Dynamic crypto key management for mobility in a cloud environment
Aspects of the disclosure relate to dynamic crypto key management for mobility in a cloud environment. A computing platform may receive a request to generate a new tenant master key and a new server recovery key. Subsequently, the computing platform may send to a cloud-based key vault server, the new tenant master key and the new server recovery key. The computing platform may send to a tenant database, the encrypted server recovery key. As a result, the computing platform may provision the enrollment servers with the encrypted server recovery key. In some embodiments, the enrollment servers are configured to manage enrollment of policy-managed devices in a policy enforcement scheme and to authenticate with the key update service based on the encrypted server recovery key.
1. A method comprising:
at a computing platform comprising at least one processor, memory, and a communication interface:
receiving, by the at least one processor, via a key upgrade service provided by the computing platform, from an administrator console device, a request to generate one or more new keys;
in response to receiving the request to generate the one or more new keys, generating, by the at least one processor, a new tenant master key and a new server recovery key;
sending, by the at least one processor, via the communication interface, to a cloud-based key vault server, the new tenant master key and the new server recovery key, wherein the cloud-based key vault server is configured to store the new tenant master key and is further configured to encrypt the new server recovery key with the new tenant master key to produce an encrypted server recovery key, wherein the encrypted server recovery key enables a plurality of policy-managed devices associated with a tenant to authenticate with the key update service;
receiving, by the at least one processor, via the communication interface, from the cloud-based key vault server, the encrypted server recovery key;
sending, by the at least one processor, via the communication interface, to a tenant database server associated with one or more enrollment servers, the encrypted server recovery key, wherein the tenant database server is separate from the cloud-based key vault server and wherein the tenant database server stores the encrypted server recover key; and
provisioning, by the at least one processor, the one or more enrollment servers with the encrypted server recovery key by sending the encrypted server recovery key to the one or more enrollment servers via the communication interface,
wherein the one or more enrollment servers are configured to manage enrollment of the plurality of policy-managed devices in a policy enforcement scheme and to authenticate with the key update service based on the encrypted server recovery key.
2. The method of claim 1 , comprising:
detecting, by the at least one processor, a new enrollment server is online; and
sending, by the at least one processor, via the communication interface, the encrypted server recovery key to the new enrollment server.
3. The method of claim 2 , comprising:
provisioning, by the at least one processor, the new enrollment server enabling the plurality of policy-managed devices to enroll with the new enrollment server.
4. The method of claim 1 , comprising:
sending, by the at least one processor, via the communication interface, commands to the plurality of policy-managed devices to generate a device key for each of the plurality of policy-managed devices.
5. The method of claim 4 , wherein sending the commands to the plurality of policy-managed devices to generate the device key causes the plurality of policy-managed devices to:
receive a passphrase from a user of the plurality of policy-managed devices;
generate an encrypted device key based on the passphrase; and
store the encrypted device key in local storage of the plurality of policy-managed devices.
6. The method of claim 1 , comprising:
sending, by the at least one processor, via the communication interface, commands to the plurality of policy-managed devices to generate file keys for one or more files residing on the plurality of policy-managed devices.
7. The method of claim 1 , comprising:
sending, by the at least one processor, via the communication interface, commands directing a device management server to send new variables to the plurality of policy-managed devices.
8. The method of claim 7 , wherein sending the commands directing the device management server to send the new variables to the plurality of policy-managed devices causes the policy-managed devices to:
receive the new variables from the device management server; and
generate a device key based on the new variables from the device management server.
9. The method of claim 8 , wherein sending the commands directing the device management server to send the new variables to the plurality of policy-managed devices causes the plurality of policy-managed devices to:
read offline variables from local storage of the plurality of policy-managed devices;
generate an offline device key based on the offline variables from the local storage;
read offline encrypted file keys from the local storage, wherein the offline encrypted file keys correspond to files residing on the plurality of policy-managed devices;
decrypt the offline encrypted file keys with the offline device key to generate decrypted file keys; and
encrypt the decrypted file keys with the device key generated based on the new variables to generate encrypted file keys.
10. The method of claim 9 , wherein sending the commands directing the device management server to send the new variables to the plurality of policy-managed devices causes the plurality of policy-managed devices to:
store the encrypted file keys in the local storage of the plurality of policy-managed devices; and
store the new variables in the local storage.
