Patent attributes
Disclosed is a highly available distributed key management system (KMS). The system receives a request for an encrypted data encryption key (DEK) from a user at an instance of the KMS. The instance of the KMS generates a blob that is signed with a symmetric key, and negotiated keys based on a key agreement scheme between the instance of the KMS and another instance of the KMS. The negotiation steps are performed using different public/private key pairings, while producing equivalent negotiated keys shared between KMS instances. This blob is sent to the user where it is stored by the user. Subsequently, when the user needs a decrypted DEK, the user may send this blob to any instance of the KMS and obtain a decrypted DEK for use in encrypting user data.
