CLOUD BASED KEY MANAGEMENT

Embodiments are directed to managing cryptographic keys in a multi-tenant cloud based system. Embodiments receive from a client a request for a wrapped data encryption key ('DEK'). Embodiments generate a random key and fetch encryption context that corresponds to the client. Embodiments generate the wrapped DEK including the random key and the encryption context encoded in the wrapped DEK. Embodiments then return the wrapped DEK to the client. 实施例涉及在基于多租户云的系统中管理密码密钥。实施例从客户端接收对包装的数据加密密钥("DEK")的请求。实施例生成随机密钥并获取与客户端对应的加密上下文。实施例生成包装的DEK，该包装的DEK包括随机密钥和在包装的DEK中被编码的加密上下文。实施例然后将包装的DEK返回给客户端。