Self-encrypting key management system

1. A method comprising:

identifying a cryptographic key at a self-encrypting key management application, the cryptographic key being received from another application provided on a server associated with the self-encrypting key management application or generated by the self-encrypting key management application in response to a request from the other application;

storing the cryptographic key at a secure enclave corresponding to the self-encrypting key management application;

receiving a request from the other application provided on the server for a performance of a cryptographic operation associated with the cryptographic key;

retrieving, by a processing device, the cryptographic key at the secure enclave corresponding to the self-encrypting key management application by:

receiving a request from the self-encrypting key management application for the cryptographic key stored at the secure enclave corresponding to the self-encrypting key management application;

generating a secure enclave key based on an internal key that is internal to the processing device;

retrieving data stored at the secure enclave; and

decrypting, within the processing device, the data with the secure enclave key, the decrypted data comprising the cryptographic key received from the other application;

performing the cryptographic operation with the cryptographic key to generate an output; and

providing the output of the cryptographic operation to the other application.

2. The method of claim 1 , wherein generating the secure enclave key is further based on an identification of the self-encrypting key management application.

3. The method of claim 1 , wherein the secure enclave is a region of a memory that is assigned to the self-encrypting key management application, and wherein data of the self-encrypting key management application stored at the secure enclave is encrypted based on a key that is internal to the processing device.

4. The method of claim 1 , wherein the self-encrypting key management application and the other application are provided on a same server.

5. The method of claim 1 , further comprising:

receiving a request from the other application to provide the cryptographic key to the self-encrypting key management application;

in response to receiving the request, generating a hash value associated with the self-encrypting key management application and a digital signature based on the self-encrypting key management application;

providing a message based on the digital signature and the hash value to the other application; and

establishing a connection between the other application and the self-encrypting key management application in response to an indication that the self-encrypting key management application has been authenticated based on the message.

6. The method of claim 1 , further comprising:

receiving executable code from the other application;

assigning an additional secure enclave for the other application; and

storing the executable code from the other application at the additional secure enclave for the other application, wherein the executable code is retrieved in response to a subsequent request to perform an operation with the cryptographic key and the executable code.

7. A system comprising:

a memory; and

a processing device, operatively coupled with the memory, to:

identify a cryptographic key at a self-encrypting key management application, the cryptographic key being received from another application provided on a server associated with the self-encrypting key management application or generated by the self-encrypting key management application in response to a request from the other application;

store the cryptographic key at a secure enclave corresponding to the self-encrypting key management application;

receive a request from the other application provided on the server for a performance of a cryptographic operation associated with the cryptographic key;

retrieve the cryptographic key at the secure enclave corresponding to the self-encrypting key management application by:

receiving a request from the self-encrypting key management application for the cryptographic key stored at the secure enclave corresponding to the self-encrypting key management application;

generating a secure enclave key based on an internal key that is internal to the processing device;

retrieving data stored at the secure enclave; and

decrypting, within the processing device, the data with the secure enclave key, the decrypted data comprising the cryptographic key received from the other application;

perform the cryptographic operation with the cryptographic key to generate an output; and

provide the output of the cryptographic operation to the other application.

8. The system of claim 7 , wherein generating the secure enclave key is further based on an identification of the self-encrypting key management application.

9. The system of claim 7 , wherein the secure enclave is a region of the memory that is assigned to the self-encrypting key management application, and wherein data of the self-encrypting key management application stored at the secure enclave is encrypted based on a key that is internal to the processing device.

10. The system of claim 7 , wherein the self-encrypting key management application and the other application are provided on a same server.

11. The system of claim 7 , wherein the processing device is further to:

receive a request from the other application to provide the cryptographic key to the self-encrypting key management application;

in response to receiving the request, generate a hash value associated with the self-encrypting key management application and a digital signature based on the self-encrypting key management application;

provide a message based on the digital signature and the hash value to the other application; and

establish a connection between the other application and the self-encrypting key management application in response to an indication that the self-encrypting key management application has been authenticated based on the message.

12. The system of claim 7 , wherein the processing device is further to:

receive a second request to perform a cryptographic operation based on the cryptographic key;

identify a second self-encrypting key management application;

identify a usage of the self-encrypting key management application and a usage of the second self-encrypting key management application; and

transmit the second request to the self-encrypting key management application or the second self-encrypting key management application based on the usages of the self-encrypting key management application and the second self-encrypting key management application.

13. A non-transitory computer readable medium comprising data that, when accessed by a processing device, cause the processing device to perform operations comprising:

identifying a cryptographic key at a self-encrypting key management application, the cryptographic key being received from another application provided on a server associated with the self-encrypting key management application or generated by the self-encrypting key management application in response to a request from the other application;

storing the cryptographic key at a secure enclave corresponding to the self-encrypting key management application;

receiving a request from the other application provided on the server for a performance of a cryptographic operation associated with the cryptographic key;

retrieving, by the processing device, the cryptographic key at the secure enclave corresponding to the self-encrypting key management application by:

receiving a request from the self-encrypting key management application for the cryptographic key stored at the secure enclave corresponding to the self-encrypting key management application;

generating a secure enclave key based on an internal key that is internal to the processing device;

retrieving data stored at the secure enclave; and

decrypting, within the processing device, the data with the secure enclave key, the decrypted data comprising the cryptographic key received from the other application;

performing the cryptographic operation with the cryptographic key to generate an output; and

providing the output of the cryptographic operation to the other application.

14. The non-transitory computer readable medium of claim 13 , wherein generating the secure enclave key is further based on an identification of the self-encrypting key management application.

15. The non-transitory computer readable medium of claim 13 , wherein the secure enclave is a region of a memory that is assigned to the self-encrypting key management application, and wherein data of the self-encrypting key management application stored at the secure enclave is encrypted based on a private key that is internal to the processing device, and wherein the self-encrypting key management application and the other application are provided on a same server.

16. The non-transitory computer readable medium of claim 13 , the operations further comprising:

receiving a request from the other application to provide the cryptographic key to the self-encrypting key management application;

in response to receiving the request, generating a hash value associated with the self-encrypting key management application and a digital signature based on the self-encrypting key management application;

providing a message based on the digital signature and the hash value to the other application; and

establishing a connection between the other application and the self-encrypting key management application in response to an indication that the self-encrypting key management application has been authenticated based on the message.

17. The non-transitory computer readable medium of claim 13 , the operations further comprising:

receiving executable code from the other application;

assigning an additional secure enclave for the other application; and

storing the executable code from the other application at the additional secure enclave for the other application, wherein the executable code is retrieved in response to a subsequent request to perform an operation with the cryptographic key and the executable code.