Abstract: Techniques are provided to import a cryptographic key into a key vault in which an application programming interface for the key vault does not support importing existing cryptographic keys into the key vault. A key management system obtains a cryptographic key from a first key vault. The cryptographic key includes a key value and attributes which describe the cryptographic key. The key management system imports the cryptographic key into a second key vault by generating a surrogate key in the second key vault which corresponds to the cryptographic key. The surrogate key includes a key attribute having a value which corresponds to the key value of the cryptographic key.

Abstract: Techniques are provided to import a cryptographic key into a key vault in which an application programming interface for the key vault does not support importing existing cryptographic keys into the key vault. A key management system obtains a cryptographic key from a first key vault. The cryptographic key includes a key value and attributes which describe the cryptographic key. The key management system imports the cryptographic key into a second key vault by generating a surrogate key in the second key vault which corresponds to the cryptographic key. The surrogate key includes a key attribute having a value which corresponds to the key value of the cryptographic key.

Abstract: Techniques are provided to implement a key management service using key proxies and generational indexes, which allows client applications to obtain data cryptographic services without having to utilize or otherwise have knowledge of cryptographic keys. For example, a key management service receives a data decryption request from a client application. The data decryption request includes encrypted data and a key proxy assigned to the client application. The key management service determines a generational index associated with the encrypted data. The generational index identifies a generation of a cryptographic key which is associated with the key proxy and which was used to create the encrypted data. The key management service obtains a cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index, decrypts the encrypted data using the obtained cryptographic key, and sends the decrypted data to the client application.

Abstract: Techniques are presented for (a) securely maintaining, by a computing device, a set of correspondences between encryption keys and key identifiers, (b) receiving, by the computing device, a cryptographic request from a remote device received across the network, the cryptographic request including credentials, data to be cryptographically processed, and a key identifier to be used for cryptographic processing, and (c) in response to successfully authenticating the cryptographic request: (1) obtaining, by the computing device with reference to the set of correspondences, an encryption key corresponding to the key identifier, (2) cryptographically processing, by the computing device, the received data using the obtained encryption key to generate cryptographically-processed data, and (3) sending the cryptographically-processed data from the computing device across the network to the remote device.

Abstract: Techniques are provided to implement a key management service using key proxies and generational indexes, which allows client applications to obtain data cryptographic services without having to utilize or otherwise have knowledge of cryptographic keys. For example, a key management service receives a data decryption request from a client application. The data decryption request includes encrypted data and a key proxy assigned to the client application. The key management service determines a generational index associated with the encrypted data. The generational index identifies a generation of a cryptographic key which is associated with the key proxy and which was used to create the encrypted data. The key management service obtains a cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index, decrypts the encrypted data using the obtained cryptographic key, and sends the decrypted data to the client application.

Abstract: Techniques are presented for (a) securely maintaining, by a computing device, a set of correspondences between encryption keys and key identifiers, (b) receiving, by the computing device, a cryptographic request from a remote device received across the network, the cryptographic request including credentials, data to be cryptographically processed, and a key identifier to be used for cryptographic processing, and (c) in response to successfully authenticating the cryptographic request: (1) obtaining, by the computing device with reference to the set of correspondences, an encryption key corresponding to the key identifier, (2) cryptographically processing, by the computing device, the received data using the obtained encryption key to generate cryptographically-processed data, and (3) sending the cryptographically-processed data from the computing device across the network to the remote device.

Abstract: Event management techniques for use in a computer system comprising an event generating component generating at least one event and an event handling component to apply one or more business process rules in response to the event. In one embodiment of the invention, an event generation component provides to an event handling component not only notification of an event but also context information about the event, in the same communication. The context information may provide all the information necessary for the event handling component to apply one or more business policy rules to determine how to handle the event. In some implementations having multiple event handling components of different types, the event generating component may be configured to provide notification of events to the event handling components in a specified order. In some implementations, multiple event handling components may be joined in a logical pool, sharing responsibility for handling events.

Abstract: Event management techniques for use in a computer system comprising an event generating component generating at least one event and an event handling component to apply one or more business process rules in response to the event. In one embodiment of the invention, an event generation component provides to an event handling component not only notification of an event but also context information about the event, in the same communication. The context information may provide all the information necessary for the event handling component to apply one or more business policy rules to determine how to handle the event. In some implementations having multiple event handling components of different types, the event generating component may be configured to provide notification of events to the event handling components in a specified order. In some implementations, multiple event handling components may be joined in a logical pool, sharing responsibility for handling events.

Abstract: Event management techniques for use in a computer system comprising an event generating component generating at least one event and a plurality of event handling components applying one or more business process rules in response to the event. In one embodiment of the invention, an event generation component provides to an event handling component a notification of an event and context information about the event, in the same communication. The context information may provide all the information necessary for the event handling component to apply one or more business policy rules to determine how to handle the event. In some implementations having multiple event handling components of different types, the event generating component may be configured to provide notification of events to the event handling components in a specified order. In some implementations, multiple event handling components may be joined in a logical pool, sharing responsibility for handling events.