Abstract: Embodiments are directed towards enabling cryptographic key rotation without disrupting cryptographic operations. If key rotation is initiated, a transitional key may be generated by encrypting the current key with a built-in system key. A new key may be generated based one at least one determined key parameter. Next, the new key may be activated by the one or more key holders. If the new key is activated, it may be designated as the new current key. The new current key may be employed to encrypt the transitional key and store it in a key array. Each additional rotated key may be stored in the key array after it is encrypted by the current cryptographic key. Further, in response to a submission of an unencrypted query value, one or more encrypted values that correspond to a determined number of rotated cryptographic keys are generated.

Abstract: Embodiments are directed towards providing cryptographic services to protect guest operating system (OS) images in virtualized computing environments. A hypervisor may trap privileged operations initiated by guest OS images. These trapped operations may be intercepted by a cryptographic module. A hypervisor may trap a write operation made by a guest OS image, and cryptographic module may encrypt the write buffer and return it the hypervisor. A hypervisor may trap a read operation made by a guest OS image, and provide the encrypted data to the cryptographic module for decrypting. If the data is decrypted, the cryptographic module may provide the decrypted data to the hypervisor which provides the decrypted data to the guest OS image. Also, guest OS image context information may be decrypted and encrypted as the guest OS image is scheduled and de-scheduled on physical CPU(s). Further, if necessary entire guest OS images may be encrypted.

Abstract: Embodiments are directed towards providing cryptographic services to protect guest operating system (OS) images in virtualized computing environments. A hypervisor may trap privileged operations initiated by guest OS images. These trapped operations may be intercepted by a cryptographic module. A hypervisor may trap a write operation made by a guest OS image, and cryptographic module may encrypt the write buffer and return it the hypervisor. A hypervisor may trap a read operation made by a guest OS image, and provide the encrypted data to the cryptographic module for decrypting. If the data is decrypted, the cryptographic module may provide the decrypted data to the hypervisor which provides the decrypted data to the guest OS image. Also, guest OS image context information may be decrypted and encrypted as the guest OS image is scheduled and de-scheduled on physical CPU(s). Further, if necessary entire guest OS images may be encrypted.

Abstract: Embodiments are directed towards enabling cryptographic key rotation without disrupting cryptographic operations. If key rotation is initiated, a transitional key may be generated by encrypting the current key with a built-in system key. A new key may be generated based one at least one determined key parameter. Next, the new key may be activated by the one or more key holders. If the new key is activated, it may be designated as the new current key. The new current key may be employed to encrypt the transitional key and store it in a key array. Each additional rotated key may be stored in the key array after it is encrypted by the current cryptographic key. Further, in response to a submission of an unencrypted query value, one or more encrypted values that correspond to a determined number of rotated cryptographic keys are generated.

Abstract: Embodiments are directed towards enabling cryptographic key rotation without disrupting cryptographic operations. If key rotation is initiated, a transitional key may be generated by encrypting the current key with a built-in system key. A new key may be generated based one at least one determined key parameter. Next, the new key may be activated by the one or more key holders. If the new key is activated, it may be designated as the new current key. The new current key may be employed to encrypt the transitional key and store it in a key array. Each additional rotated key may be stored in the key array after it is encrypted by the current cryptographic key. Further, in response to a submission of an unencrypted query value, one or more encrypted values that correspond to a determined number of rotated cryptographic keys are generated.

Abstract: Embodiments are directed towards enabling cryptographic key management without disrupting cryptographic operations. Embodiments may be employed to generate cryptographic keys based on at least one key parameter that may be provided by an administrator. The administrator may generate key managers and key request users that may be linked to particular cryptographic keys. The cryptographic keys may be stored on key exchange servers separate from the key management server. Responsive to a request for a cryptographic key, the key exchange servers may authenticate the key request user associated with the request. The key request may be validated based on at least one key parameter and a portion of the key request. The key exchange server may generate the requested cryptographic keys providing them to the key request user over the network.

Abstract: Embodiments are directed towards enabling cryptographic key management without disrupting cryptographic operations. Embodiments may be employed to generate cryptographic keys based on at least one key parameter that may be provided by an administrator. The administrator may generate key managers and key request users that may be linked to particular cryptographic keys. The cryptographic keys may be stored on key exchange servers separate from the key management server. Responsive to a request for a cryptographic key, the key exchange servers may authenticate the key request user associated with the request. The key request may be validated based on at least one key parameter and a portion of the key request. The key exchange server may generate the requested cryptographic keys providing them to the key request user over the network.

Abstract: Embodiments are directed towards enabling cryptographic key rotation without disrupting cryptographic operations. If key rotation is initiated, a transitional key may be generated by encrypting the current key with a built-in system key. A new key may be generated based one at least one determined key parameter. Next, the new key may be activated by the one or more key holders. If the new key is activated, it may be designated as the new current key. The new current key may be employed to encrypt the transitional key and store it in a key array. Each additional rotated key may be stored in the key array after it is encrypted by the current cryptographic key. Further, in response to a submission of an unencrypted query value, one or more encrypted values that correspond to a determined number of rotated cryptographic keys are generated.