Encryption in the cloud using enterprise managed keys
View Patent ↗An encryption key management system and method implements enterprise managed encryption key for an enterprise using encryption for cloud-based services. In some embodiments, the enterprise deploys a key agent on the enterprise data network to distribute encryption key material to the network intermediary on a periodic basis. The network intermediary receives the encryption key material from the enterprise and stores the encryption key material in temporary storage and uses the received encryption key material to derive a data encryption key to perform the encryption of the enterprise's data. In this manner, the enterprise can be provided with the added security assurance of maintaining and managing its own encryption key while using cloud-based data storage services. The encryption key management system and method can be applied to ensure that the enterprise's one or more encryption keys do not leave the enterprise's premises.
1. A method of performing cloud-based encryption of data on behalf of an enterprise operating an enterprise data network using an enterprise managed encryption key, comprising:
receiving, at a proxy server deployed outside of the enterprise data network, a key material generated by a key agent deployed inside the enterprise data network, the key material being generated using the enterprise managed encryption key being available only within the enterprise data network;
storing the key material on the proxy server in a temporary memory for a first time period associated with a valid time period for the key material;
generating, at the proxy server, a data encryption key using the key material, the data encryption key being used to perform cloud-based encryption of data on behalf of the enterprise;
in response to the expiration of the first time period, repeating the receiving of a key material from the proxy server to generating a data encryption key based on the received key material;
providing a cloud based encryption service on the proxy server to encrypt and decrypt data on behalf of the enterprise using the key material;
receiving, at the proxy server, a first data in clear text from the enterprise data network;
transmitting the first data in clear text to a cloud service provider;
receiving, at the proxy server, a request from the cloud service provider to encrypt the first data, the request including the first data in clear text transmitted from the cloud service provider;
in response to the request from the cloud service provider, encrypting, at the proxy server, the first data received from the cloud service provider using the data encryption key; and
transmitting the encrypted first data to the cloud service provider to be stored on the cloud service provider as encrypted data at rest.
2. The method of claim 1 , further comprising:
receiving, at the proxy server, a request to decrypt an encrypted third data from the cloud service provider;
decrypting, at the proxy server, the encrypted third data on behalf of the enterprise using the data encryption key; and
providing the decrypted third data to the enterprise on behalf of the cloud service provider.
3. The method of claim 1 , wherein receiving the key material generated by the key agent deployed inside the enterprise data network comprises:
generating, at the key agent, a request to a hardware security module to decrypt an encrypted key material, wherein the hardware security module decrypts the encrypted key material using the enterprise managed encryption key being available only within the enterprise data network;
receiving, at the key agent, a decrypted key material;
storing the decrypted key material on the key agent in a temporary memory for a valid time period for the decrypted key material; and
transmitting the decrypted key material from the key agent to the proxy server as the key material.
4. The method of claim 1 , wherein receiving, at the proxy server, the request from the cloud service provider to encrypt the first data comprises:
receiving a call to the cloud based encryption service from the cloud service provider to encrypt the first data.
5. The method of claim 2 ,
wherein receiving, at the proxy server, the request to decrypt an encrypted third data from the cloud service provider comprises receiving a call to the cloud based encryption service from the cloud service provider to decrypt the third data.
6. The method of claim 1 , further comprising:
receiving, at the proxy server, the key material from the key agent on a periodic basis.
7. The method of claim 1 , wherein generating, using the proxy server, the data encryption key using the key material comprises:
generating, using a key derivation function, the data encryption key using the key material.
8. A system for performing cloud-based encryption of data on behalf of an enterprise operating an enterprise data network using an enterprise managed encryption key, comprising:
a hardware proxy server deployed outside of the enterprise data network, the hardware proxy server being configured to receive a key material generated by a key agent deployed inside the enterprise data network wherein the key material is generated using the enterprise managed encryption key being available only within the enterprise data network,
to store the key material on the hardware proxy server in a temporary memory for a first time period associated with a valid time period for the key material to generate a data encryption key using the key material where the data encryption key is used to perform cloud-based encryption of data on behalf of the enterprise, in response to the expiration of the first time period,
to repeat the receiving of a key material from the hardware proxy server to generating a data encryption key using the received key material to provide a cloud based encryption service on the hardware proxy server to encrypt and decrypt data on behalf of the enterprise based on the key material to receive a first data in clear text from the enterprise data network,
to transmit the first data in clear text to a cloud service provider, to receive a request from the cloud service provider to encrypt the first data, in response to the request from the cloud service provider, to encrypt the first data received from the cloud service provider using the data encryption key, and
to transmit the encrypted first data to the cloud service provider to be stored on the cloud service provider as encrypted data at rest.
9. The system of claim 8 , wherein the proxy server is further configured to receive a request to decrypt an encrypted third data from the cloud service provider, to decrypt the encrypted third data on behalf of the enterprise using the data encryption key, and to provide the decrypted third data to the enterprise on behalf of the cloud service provider.
10. The system of claim 8 , wherein the key agent is configured to generate a request to a hardware security module to decrypt an encrypted key material where the hardware security module decrypts the encrypted key material using the enterprise managed encryption key being available only within the enterprise data network, to receive a decrypted key material, to store the decrypted key material on the key agent in a temporary memory for a valid time period for the decrypted key material, and to transmit the decrypted key material from the key agent to the proxy server as the key material.
11. The system of claim 8 , wherein the proxy server is further configured to receive a call to the cloud based encryption service from the cloud service provider to encrypt the first data.
12. The system of claim 9 , wherein the proxy server is further configured to receive a call to the cloud based encryption service from the cloud service provider to decrypt the third data.
13. The system of claim 8 , wherein the proxy server is further configured to receive the key material from the key agent on a periodic basis.
14. The system of claim 8 , wherein the proxy server is further configured to generate the data encryption key using the key material and a key derivation function.