US 12,395,314 B2
Systems and methods for minimizing impact of breach of encryption and signing keys in multi-cloud environments
Reetu Bok, Philadelphia, PA (US); Dipti Ahuja, Basking Ridge, NJ (US); Bipin More, Edison, NJ (US); Neeraj Tati, Fremont, CA (US); and Valanka Fernandes, Edison, NJ (US)
Assigned to JPMORGAN CHASE BANK, N.A., New York, NY (US)
Filed by JPMORGAN CHASE BANK, N.A., New York, NY (US)
Filed on Dec. 14, 2022, as Appl. No. 18/066,116.
Prior Publication US 2024/0204985 A1, Jun. 20, 2024
Int. Cl. H04L 9/00 (2022.01); H04L 9/06 (2006.01); H04L 9/08 (2006.01); H04L 9/14 (2006.01)
CPC H04L 9/002 (2013.01) [H04L 9/0631 (2013.01); H04L 9/0822 (2013.01); H04L 9/0825 (2013.01); H04L 9/0894 (2013.01); H04L 9/14 (2013.01)] 12 Claims
OG exemplary drawing
 
1. A method for generating keys, comprising:
generating, by a computer program executed by a first cloud environment, a first key encryption key and storing the first key encryption key in a first cloud environment key management service;
generating, by the computer program, a first data encryption key using the first cloud environment key management service;
generating, by the computer program, a second data encryption key for a second cloud environment using the first cloud environment key management service;
encrypting, by the computer program, the first data encryption key with the first key encryption key and the second data encryption key with the first key encryption key;
storing, by the computer program, the first data encryption key encrypted with the first key encryption key and the second data encryption key encrypted with the first key encryption key in a database of the first cloud environment;
generating, by the computer program, a second key encryption key and storing the second key encryption key in a second cloud environment key management service;
receiving, at a load balancer computer program for the first cloud environment and the second cloud environment and from a consumer application, a first consumer application request to encrypt a data;
determining, by the load balancer program via a check, a key breach of the first cloud environment to the load balancer computer program;
routing, by the load balancer computer program, the first consumer application request and the data to one of the cloud environments based on a routing rule, wherein the load balancer routes the first consumer application request to the second cloud environment on the basis that the second cloud environment is not undergoing healing;
retrieving, by an application instance in the second cloud environment, the first data encryption key from the database for the second cloud environment;
decrypting, by the application instance and with a key encryption key for the second cloud environment, the first data encryption key;
encrypting, by the application instance, the data with the decrypted first data encryption key;
returning, by the application instance, the data encrypted with the decrypted first data encryption key to the consumer application;
encrypting, by the computer program, the first data encryption key with the second key encryption key and the second data encryption key with the second key encryption key; and
storing, by the computer program, the first data encryption key encrypted with the second key encryption key and the second data encryption key encrypted with the second key encryption key in the database of the second cloud environment.