Granted Patent B2

US 12,401,500 · App. 18/321,694 · Granted Aug 26, 2025

Inventors: Derek Chamorro (Austin, TX); Michael Pak (Portland, OR); Ignat Korchagin (Orpington, GB); Chase Robinson (San Francisco, CA)

Assignee: CLOUDFLARE, INC.

H04L9/083

Abstract

Claims (62)

1. A method, comprising:

receiving, at a first one of a plurality of intermediate key management system (KMS) servers of a distributed KMS, a first KMS service request from a first KMS client, wherein each of the plurality of intermediate KMS servers is capable of servicing the first KMS service request;

determining, at the first intermediate KMS server, that the first intermediate KMS server does not have local access to a first managed key that is capable of performing an action requested in the first KMS service request;

transmitting, from the first intermediate KMS server to a central KMS server of the distributed KMS, a query for the first managed key;

receiving, from the central KMS server at the first intermediate KMS server, the first managed key;

performing, at the first intermediate KMS server, the action requested in the first KMS service request using the first managed key;

transmitting, from the first intermediate KMS server to the first KMS client, a response to the first KMS service request that includes a result of the performed action using the first managed key;

receiving, at the first one of the plurality of intermediate KMS servers from a second one of the plurality of intermediate KMS servers, a second managed key;

receiving, at the first one of the plurality of intermediate KMS servers, a second KMS service request from a second KMS client, wherein each of the plurality of intermediate KMS servers is capable of servicing the second KMS service request, and wherein the first intermediate KMS server is closest to the second KMS client out of the plurality of intermediate KMS servers;

determining, at the first intermediate KMS server, that the first intermediate KMS server has access to the second managed key that is capable of performing an action requested in the second KMS service request;

performing, at the first intermediate KMS server, the action requested in the second KMS service request using the second managed key; and

transmitting, from the first intermediate KMS server to the second KMS client, a response to the second KMS service request that includes a result of the performed action using the second managed key.

2. The method of claim 1 , further comprising:

receiving, at the first one of the plurality of intermediate key management system (KMS) servers of the distributed KMS from the central KMS server, a policy associated with the first managed key; and

enforcing the policy that is associated with the first managed key prior to performing the action requested in the first KMS service request using the first managed key.

3. The method of claim 2 , wherein enforcing policy includes:

determining an identity associated with the first KMS service request; and

determining that the action requested in the first KMS service request is allowed for the determined identity.

4. The method of claim 1 , wherein the first intermediate KMS server is closest to the first KMS client out of the plurality of intermediate KMS servers.

5. The method of claim 1 , wherein the first intermediate KMS server is part of a same datacenter as the first KMS client.

6. The method of claim 1 , wherein the first KMS client is a compute server in a distributed cloud computing network.

7. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, will cause operations to be performed including:

receiving, at a first one of a plurality of intermediate key management system (KMS) servers of a distributed KMS, a first KMS service request from a first KMS client, wherein each of the plurality of intermediate KMS servers is capable of servicing the first KMS service request;

determining, at the first intermediate KMS server, that the first intermediate KMS server does not have local access to a first managed key that is capable of performing an action requested in the first KMS service request;

transmitting, from the first intermediate KMS server to a central KMS server of the distributed KMS, a query for the first managed key;

receiving, from the central KMS server at the first intermediate KMS server, the first managed key;

performing, at the first intermediate KMS server, the action requested in the first KMS service request using the first managed key;

transmitting, from the first intermediate KMS server to the first KMS client, a response to the first KMS service request that includes a result of the performed action using the first managed key;

receiving, at the first one of the plurality of intermediate KMS servers from a second one of the plurality of intermediate KMS servers, a second managed key;

receiving, at the first one of the plurality of intermediate KMS servers, a second KMS service request from a second KMS client, wherein each of the plurality of intermediate KMS servers is capable of servicing the second KMS service request, and wherein the first intermediate KMS server is closest to the second KMS client out of the plurality of intermediate KMS servers;

determining, at the first intermediate KMS server, that the first intermediate KMS server has access to the second managed key that is capable of performing an action requested in the second KMS service request;

performing, at the first intermediate KMS server, the action requested in the second KMS service request using the second managed key; and

transmitting, from the first intermediate KMS server to the second KMS client, a response to the second KMS service request that includes a result of the performed action using the second managed key.

8. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further comprise:

receiving, at the first one of the plurality of intermediate key management system (KMS) servers of the distributed KMS from the central KMS server, a policy associated with the first managed key; and

enforcing the policy that is associated with the first managed key prior to performing the action requested in the first KMS service request using the first managed key.

9. The non-transitory machine-readable storage medium of claim 8 , wherein enforcing policy includes:

determining an identity associated with the first KMS service request; and

determining that the action requested in the first KMS service request is allowed for the determined identity.

10. The non-transitory machine-readable storage medium of claim 7 , wherein the first intermediate KMS server is closest to the first KMS client out of the plurality of intermediate KMS servers.

11. The non-transitory machine-readable storage medium of claim 7 , wherein the first intermediate KMS server is part of a same datacenter as the first KMS client.

12. The non-transitory machine-readable storage medium of claim 7 , wherein the first KMS client is a compute server in a distributed cloud computing network.

13. A first intermediate key management system (KMS) server of a plurality of intermediate KMS servers of a distributed KMS, comprising:

a processor; and

a non-transitory machine-readable storage medium that provides instructions that, when executed by the processor, will cause the first intermediate KMS server to carry out operations including:

receiving, at the first one of the plurality of intermediate KMS servers, a first KMS service request from a first KMS client, wherein each of the plurality of intermediate KMS servers is capable of servicing the first KMS service request;

determining, at the first intermediate KMS server, that the first intermediate KMS server does not have local access to a first managed key that is capable of performing an action requested in the first KMS service request;

transmitting, from the first intermediate KMS server to a central KMS server of the distributed KMS, a query for the first managed key;

receiving, from the central KMS server at the first intermediate KMS server, the first managed key;

performing, at the first intermediate KMS server, the action requested in the first KMS service request using the first managed key;

transmitting, from the first intermediate KMS server to the first KMS client, a response to the first KMS service request that includes a result of the performed action using the first managed key;

receiving, at the first intermediate KMS server from a second one of the plurality of intermediate KMS servers, a second managed key;

receiving, at the first intermediate KMS server, a second KMS service request from a second KMS client, wherein each of the plurality of intermediate KMS servers is capable of servicing the second KMS service request, and wherein the first intermediate KMS server is closest to the second KMS client out of the plurality of intermediate KMS servers;

determining, at the first intermediate KMS server, that the first intermediate KMS server has access to the second managed key that is capable of performing an action requested in the second KMS service request;

performing, at the first intermediate KMS server, the action requested in the second KMS service request using the second managed key; and

transmitting, from the first intermediate KMS server to the second KMS client, a response to the second KMS service request that includes a result of the performed action using the second managed key.

14. The first intermediate KMS server of claim 13 , wherein the operations further comprise:

receiving, at the first intermediate KMS server from the central KMS server, a policy associated with the first managed key; and

enforcing the policy that is associated with the first managed key prior to performing the action requested in the first KMS service request using the first managed key.

15. The first intermediate KMS server of claim 14 , wherein enforcing policy includes:

determining an identity associated with the first KMS service request; and

determining that the action requested in the first KMS service request is allowed for the determined identity.

Assignments (2)

Continuity (2)

References Cited (27)