FIELD

One embodiment is directed generally to a cloud based computer system, and in particular to the management of cryptographic keys in a cloud based computer system.

BACKGROUND INFORMATION

A key management service (“KMS”) provides for the management of cryptographic keys in a cryptosystem. Management includes the functions of the generation, exchange, storage, use, crypto-shredding (i.e., destruction) and replacement of keys. It includes cryptographic protocol design, key servers, user procedures, and other relevant protocols.

The keys in a KMS are logical entities that represent one or more key versions that contain the cryptographic material used to encrypt and decrypt data, protecting the data where it is stored. When processed as part of an encryption algorithm, a key specifies how to transform plaintext into ciphertext during encryption and how to transform ciphertext into plaintext during decryption. A KMS in general recognizes two types of encryption keys: a master encryption key (“MEK”) and a data encryption key (“DEK”). After a user has created a master encryption key using the KMS, the user can then use an API to generate data encryption keys that the KMS returns to the user. A KMS returns a raw key and a wrapped key. Typically, the user will only store the wrapped key.

SUMMARY

Embodiments are directed to managing cryptographic keys in a multi-tenant cloud based system. Embodiments receive from a client a request for a wrapped data encryption key (“DEK”). Embodiments generate a random key and fetch encryption context that corresponds to the client. Embodiments generate the wrapped DEK including the random key and the encryption context encoded in the wrapped DEK. Embodiments then return the wrapped DEK to the client.

