Systems and methods for proxying encryption key communications between a cloud storage system and a customer security module
Methods in a cloud object store facilitate strong data encryption, customer-management of object (encryption) keys, reductions in latency, globally-distributed object storage, and handling of streamed uploads. A method for encrypting objects stored in a cloud includes encrypting each object with a unique encryption (object) key. The plaintext object keys are generated in advance of uploads. The plaintext object keys can be stored in an object database in the cloud. Alternatively, the plaintext object keys can be provided to a customer's HSM, encrypted, and returned to the cloud, such that encrypted object keys, encrypted by the customer, are stored in the cloud. The cloud can alternatively encrypt the customer's object keys with a master key for the customer, which is then encrypted by the customer's HSM before being stored in the cloud. Proxies are also deployed for efficiently communicating with customer security modules.
1. A method for proxying key communications between a multi-tenant cloud storage system and a customer security module (CSM) located geographically remotely from said multi-tenant cloud storage system, said method comprising:
opening a first connection with said multi-tenant cloud storage system;
receiving a request for key processing from said multi-tenant cloud storage system via said first connection, said request for key processing including an encryption key, and said request for key processing being associated with a particular customer by the multi-tenant cloud storage system, and said encryption key is associated with at least one digital object stored on said multi-tenant cloud storage system, wherein said at least one digital object stored on said multi-tenant cloud storage system was encrypted with said encryption key and is stored on said multi-tenant cloud storage system in an encrypted state;
opening a second connection with said CSM, said CSM operating on behalf of said particular customer; and
forwarding said request for key processing including said encryption key to said CSM via said second connection;
receiving a response to said request from said CSM via said second connection, said response including an encrypted encryption key, said encrypted encryption key being an encrypted version of said encryption key;
forwarding said encrypted encryption key to said multi-tenant cloud storage system via said first connection;
receiving a second request for key processing from said multi-tenant cloud storage system via said first connection, said second request including said encrypted encryption key;
forwarding said second request for key processing including said encrypted encryption key to said CSM via said second connection;
receiving a second response to said second request from said CSM via said second connection, said second response including said encryption key, said encryption key received with said second response being a decrypted version of said encrypted encryption key;
forwarding said encryption key to said multi-tenant cloud storage system via said first connection to allow decrypting of said at least one digital object at said multi-tenant cloud storage system, using said encryption key;
receiving a third request for key processing from said multi-tenant cloud storage system via said first connection, said third request including said encrypted encryption key;
forwarding said third request for key processing including said encrypted encryption key to said CSM via said second connection;
receiving a third response to said third request for key processing from said CSM via said second connection, said third response including said encryption key, said encryption key included with said third response being a second decrypted version of said encrypted encryption key; and
forwarding said encryption key to said multi-tenant cloud storage system via said first connection to allow decrypting of said at least one digital object at said multi-tenant cloud storage system, using said encryption key.
2. The method of claim 1 , wherein:
said encryption key of said request for key processing comprises a plaintext master key assigned by said multi-tenant cloud storage system to said particular customer; and
said encrypted encryption key provided with said response comprises an encrypted version of said plaintext master key.
3. The method of claim 2 , wherein:
said encrypted encryption key of said second request for key processing comprises an encrypted master key associated with a plaintext master key assigned by said multi-tenant cloud storage system to said particular customer; and
said encryption key provided with said second response comprises said plaintext master key.
4. The method of claim 1 , wherein:
said encryption key of said request for key processing comprises a plaintext object key used to encrypt said at least one digital object stored on said multi-tenant cloud storage system; and
said encrypted encryption key provided with said response comprises an encrypted object key.
5. The method of claim 4 , wherein:
said encrypted encryption key of said second request for key processing comprises an encrypted object key associated with a plaintext object key used to encrypt said at least one stored digital object; and
said encryption key provided with said second response comprises said plaintext object key.
6. The method of claim 1 , wherein:
said opening said first connection comprises establishing a private network connection with said multi-tenant cloud storage system; and
said opening said second connection comprises using a Java security process to communicate with said CSM.
