Encrypting data records and processing encrypted records without exposing plaintext
A computer-implemented method of generating and distributing keys includes generating, based on a master key, a keyset, wherein the keyset comprises a re-encryption key, generating a key distribution request comprising the keyset, encrypting the keyset using an inbox key associated with a client device to generate an encrypted keyset, sending the re-encryption key to a key manager, and causing to distribute the encrypted keyset to the client device.
1. A computer-implemented method of generating and distributing keys, comprising:
generating, based on a master key, a keyset, wherein the keyset comprises a re-encryption key;
generating a key distribution request comprising the keyset;
encrypting the keyset using an inbox key associated with a client device to generate an encrypted keyset;
sending the re-encryption key to a key manager; and
causing to distribute the encrypted keyset to the client device.
2. The computer-implemented method of claim 1 , wherein the keyset further comprises a decryption key or a search key.
3. The computer-implemented method of claim 1 , wherein generating the keyset further comprises generating the re-encryption key.
4. The computer-implemented method of claim 3 , wherein generating the re-encryption key comprises generating the re-encryption key in encrypted form.
5. The computer-implemented method of claim 1 , wherein generating the key distribution request further comprises including a user identify, a device identity, or a key identity in the key distribution request.
6. The computer-implemented method of claim 1 , further comprising:
generating a second master key and a rotation key based on the master key;
receiving a key management record; and
wherein generating the key distribution request comprises generating the key distribution request based on the key management record and the second master key.
7. The computer-implemented method of claim 6 , further comprising sending the rotation key to a record updater.
8. The computer-implemented method of claim 1 , further comprising:
receiving the inbox key from a key distributer, wherein the inbox key comprises an inbox public key generated using an asymmetric encryption scheme from the client device.
9. A non-transitory, computer-readable medium storing a set of instructions that, when executed by a processor, cause:
generating, based on a master key, a keyset, wherein the keyset comprises a re-encryption key;
generating a key distribution request comprising the keyset;
encrypting the keyset using an inbox key associated with a client device to generate an encrypted keyset;
sending the re-encryption key to a key manager; and
causing to distribute the encrypted keyset to the client device.
10. The non-transitory, computer-readable medium of claim 9 , wherein the keyset further comprises a decryption key or a search key.
11. The non-transitory, computer-readable medium of claim 9 , wherein generating the keyset further comprises generating the re-encryption key.
12. The non-transitory, computer-readable medium of claim 11 , wherein generating the re-encryption key comprises generating the re-encryption key in encrypted form.
13. The non-transitory, computer-readable medium of claim 9 , wherein generating the key distribution request further comprises including a user identify, a device identity, or a key identity in the key distribution request.
14. The non-transitory, computer-readable medium of claim 9 , storing further instructions that, when executed by the processor, cause:
generating a second master key and a rotation key based on the master key;
receiving a key management record; and
wherein generating the key distribution request comprises generating the key distribution request based on the key management record and the second master key.
15. The non-transitory, computer-readable medium of claim 9 , storing further instructions that, when executed by the processor, cause:
receiving the inbox key from a key distributer, wherein the inbox key comprises an inbox public key generated using an asymmetric encryption scheme from the client device.
16. A system of generating and distributing keys, the system comprising:
a processor;
a memory operatively connected to the processor and storing instructions that, when executed by the processor, cause:
generating, based on a master key, a keyset, wherein the keyset comprises a re-encryption key;
generating a key distribution request comprising the keyset;
encrypting the keyset using an inbox key associated with a client device to generate an encrypted keyset;
sending the re-encryption key to a key manager; and
causing to distribute the encrypted keyset to the client device.
17. The system of claim 16 , wherein the keyset further comprises a decryption key or a search key.
18. The system of claim 16 , wherein generating the keyset further comprises generating the re-encryption key.
19. The system of claim 18 , wherein generating the re-encryption key comprises generating the re-encryption key in encrypted form.
20. The system of claim 16 , wherein generating the key distribution request further comprises including a user identity, a device identity, or a key identity in the key distribution request.
21. The system of claim 16 , wherein the memory stories further instructions that, when executed by the processor, cause:
generating a second master key and a rotation key based on the master key;
receiving a key management record; and
wherein generating the key distribution request comprises generating the key distribution request based on the key management record and the second master key.
22. The system of claim 21 , wherein the memory stories further instructions that, when executed by the processor, cause sending the rotation key to a record updater.
23. The system of claim 16 , wherein the memory stories further instructions that, when executed by the processor, cause:
receiving the inbox key from a key distributer, wherein the inbox key comprises an inbox public key generated using an asymmetric encryption scheme from the client device; and
wherein encrypting the keyset using the inbox key comprises encrypting using the inbox public key to generate the encrypted keyset.