Multi-level key management
View Patent ↗A key manager provides a way to separate out the management of encryption keys and policies from application domains. The key manager may create cipher objects that may be used by the domains to perform encryption or decryption, without exposing the keys or encryption/decryption algorithms to the domains. A master key managed by the key manager may be used to encrypt and decrypt the domain keys that are stored under the control of the key manager. The key manager supports the rekeying of both the master key and the domain keys based on policy. Multiple versions of domain keys may be supported, allowing domains to access data encrypted with a previous version of a domain key after a rekeying.
1. A system for centrally managing encryption or decryption services across multiple domains, the system comprising:
at least one processor;
a non-transitory computer readable medium including instructions, which, when executed, are configured to cause the at least one processor to implement,
a key manager configured to generate a master key to protect a plurality of domains including a first domain and a second domain different than the first domain;
the key manager configured to store the master key;
the key manager configured to determine a first encryption algorithm and first key size based on domain-specific policy information for the first domain, and determine a second encryption algorithm and second key size based on domain-specific policy information for the second domain;
the key manager configured to generate a plurality of domain keys including generating a first domain key having the first key size for the first domain, and generating a second domain key having the second key size for the second domain;
the key manager configured to encrypt the plurality of domain keys including the first domain key and the second domain key with the master key; and
the key manager configured to store the encrypted first domain key and the encrypted second domain key in an area remote from the first domain and the second domain,
the key manager configured to generate a first Cipher object for the first domain in response to a request from the first domain, including retrieving the first domain key, decrypting the first domain key with the master key, and transmitting the first Cipher object to the first domain, the first Cipher object identifying the first encryption algorithm and including the first domain key;
the key manager configured to generate a second Cipher object for the second domain in response to a request from the second domain, including retrieving the second domain key, decrypting the second domain key with the master key, and transmitting the second Cipher object to the second domain, the second Cipher object identifying the second encryption algorithm and including the second domain key,
wherein the first encryption algorithm and the first domain key of the first Cipher object are not exposed to the first domain other than by invocation of encryption or decryption provided by the first Cipher object, and the second encryption algorithm and the second domain key of the second Cipher object are not exposed to the second domain other than by invocation of encryption or decryption provided by the second Cipher object.
2. The system of claim 1 , wherein the first domain is configured to encrypt or decrypt domain data associated with the first domain using the first encryption algorithm and the first domain key, and the second domain is configured to encrypt or decrypt domain data associated with the second domain using the second encryption algorithm and the second domain key.
3. The system of claim 1 , wherein the key manager is configured to obtain a private key and retrieve at least one of the first domain key and the second domain key using the private key.
4. The system of claim 1 , wherein the first domain relates to a first portion of an application requiring first cryptography services, and the second domain relates to a second portion of the application requiring second cryptography services.
5. The system of claim 1 , wherein the first domain includes a set of classes whose instances are granted from a first set of permissions, and the second domain includes a set of classes whose instances are granted from a second set of permissions.
6. The system of claim 1 , wherein the master key is equal to or stronger than the plurality of domain keys.
7. The system of claim 1 , wherein the key manager is further configured to replace the first domain key and the second domain key with new keys including decrypting the first domain key and the second domain key with the master key, generating a new master key, re-encrypting the first domain key and the second domain key with the new master key, and re-storing the re-encrypted first and second domain keys.
8. A method for centrally managing encryption or decryption services across multiple domains, the method comprising:
generating, using at least one processor, a master key to protect a plurality of domains including a first domain and a second domain different than the first domain;
storing, using the at least one processor, the master key;
determining, using the at least one processor, a first encryption algorithm and first key size based on domain-specific policy information for the first domain;
determining, using the at least one processor, a second encryption algorithm and second key size based on domain-specific policy information for the second domain;
generating, using the at least one processor, a plurality of domain keys including generating a first domain key having the first key size for the first domain, and generating a second domain key having the second key size for the second domain;
encrypting, using the at least one processor, the plurality of domain keys including the first domain key and the second domain key with the master key; and
storing, using the at least one processor, the encrypted first domain key and the encrypted second domain key in an area remote from the first domain and the second domain;
generating, using the at least one processor, a first Cipher object for the first domain in response to a request from the first domain, including retrieving the first domain key, decrypting the first domain key with the master key, and transmitting the first Cipher object to the first domain, the first Cipher object identifying the first encryption algorithm and including the first domain key;
generating, using the at least one processor, a second Cipher object for the second domain in response to a request from the second domain, including retrieving the second domain key, decrypting the second domain key with the master key, and transmitting the second Cipher object to the second domain, the second Cipher object identifying the second encryption algorithm and including the second domain key,
wherein the first encryption algorithm and the first domain key of the first Cipher object are not exposed to the first domain other than by invocation of encryption or decryption provided by the first Cipher object, and the second encryption algorithm and the second domain key of the second Cipher object are not exposed to the second domain other than by invocation of encryption or decryption provided by the second Cipher object.
9. The method of claim 8 , further comprising:
encrypting or decrypting, by the first domain, domain data associated with the first domain using the first encryption algorithm and the first domain key; and
encrypting or decrypting, by the second domain, domain data associated with the second domain using the second encryption algorithm and the second domain key.
10. The method of claim 8 , further comprising:
obtaining, using the at least one processor, a private key; and
retrieving, using the at least one processor, at least one of the first domain key and the second domain key using the private key.
11. The method of claim 8 , wherein the first domain relates to a first portion of an application requiring first cryptography services, and the second domain relates to a second portion of the application requiring second cryptography services.
12. The method of claim 8 , wherein the first domain includes a set of classes whose instances are granted from a first set of permissions, and the second domain includes a set of classes whose instances are granted from a second set of permissions.
13. The method of claim 8 , wherein the master key is equal to or stronger than the plurality of domain keys.
14. The method of claim 8 , further comprising:
replacing, including the at least one processor, the first domain key and the second domain key with new keys including decrypting the first domain key and the second domain key with the master key, generating a new master key, re-encrypting the first domain key and the second domain key with the new master key, and re-storing the re-encrypted first and second domain keys.
15. A non-transitory computer-readable medium storing instructions that when executed cause at least one processor to centrally manage encryption or decryption services across multiple domains, the instructions comprising instructions to:
generate a master key to protect a plurality of domains including a domain;
store the master key;
determine an encryption algorithm and key size based on domain-specific policy information for the domain;
generate a domain key having the key size for the domain;
encrypt the domain key with the master key;
store the encrypted domain key in an area remote from the domain; and
generate a Cipher object for the domain in response to a request from the domain, including retrieving the domain key, decrypting the domain key with the master key, and transmitting the Cipher object to the domain, the Cipher object identifying the encryption algorithm and including the domain key,
wherein the encryption algorithm and the domain key of the Cipher object are not exposed to the domain other than by invocation of encryption or decryption provided by the Cipher object.
16. The non-transitory computer-readable medium of claim 15 , further comprising:
encrypt or decrypt, by the domain, domain data associated with the domain using the encryption algorithm and the domain key.