Systems and methods for key access distribution and management
Various systems and methods for providing a trusted key access broker are described herein. A system may be configured to receive, at a trusted key access broker, from a requestor via a broker application programming interface, a request for a cryptographic key operation, the request associated with attestation evidence data; use the attestation evidence data to validate the requestor; in response to validating the requestor, translate and transmit the request for the cryptographic key operation to one of the plurality of key management systems; receive a response from the one of the plurality of key management systems; and transmit the response to the requestor.
1 . A system, comprising:
a processor; and
memory to store instructions, which when executed by the processor, cause the system to:
receive, at a trusted key access broker, from a requestor, via a broker application programming interface, a request for a cryptographic key operation, the request associated with attestation evidence data;
use the attestation evidence data to validate the requestor;
in response to the validation of the requestor, translate and transmit the request for the cryptographic key operation to one of a plurality of key management systems by:
selecting, based on the request, one key management system from the plurality of key management systems;
determining a key management system-specific application programming interface associated with the selected key management system; and
converting the request from a format of the broker application programming interface to a format of the key management system-specific application programming interface using a plugin module associated with the selected key management system;
receive a response from the one of the plurality of key management systems; and
transmit the response to the requestor.
2 . The system of claim 1 , wherein the request for the cryptographic key operation comprises a request to read, create, modify, or delete a cryptographic key.
3 . The system of claim 1 , wherein to use the attestation evidence data to validate the requestor, the instructions cause the trusted key access broker to interface with a trust authority.
4 . The system of claim 3 , wherein the trust authority operates using a trust as a service (TaaS) architecture.
5 . The system of claim 1 , wherein the plurality of key management systems includes at least one key management system provided by a cloud service provider and at least one key management system provided by a private host.
6 . The system of claim 1 , wherein to transmit the request for the cryptographic key operation to the one of the plurality of key management systems, the instructions cause the trusted key access broker to:
determine a key management system application programming interface to use when accessing the one of the plurality of key management systems; and
access the one of the plurality of key management systems to transmit the request for the cryptographic key operation.
7 . The system of claim 1 , wherein the response includes a cryptographic key.
8 . The system of claim 1 , wherein the response includes an indication of a successful operation on a cryptographic key.
9 . The system of claim 1 , wherein the trusted key access broker is executed in a trusted execution environment of the system.
10 . The system of claim 1 , comprising instructions, which cause the trusted key access broker to store a transaction log of the request for the cryptographic key operation in an immutable ledger.
11 . The system of claim 1 , wherein the broker application programming interface is agnostic to the plurality of key management systems.
12 . A method comprising:
receiving, at a trusted key access broker, from a requestor, via a broker application programming interface, a request for a cryptographic key operation, the request associated with attestation evidence data;
using the attestation evidence data to validate the requestor;
in response to the validation of the requestor, translating and transmitting the request for the cryptographic key operation to one of a plurality of key management systems by:
selecting, based on the request, one key management system from the plurality of key management systems;
determining a key management system-specific application programming interface associated with the selected key management system; and
converting the request from a format of the broker application programming interface to a format of the key management system-specific application programming interface using a plugin module associated with the selected key management system;
receiving a response from the one of the plurality of key management systems; and
transmitting the response to the requestor.
13 . The method of claim 12 , wherein using the attestation evidence data to validate the requestor comprises causing the trusted key access broker to interface with a trust authority.
14 . The method of claim 13 , wherein the trust authority operates using a trust as a service (TaaS) architecture.
15 . The method of claim 12 , wherein the plurality of key management systems includes at least one key management system provided by a cloud service provider and at least one key management system provided by a private host.
16 . The method of claim 12 , wherein transmitting the request for the cryptographic key operation to the one of the plurality of key management systems comprises:
determining a key management system application programming interface to use when accessing the one of the plurality of key management systems; and
accessing the one of the plurality of key management systems to transmit the request for the cryptographic key operation.
17 . The method of claim 12 , wherein the response includes a cryptographic key.
18 . The method of claim 12 , wherein the response includes an indication of a successful operation on a cryptographic key.
19 . The method of claim 12 , wherein the trusted key access broker is executed in a trusted execution environment.
20 . The method of claim 12 , comprising storing a transaction log of the request for the cryptographic key operation in an immutable ledger.