Multi-tenancy architecture
First Claim
Patent Images
1. A system, comprising:
- a first security computing device of a plurality of security computing devices, each device supporting a different encryption protocol, the first security computing device comprising;
at least one memory configured to store keys for use in cryptographic processing, and to store incoming data, andat least one processor configured for cryptographic processing comprising encryption of data packets for writing to data storage, anddecryption of data packets for reading from data storage, the at least one processor coupled to receive the incoming data from a plurality of data sources, the incoming data including first data from first data source;
a first switch configured to select the first security computing device from the plurality of security computing devices for routing of the first data to the first security computing device for processing using a first encryption protocol, the selecting based on a source tag of the first data associated with the first data source;
a controller configured to select a first set of keys from a plurality of key sets, each of the key sets corresponding to one of the plurality of data sources, the controller further configured to select the first set of keys based on the source tag, wherein the first set of keys is stored in the at least one memory and used by the at least one processor to encrypt the first data;
a common encrypted data storage, coupled to receive the encrypted first data from the first security computing device; and
a second switch configured to, when reading the encrypted first data from the common encrypted data storage, select the first security computing device from the plurality of security computing devices for decryption processing, the selecting based on the source tag.
1 Assignment
0 Petitions
Accused Products
Abstract
A system includes a security device, configured for cryptographic processing, coupled to receive incoming data from a plurality of data sources (e.g., data from different customers), wherein the incoming data includes first data from a first data source; a controller (e.g., an external key manager) configured to select a first set of keys from a plurality of key sets, each of the key sets corresponding to one of the plurality of data sources, wherein the first set of keys is used by the security device to encrypt the first data; and a common encrypted data storage, coupled to receive the encrypted first data from the security device.
105 Citations
17 Claims
-
1. A system, comprising:
-
a first security computing device of a plurality of security computing devices, each device supporting a different encryption protocol, the first security computing device comprising; at least one memory configured to store keys for use in cryptographic processing, and to store incoming data, and at least one processor configured for cryptographic processing comprising encryption of data packets for writing to data storage, and decryption of data packets for reading from data storage, the at least one processor coupled to receive the incoming data from a plurality of data sources, the incoming data including first data from first data source; a first switch configured to select the first security computing device from the plurality of security computing devices for routing of the first data to the first security computing device for processing using a first encryption protocol, the selecting based on a source tag of the first data associated with the first data source; a controller configured to select a first set of keys from a plurality of key sets, each of the key sets corresponding to one of the plurality of data sources, the controller further configured to select the first set of keys based on the source tag, wherein the first set of keys is stored in the at least one memory and used by the at least one processor to encrypt the first data; a common encrypted data storage, coupled to receive the encrypted first data from the first security computing device; and a second switch configured to, when reading the encrypted first data from the common encrypted data storage, select the first security computing device from the plurality of security computing devices for decryption processing, the selecting based on the source tag. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A system, comprising:
-
a plurality of security computing devices, each configured for cryptographic processing using a different encryption protocol, and coupled to receive incoming data from a plurality of data sources; a first security computing device of the plurality of security computing devices, the first security computing device comprising; at least one memory configured to store keys for use in cryptographic processing, and to store incoming data, and at least one processor configured for cryptographic processing comprising encryption of data packets for writing to data storage, and decryption of data packets for reading from data storage; a first switch coupled to receive the incoming data from the plurality of data sources, the incoming data including first data from a first data source, the first switch configured to route the incoming data to one of the security computing devices selected based on a source of the incoming data, wherein the first data is routed to the first security computing device based on a determination that the first data is from the first data source; a plurality of key managers, each key manager associated with a user, each key manager coupled to a respective one of the security computing devices, and each key manager configured to provide a set of keys to the respective security computing device for encryption of incoming data associated with the respective user, the incoming data to be stored in a common encrypted data storage after encryption; and a second switch configured to, when reading the encrypted first data from the common encrypted data storage, select the first security computing device from the plurality of security computing devices for decryption processing, the selecting based on a determination that the encrypted first data is associated with the first data source. - View Dependent Claims (11)
-
-
12. A system, comprising:
-
a plurality of cryptographic cores comprising an input core configured to perform, by at least one processor, encryption for a first data packet when writing to data storage, and an output core configured to perform, by at least one processor, decryption for the first data packet when reading from data storage; at least one key cache configured to store, by at least one memory, a plurality of key sets, wherein a first set of keys is to be selected from the plurality of key sets to encrypt the first data packet by the input core;
a packet input engine configured to detect a header of the first data packet and to address the first set of keys;a first switch configured to select one of the cryptographic cores for processing of the first data packet, the selecting based on a source tag of the first data packet that is associated with a first data source; a packet output engine configured to provide the encrypted first data packet from the input core to a common data storage, the packet output engine further configured to detect the source tag when reading from the common data storage and to address a second set of keys in the at least one key cache for decrypting the first data packet by the output core; and a second switch configured to, when reading the encrypted first data packet from the common data storage, select one of the cryptographic cores for decryption processing, the selecting based on the source tag. - View Dependent Claims (13, 14, 15, 16, 17)
-
Specification