Cache Encryption

The industry-standard symmetric cipher used to protect cached inference data on persistent storage. AES-256-GCM provides both confidentiality and authenticated integrity, ensuring that any unauthorized modification to a cached response is immediately detectable. Each cache entry is encrypted with a unique data encryption key (DEK) , which is itself wrapped by a key encryption key (KEK) stored in a hardware security module. This envelope encryption pattern limits the blast radius of any single key compromise and enables fine-grained key rotation without re-encrypting the entire cache.

A hierarchical key management strategy where data encryption keys (DEKs) encrypt the actual cache entries, and a master key encryption key (KEK) encrypts the DEKs. The KEK never leaves a FIPS 140-2 Level 3 certified hardware security module (HSM). This architecture ensures that even if the storage media is physically stolen, the encrypted DEKs are useless without access to the HSM. Key rotation becomes trivial: generate a new DEK version, re-wrap with the KEK, and mark old DEKs as deprecated without bulk data re-encryption.

In multi-tenant sovereign caching deployments, each tenant's cached inference responses are encrypted with a tenant-specific DEK derived from a unique tenant master key. This provides cryptographic tenant isolation—even if a misconfigured access policy exposes raw storage blocks, Tenant A cannot decrypt Tenant B's cached data. The tenant key derivation follows NIST SP 800-108 using HMAC-based key derivation functions, ensuring that cross-tenant data leakage is mathematically impossible rather than relying on application-layer access controls alone.

Every cached entry is protected using AEAD ciphers like AES-256-GCM or ChaCha20-Poly1305, which bind the ciphertext to specific associated data such as the cache key, tenant ID, and timestamp. This prevents ciphertext splicing attacks where an adversary swaps encrypted cache entries between different keys or tenants. The authentication tag is verified before any decrypted data is served, ensuring that the response has not been tampered with and originates from the correct cache context.

A transparent data encryption layer sits between the caching application and the storage backend, automatically encrypting all writes and decrypting all reads without requiring changes to the cache logic. This is implemented via a Linux kernel dm-crypt module or a FUSE-based encrypted filesystem. The encryption is file-system-level, meaning even core dumps, swap, and temporary files from the cache process are encrypted. TDE ensures that no plaintext inference response ever touches persistent storage, satisfying data-at-rest compliance requirements for GDPR, HIPAA, and sovereign cloud mandates.

For the most sensitive cached inference responses, the hot cache—data held in RAM for ultra-low-latency access—is protected using confidential computing enclaves such as Intel SGX or AMD SEV. These hardware-enforced trusted execution environments encrypt data in use, ensuring that even a compromised hypervisor or root-level attacker cannot read the plaintext cache from memory. The enclave performs decryption internally, serves the response, and never exposes the plaintext outside the CPU package boundary, providing defense-in-depth for sovereign deployments.