Shuffling cryptographic keys stored in clouds of a multi-cloud environment

1. A method comprising:

receiving, at a key management system from one or more client devices, one or more requests for cryptographic keys stored in respective clouds of a plurality of cloud service providers in a multi-cloud environment, the cryptographic keys being distributed across different ones of the respective clouds of the plurality of cloud service providers in the multi-cloud environment;

determining a location of a given one of the requested cryptographic keys on one or more of the clouds of the cloud service providers in the multi-cloud environment;

retrieving the given cryptographic key from the determined location in the multi-cloud environment;

providing the given cryptographic key to a given one of the client devices; and

shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers in the multi-cloud environment;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 wherein the key management system is implemented on an additional cloud of an additional cloud service provider distinct from the plurality of cloud service providers on which the cryptographic keys are stored.

3. The method of claim 1 wherein the given cryptographic key comprises a key encryption key (KEK) utilized to encrypt one or more data encryption keys (DEKs) that protect data stored in the multi-cloud environment.

4. The method of claim 1 wherein the cryptographic keys are distributed across the clouds of the plurality of cloud service providers in the multi-cloud environment utilizing a tree structure, and wherein portions of the cryptographic keys are stored in leaves of the tree structure.

5. The method of claim 4 wherein the tree structure comprises an unchained B+ tree structure.

6. The method of claim 4 wherein internal nodes and the leaves of the tree structure are distributed among the clouds of the plurality of cloud service providers in the multi-cloud environment.

7. The method of claim 4 wherein a given node of the tree structure comprises a logical identifier, the logical identifier comprising:

a first portion identifying a given one of the cloud service providers;

a second portion identifying a level of the tree structure; and

a third portion indicating a location on a given cloud within the given cloud service provider.

8. The method of claim 1 wherein the given cryptographic key comprises two or more portions distributed across clouds of two or more of the plurality of cloud service providers in the multi-cloud environment.

9. The method of claim 1 wherein the plurality of cloud service providers in the multi-cloud environment provide confidentiality and integrity protection for the plurality of cryptographic keys stored thereon.

10. The method of claim 9 wherein the plurality of cloud service providers utilize encryption of the cryptographic keys to provide confidentiality and keyed-hash message authentication codes (HMACs) of the cryptographic keys to provide integrity protection.

11. The method of claim 1 wherein the plurality of cloud service providers in the multi-cloud environment are not provisioned with knowledge of the ownership or associations of the cryptographic keys stored thereon.

12. The method of claim 1 wherein shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers in the multi-cloud environment is performed responsive to each of the one or more requests received at the key management system.

13. The method of claim 12 wherein shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers comprises moving each of the cryptographic keys from a previous location on a cloud of one of the cloud service providers in the multi-cloud environment to a new location on a cloud of a different one of the cloud service providers in the multi-cloud environment.

14. The method of claim 1 wherein shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers comprises re-distributing the cryptographic keys pseudo-randomly across the clouds of the plurality of cloud service providers in the multi-cloud environment.

15. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device cause the at least one processing device:

to receive, at a key management system from one or more client devices, one or more requests for cryptographic keys stored in respective clouds of a plurality of cloud service providers in a multi-cloud environment, the cryptographic keys being distributed across different ones of the respective clouds of the plurality of cloud service providers in the multi-cloud environment;

to determine a location of a given one of the requested cryptographic keys on one or more of the clouds of the cloud service providers in the multi-cloud environment;

to retrieve the given cryptographic key from the determined location in the multi-cloud environment;

to provide the given cryptographic key to a given one of the client devices; and

to shuffle the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers in the multi-cloud environment.

16. The computer program product of claim 15 wherein shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers in the multi-cloud environment is performed responsive to each of the one or more requests received at the key management system, and wherein shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers comprises moving each of the cryptographic keys from a previous location on a cloud of one of the cloud service providers in the multi-cloud environment to a new location on a cloud of a different one of the cloud service providers in the multi-cloud environment.

17. The computer program product of claim 15 wherein the cryptographic keys are distributed across the clouds of the plurality of cloud service providers in the multi-cloud environment utilizing a tree structure, and wherein portions of the cryptographic keys are stored in leaves of the tree structure.

18. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the at least one processing device being configured:

to receive, at a key management system from one or more client devices, one or more requests for cryptographic keys stored in respective clouds of a plurality of cloud service providers in a multi-cloud environment, the cryptographic keys being distributed across different ones of the respective clouds of the plurality of cloud service providers in the multi-cloud environment;

to determine a location of a given one of the requested cryptographic keys on one or more of the clouds of the cloud service providers in the multi-cloud environment;

to retrieve the given cryptographic key from the determined location in the multi-cloud environment;

to provide the given cryptographic key to a given one of the client devices; and

to shuffle the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers in the multi-cloud environment.

19. The apparatus of claim 18 wherein shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers in the multi-cloud environment is performed responsive to each of the one or more requests received at the key management system, and wherein shuffling the distribution of the cryptographic keys across the clouds of the plurality of cloud service providers comprises moving each of the cryptographic keys from a previous location on a cloud of one of the cloud service providers in the multi-cloud environment to a new location on a cloud of a different one of the cloud service providers in the multi-cloud environment.

20. The apparatus of claim 18 wherein the cryptographic keys are distributed across the clouds of the plurality of cloud service providers in the multi-cloud environment utilizing a tree structure, and wherein portions of the cryptographic keys are stored in leaves of the tree structure.