Preventing encryption key recovery by a cloud provider
Methods, systems, and devices for encryption key storage are described. An application server may store an encryption key in volatile memory and access the key directly from the volatile memory when performing an encryption process. In some cases, a user may supply the encryption key to the application server on demand. Accordingly, when the application server is restarted, the encryption key may be purged from the memory. In some cases, the encryption key may be wrapped in a public key, and the application server may derive a private key to decrypt the public key-encrypted information to access the encryption key and store it in the volatile memory. Additionally or alternatively, the user may supply a first fragment of the encryption key, and the application server may derive the encryption key from the first fragment and a second fragment of the encryption key retrieved from a database.
1. A method for encryption key storage at an application server, comprising:
identifying, at the application server, an encryption process to perform on a first data object;
receiving, at the application server, from a user associated with a user device, data encryption key data corresponding to the encryption process;
deriving, at the application server, a data encryption key based on the data encryption key data and a second fragment of the data encryption key retrieved from a database;
storing the data encryption key data and the data encryption key in volatile memory of the application server;
performing, at the application server, the encryption process on the first data object by accessing the data encryption key from the volatile memory;
restarting, at the application server and in response to receiving a key destruction request from the user, the application server, wherein the restarting the application server removes the data encryption key data and the data encryption key from the volatile memory; and
receiving, at the application server, from the user, the data encryption key data after the restarting the application server, wherein after the restarting the application server, the application server lacks an ability to derive the data encryption key until receiving the data encryption key data from the user.
2. The method of claim 1 , further comprising:
transmitting, to the user, a request for the data encryption key data based at least in part on the identifying the encryption process.
3. The method of claim 1 , wherein the receiving the data encryption key data comprises receiving the data encryption key data wrapped in a public key, the method further comprising:
retrieving, from the database, a private key corresponding to the public key; and
unwrapping the data encryption key data based at least in part on the public key and the corresponding private key.
4. The method of claim 3 , wherein the retrieving the private key further comprises:
retrieving one or more private key derivation inputs; and
deriving the private key based at least in part on the private key derivation inputs and a private key derivation function.
5. The method of claim 3 , wherein the public key and the private key correspond to a Rivest-Shamir-Adleman (RSA) encryption system, an ElGamal encryption system, or a combination thereof.
6. The method of claim 1 , wherein the receiving the data encryption key data comprises receiving a first fragment of the data encryption key.
7. The method of claim 6 , wherein the deriving the data encryption key comprises:
deriving the data encryption key based at least in part on the first fragment of the data encryption key and the second fragment of the data encryption key.
8. The method of claim 1 , wherein the encryption process comprises encrypting the first data object, decrypting the first data object, a key rotation process for the first data object, an encryption scheme change for the first data object, or a combination thereof.
9. The method of claim 1 , further comprising:
failing to derive the data encryption key based at least in part on removing the data encryption key data and the data encryption key from the volatile memory.
10. The method of claim 1 , further comprising:
transmitting, to the user, a request for additional data encryption key data corresponding to an additional encryption process to perform on a second data object based at least in part on the restarting the application server.
11. The method of claim 10 , further comprising:
receiving, from the user, the additional data encryption key data corresponding to the additional encryption process based at least in part on the request;
deriving an additional data encryption key based on the additional data encryption key data and an additional second fragment of the additional data encryption key retrieved from a database;
storing the additional data encryption key data and the additional data encryption key in the volatile memory of the application server; and
performing the additional encryption process on the second data object by accessing the additional data encryption key from the volatile memory, wherein the additional encryption process allows access to the second data object by decrypting the second data object using the additional data encryption key.
12. An apparatus for encryption key storage at an application server, comprising:
a processor;
memory in electronic communication with the processor; and
instructions stored in the memory and executable by the processor to cause the apparatus to:
identify, at the application server, an encryption process to perform on a first data object;
receive, at the application server, from a user associated with a user device, data encryption key data corresponding to the encryption process;
derive, at the application server, a data encryption key based on the data encryption key data and a second fragment of the data encryption key retrieved from a database;
store the data encryption key data and the data encryption key in volatile memory of the application server;
perform, at the application server, the encryption process on the first data object by accessing the data encryption key from the volatile memory;
restart, at the application server and in response to receiving a key destruction request from the user, the application server, wherein the restarting the application server removes the data encryption key data and the data encryption key from the volatile memory; and
receive, at the application server, from the user, the data encryption key data after the restarting the application server, wherein after the restarting the application server, the application server lacks an ability to derive the data encryption key until receiving the data encryption key data from the user.
13. The apparatus of claim 12 , wherein the data encryption key data is received wrapped in a public key and the instructions are further executable by the processor to cause the apparatus to:
retrieve, from the database, a private key corresponding to the public key; and
unwrap the data encryption key based at least in part on the public key and the corresponding private key.
14. The apparatus of claim 12 , wherein the data encryption key data is received as a first fragment of the data encryption key.
15. The apparatus of claim 14 , wherein the deriving the data encryption key comprises:
deriving the data encryption key based at least in part on the first fragment of the data encryption key and the second fragment of the data encryption key.
16. A non-transitory computer-readable medium storing code for encryption key storage at an application server, the code comprising instructions executable by a processor to:
identify, at the application server, an encryption process to perform on a first data object;
receive, at the application server, from a user associated with a user device, data encryption key data corresponding to the encryption process;
derive, at the application server, a data encryption key based on the data encryption key data and a second fragment of the data encryption key retrieved from a database;
store the data encryption key data and the data encryption key in volatile memory of the application server;
perform, at the application server, the encryption process on the first data object by accessing the data encryption key from the volatile memory;
restart, at the application server and in response to receiving a key destruction request from the user, the application server, wherein the restarting the application server removes the data encryption key data and the data encryption key from the volatile memory; and
receive, at the application server, from the user, the data encryption key data after the restarting the application server, wherein after the restarting the application server, the application server lacks an ability to derive the data encryption key until receiving the data encryption key data from the user.
17. The non-transitory computer-readable medium of claim 16 , wherein the data encryption key data is received wrapped in a public key and the instructions are further executable by the processor to:
retrieve, from the database, a private key corresponding to the public key; and
unwrap the data encryption key based at least in part on the public key and the corresponding private key.
18. The non-transitory computer-readable medium of claim 16 , wherein the data encryption key data is received as a first fragment of the data encryption key.
19. The non-transitory computer-readable medium of claim 18 , wherein deriving the data encryption key comprises:
deriving the data encryption key based at least in part on the first fragment of the data encryption key and the second fragment of the data encryption key.