Abstract: A configuration for a key management system is provided for managing cryptographic keys in cryptosystems. The configuration includes the use of database replication to improve the reliability, accessibility, and partition tolerance of the key management system. The configuration also includes the use of database sharding and distributed networks to improve the functionality of the key management system. From a logical level, the system can appear multi-master because client software can connect with any compute node in a plurality of compute nodes and perform key management operations on the entire key database from that compute node. From a physical level, the system can be a master-slave configuration with each database shard replication group having a single master shard instance and one or more slave shard instances. In some examples, the present disclosure provides better redundancy, load balancing, availability, and partition tolerance for key management systems.

Abstract: A system includes a data storage device containing encrypted data to be decrypted, and a VZ storage device containing a key material for decrypting data, wherein the VZ storage device decrypts the encrypted data by consuming a portion of the key material and stores the decrypted data in the consumed portion of the key material.

Abstract: A configuration for a key management system is provided for managing cryptographic keys in cryptosystems. The configuration includes the use of database replication to improve the reliability, accessibility, and partition tolerance of the key management system. The configuration also includes the use of database sharding and distributed networks to improve the functionality of the key management system. From a logical level, the system can appear multi-master because client software can connect with any compute node in a plurality of compute nodes and perform key management operations on the entire key database from that compute node. From a physical level, the system can be a master-slave configuration with each database shard replication group having a single master shard instance and one or more slave shard instances. In some examples, the present disclosure provides better redundancy, load balancing, availability, and partition tolerance for key management systems.

Abstract: A method, system, and computer-program product for handling network partitions in a network is provided. For example, a method can include providing a first compute node and a second compute node on the network. In such an example, the first compute node can include a master instance of a cryptographic database. In addition, the second compute node can include a first synchronous slave instance associated with the master instance. The method can further include identifying a network partition event on the network. The method can further include providing an asynchronous slave instance associated with the master instance and changing the asynchronous slave instance to a second synchronous slave instance in response to identifying the network partition event.

Abstract: A configuration for a key management system is provided for managing cryptographic keys in cryptosystems. The configuration includes the use of database replication to improve the reliability, accessibility, and partition tolerance of the key management system. The configuration also includes the use of database sharding and distributed networks to improve the functionality of the key management system. From a logical level, the system can appear multi-master because client software can connect with any compute node in a plurality of compute nodes and perform key management operations on the entire key database from that compute node. From a physical level, the system can be a master-slave configuration with each database shard replication group having a single master shard instance and one or more slave shard instances. In some examples, the present disclosure provides better redundancy, load balancing, availability, and partition tolerance for key management systems.

Abstract: A system includes a data storage device containing encrypted data to be decrypted, and a VZ storage device containing a key material for decrypting data, wherein the VZ storage device decrypts the encrypted data by consuming a portion of the key material and stores the decrypted data in the consumed portion of the key material.

Abstract: A system for protecting data includes a virtual zeroisation device which receives data to be encrypted and key material for encrypting the data. The key material is stored in a storage device. As the encryption unit encrypts the data using the key material, the encrypted data is stored in the storage device and overwrites the key material.

Abstract: A configuration for a key management system is provided for managing cryptographic keys in cryptosystems. The configuration includes the use of database replication to improve the reliability, accessibility, and partition tolerance of the key management system. The configuration also includes the use of database sharding and distributed networks to improve the functionality of the key management system. From a logical level, the system can appear multi-master because client software can connect with any compute node in a plurality of compute nodes and perform key management operations on the entire key database from that compute node. From a physical level, the system can be a master-slave configuration with each database shard replication group having a single master shard instance and one or more slave shard instances. In some examples, the present disclosure provides better redundancy, load balancing, availability, and partition tolerance for key management systems.

Abstract: A method, system, and computer-program product for handling network partitions in a network is provided. For example, a method can include providing a first compute node and a second compute node on the network. In such an example, the first compute node can include a master instance of a cryptographic database. In addition, the second compute node can include a first synchronous slave instance associated with the master instance. The method can further include identifying a network partition event on the network. The method can further include providing an asynchronous slave instance associated with the master instance and changing the asynchronous slave instance to a second synchronous slave instance in response to identifying the network partition event.

Abstract: A system for securely moving data from one location to another exchanges key material between the locations. The system enables cryptosystems to use key material distributed over a quantum channel.

Abstract: A system for protecting data includes a virtual zeroisation device which receives data to be encrypted and key material for encrypting the data. The key material is stored in a storage device. As the encryption unit encrypts the data using the key material, the encrypted data is stored in the storage device and overwrites the key material.

Abstract: A system for securely moving data from one location to another exchanges key material between the locations. The system enables cryptosystems to use key material distributed over a quantum channel.