Patent ID: 8538029
Filing Date: 2013-09-17
Classification: H04L

Abstract:
1. A method for distributing encryption key fragments across data stores located within a first geographic region and data stores located within a second geographic region that is different than and physically separated from the first geographic region, the method comprising: fragmenting, by a computer, an encryption key into a number, n, of encryption key fragments such that a number, k<n, of the encryption key fragments is sufficient for reconstructing the encryption key; distributing, by the computer, a first subset of at least k of the encryption key fragments across data stores realized at N different availability zones within the first geographic region such that less than k of the encryption key fragments are distributed to each of the N availability zones within the first geographic region; distributing, by the computer, a second subset of at least k of the encryption key fragments across data stores realized at M different availability zones within the second geographic region such that less than k of the encryption key fragments are distributed to each of the M availability zones within the second geographic region, wherein the encryption key fragments in the first subset have no overlap with the encryption key fragments in the second subset; and in response to determining that the computer is unable to obtain at least k of the encryption key fragments from the first geographic region, requesting encryption key fragments from the second geographic region for reconstructing the encryption key.