7. The method of claim 1 , wherein:
said opening said first connection comprises establishing an HTTPS connection; and
said opening said second connection comprises establishing a private network connection with said CSM via a private network of said particular customer.
8. A server for proxying communications associated with encryption keys between a multi-tenant cloud storage system and a customer security module (CSM), said server comprising:
memory including a set of predefined instructions for causing at least one hardware processor to perform an associated set of operations;
a cloud interface electrically coupled to communicate with said multi-tenant cloud storage system;
a CSM interface electrically coupled to communicate with said CSM, said CSM operating on behalf of a particular customer of said multi-tenant cloud storage system;
a CSM server application including a first subset of said set of predefined instructions configured to
open a first connection facilitating communication with said cloud storage system via said cloud interface and
open a second connection with said CSM via said CSM interface; and
a CSM proxy application including a second subset of said set of predefined instructions configured to
receive a request for key processing including an encryption key, from said multi-tenant cloud storage system via said first connection, said request for key processing being associated with a particular customer by the multi-tenant cloud storage system, and said encryption key is associated with at least one digital object stored on said multi-tenant cloud storage system, wherein said at least one digital object stored on said multi-tenant cloud storage system was encrypted with said encryption key and is stored on said multi-tenant cloud storage system in an encrypted state;
forward said request for key processing including said encryption key to said CSM via said second connection,
receive a response to said request from said CSM via said second connection, said response including an encrypted encryption key, said encrypted encryption key being an encrypted version of said encryption key,
forward said encrypted encryption key to said multi-tenant cloud storage system via said first connection,
receive a second request for key processing from said multi-tenant cloud storage system via said first connection, said second request including said encrypted encryption key,
forward said second request for key processing including said encrypted encryption key to said CSM via said second connection,
receive a second response to said second request from said CSM via said second connection, said second response including said encryption key, said encryption key received with said second response being a decrypted version of said encrypted encryption key included with said second request,
forward said encryption key to said multi-tenant cloud storage system via said first connection to allow decrypting of said at least one digital object at said multi-tenant cloud storage system, using said encryption key,
receive a third request for key processing from said multi-tenant cloud storage system via said first connection, said third request including said encrypted encryption key,
forward said third request for key processing including said encrypted encryption key to said CSM via said second connection,
receive a third response to said third request for key processing from said CSM via said second connection, said third response including said encryption key, said encryption key included with said third response being a second decrypted version of said encrypted encryption key included with said third request,
forward said encryption key to said multi-tenant cloud storage system via said first connection to allow decrypting of said at least one digital object at said multi-tenant cloud storage system, using said encryption key.
9. The server of claim 8 , wherein:
said encryption key of said request for key processing comprises a plaintext master key assigned by said multi-tenant cloud storage system to said particular customer; and
said encrypted encryption key provided with said response comprises an encrypted version of said plaintext master key.
10. The server of claim 9 , wherein:
said encrypted encryption key of said second request for key processing comprises an encrypted master key associated with a plaintext master key assigned by said multi-tenant cloud storage system to said particular customer; and
said encryption key provided with said second response comprises said plaintext master key.
11. The server of claim 8 , wherein:
said encryption key of said request for key processing comprises a plaintext object key used to encrypt said at least one digital object stored on said multi-tenant cloud storage system; and
said encrypted encryption key provided with said response comprises an encrypted object key.
12. The server of claim 11 , wherein:
said encrypted encryption key of said second request for key processing comprises an encrypted key associated with a plaintext object key used to encrypt said at least one stored digital object; and
said encryption key provided with said second response comprises said plaintext object key.
13. The server of claim 8 , wherein:
said first connection comprises a private network connection; and
said second connection is established using a Java security process facilitating communication with said CSM.
14. The server of claim 8 , wherein:
said first connection comprises an HTTPS connection; and
said second connection comprises a private network connection with said CSM via a private network of said particular customer.