11. A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via a key upgrade service provided by the computing platform, from an administrator console device, a request to generate one or more new keys;
in response to receiving the request to generate the one or more new keys, generate a new tenant master key and a new server recovery key;
send, via the communication interface, to a cloud-based key vault server, the new tenant master key and the new server recovery key, wherein the cloud-based key vault server is configured to store the new tenant master key and is further configured to encrypt the new server recovery key with the new tenant master key to produce an encrypted server recovery key, wherein the encrypted server recovery key enables a plurality of policy-managed devices associated with a tenant to authenticate with the key update service;
receive, via the communication interface, from the cloud-based key vault server, the encrypted server recovery key;
send, via the communication interface, to a tenant database server associated with one or more enrollment servers, the encrypted server recovery key, wherein the tenant database server is separate from the cloud-based key vault server and wherein the tenant database server stores the encrypted server recover key; and
provision the one or more enrollment servers with the encrypted server recovery key by sending the encrypted server recovery key to the one or more enrollment servers via the communication interface,
wherein the one or more enrollment servers are configured to manage enrollment of the plurality of policy-managed devices in a policy enforcement scheme and to authenticate with the key update service based on the encrypted server recovery key.
12. The computing platform of claim 11 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
detect a new enrollment server is online; and
send, via the communication interface, the encrypted server recovery key to the new enrollment server.
13. The computing platform of claim 12 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
provision the new enrollment server enabling the plurality of policy-managed devices to enroll with the new enrollment server.
14. The computing platform of claim 11 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
send, via the communication interface, commands to the plurality of policy-managed devices to generate a device key for each of the plurality of policy-managed devices.
15. The computing platform of claim 11 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
send, via the communication interface, commands to the plurality of policy-managed devices to generate file keys for one or more files residing on the plurality of policy-managed devices.
16. The computing platform of claim 11 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
send, via the communication interface, commands directing a device management server to send new variables to the plurality of policy-managed devices.
17. The computing platform of claim 16 , wherein sending the commands directing the device management server to send the new variables to the plurality of policy-managed devices causes the plurality of policy-managed devices to:
receive the new variables from the device management server; and
generate a device key based on the new variables from the device management server.
18. The computing platform of claim 17 , wherein sending the commands directing the device management server to send the new variables to the policy-managed devices causes the plurality of policy-managed devices to:
read offline variables from local storage of the plurality of policy-managed devices;
generate an offline device key based on the offline variables from the local storage;
read offline encrypted file keys from the local storage, wherein the offline encrypted file keys correspond to files residing on the plurality of policy-managed devices;
decrypt the offline encrypted file keys with the offline device key to generate decrypted file keys; and
encrypt the decrypted file keys with the device key generated based on the new variables to generate encrypted file keys.
19. The computing platform of claim 18 , wherein sending the commands directing the device management server to send the new variables to the plurality of policy-managed devices causes the plurality of policy-managed devices to:
store the encrypted file keys in the local storage of the plurality of policy-managed devices; and
store the new variables in the local storage.
20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:
receive, via a key upgrade service provided by the computing platform, from an administrator console device, a request to generate one or more new keys;
in response to receiving the request to generate the one or more new keys, generate a new tenant master key and a new server recovery key;
send, via the communication interface, to a cloud-based key vault server, the new tenant master key and the new server recovery key, wherein the cloud-based key vault server is configured to store the new tenant master key and is further configured to encrypt the new server recovery key with the new tenant master key to produce an encrypted server recovery key, wherein the encrypted server recovery key enables a plurality of policy-managed devices associated with a tenant to authenticate with the key update service;
receive, via the communication interface, from the cloud-based key vault server, the encrypted server recovery key;
send, via the communication interface, to a tenant database server associated with one or more enrollment servers, the encrypted server recovery key, wherein the tenant database server is separate from the cloud-based key vault server and wherein the tenant database server stores the encrypted server recover key; and
provision the one or more enrollment servers with the encrypted server recovery key by sending the encrypted server recovery key to the one or more enrollment servers via the communication interface,
wherein the one or more enrollment servers are configured to manage enrollment of one or more policy-managed devices in a policy enforcement scheme and to authenticate with the key update service based on the encrypted server recovery key.