prior to executing key rotation on a respective primary node.
2. The method of claim 1 , further comprising an act of limiting key rotation operations to a node and an associated database within a respective replica set.
3. The method of claim 1 , wherein responsive to validating proper execution of key rotation on the secondary nodes of the replica set, triggering key rotation on the primary node.
4. The method of claim 3 , wherein triggering key rotation on the at least one primary node includes:
demoting the primary node to a secondary node:
automatically electing a new primary from the secondary nodes on which key rotation has been executed; and
disabling read write access to the demoted primary node.
5. The method of claim 1 , further comprising an act of automatically obtaining the second master key from a key management server.
6. The method of claim 5 , wherein the act of automatically obtaining the second master key includes receiving the second master key via a key management interoperability protocol (KMIP) or via an Application Programming Interface (API), in communication with the key management server external to the database system.
7. The method of claim 1 , further comprising an act of automatically determining a key rotation operation should be executed.
8. The method of claim 1 , wherein the act of obtaining a second master key via a key management interface includes an act of obtaining at least one new internal key for the at least one database instance; and
wherein the act of encrypting the internal database key using the second master key is executed responsive to validating an act of re-encrypting the at least one database instance with the new at least one internal key.
9. The method of claim 8 , further comprising an act of generating a duplicate secondary node responsive scheduling an internal key rotation operation.
10. The method of claim 9 , further comprising an act of executing key rotation on the duplicate secondary node.
11. A system for modifying an encryption scheme of a database system, the system comprising:
at least one processor operatively connected to a memory, the at least one processor when executing configured to:
select a first secondary node of a replica set, the replica set comprising at least a primary node and a plurality of secondary nodes, and disable read and write access to at least one database instance hosted on the first secondary node of the replica set;
decrypt an internal database key using a first master key for the at least one database instance on the node of a replica set;
obtain a second master key via a key management interface;
for the at least one database on the first secondary node of the replica set,
encrypt the internal database key using the second master key;
restore read and write access to the first secondary node of the replica set; and
trigger key rotation for the other nodes of the replica set responsive to validating proper encryption of a prior node of the replica set,
wherein the act of triggering key rotation for the other nodes of the replica set includes executing key rotation on at least one secondary node of the replica set prior to executing key rotation on a respective primary node.
12. The system of claim 11 , wherein the at least one processor is configured to limit key rotation operations to a node and an associated database within a respective replica set.
13. The system of claim 12 , wherein the at least one processor is configured to trigger key rotation on the primary node responsive to validation of proper execution of key rotation on the secondary nodes of the replica set.
14. The system of claim 13 , wherein the operation to trigger key rotation on the primary node includes operations to:
demote the primary node to a secondary node:
automatically elect a new primary from the secondary nodes on which key rotation has been executed; and
disable read write access to the demoted primary node.
15. The system of claim 11 , wherein the at least one processor is configured to automatically obtain the second master key from a key management server.
16. The system of claim 15 , wherein the operation to automatically obtain the second master key includes operations to receive the second master key via a key management interoperability protocol (KMIP) or via an Application Programming Interface (API), in communication with the key management server external to the database system.
17. The system of claim 11 , wherein the at least one processor is configured to automatically determine a key rotation operation should be executed.
18. The system of claim 11 , wherein the at least one processor is configured to obtain a second master key via a key management interface which includes an operation to obtain at least one new internal key for the at least one database instance; and
wherein the operation to encrypt the internal database key using the second master key is executed responsive to validating an act of re-encrypting the at least one database instance with the at least one new internal key.
19. The system of claim 18 , wherein the at least one processor is configured to generate a duplicate secondary node responsive scheduling an internal key rotation operation.
20. The method of claim 19 , wherein the at least one processor is configured execute key rotation on the duplicate secondary node.