Encryption key management of client devices and endpoints within a protected network
Disclosed are various examples for establishing encrypted channels or tunnels within a TCP or other communication session between a tunnel endpoint and tunnel client on a client device. A tunnel endpoint on the client device can determine an encryption key based upon whether a client device is in compliance with encryption policies of the enterprise.
1. A non-transitory computer-readable medium embodying at least one program executable in a tunnel endpoint, the tunnel endpoint providing a gateway to a software defined network, the at least one program, when executed by the tunnel endpoint, being configured to cause the tunnel endpoint to at least:
cause an encryption key to be deployed to a client device, wherein the client device is external to the software defined network and configured with a virtual private network (VPN) configuration from a management service with which the client device is enrolled as a managed device, the VPN configuration identifying the encryption key and an address of the tunnel endpoint;
cause the encryption key to be deployed to at least one endpoint internal to the software defined network, wherein the at least one endpoint uses the encryption key to encrypt communications within the software defined network and with the client device;
obtain a packet from the client device that is encrypted using the encryption key, the packet associated with an endpoint within the software defined network;
determine, based upon the packet encrypted using the encryption key, that the client device is non-compliant with at least one compliance rule based upon a packet header associated with the packet; and
cause revocation of the encryption key deployed to the client device by issuing a new encryption key to the at least one endpoint internal to the software defined network, wherein the at least one endpoint uses the new encryption key for communications within the software defined network and external to the software defined network.
2. The non-transitory computer-readable medium of claim 1 , wherein the at least one program further causes the tunnel endpoint to at least:
subsequently determine that the client device is compliant with the at least one compliance rule; and
issue the new encryption key to the client device.
3. The non-transitory computer-readable medium of claim 1 , wherein the at least one program determines that the client device is non-compliant based upon a geolocation of the client device, a network type associated with the client device, or a device posture determined from data embedded within the packet header.
4. The non-transitory computer-readable medium of claim 1 , wherein the tunnel endpoint causes revocation of the encryption key by issuing a third encryption key to the client device, wherein an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.
5. The non-transitory computer-readable medium of claim 4 , wherein the tunnel endpoint causes revocation of the encryption key by causing the management service to issue a third encryption key to the client device, wherein the encryption level associated with the third encryption key is stronger than the encryption key that is revoked.
6. The non-transitory computer-readable medium of claim 1 , wherein the tunnel endpoint causes revocation of the encryption key by discarding subsequent packets received from the client device that are encrypted using the encryption key.
7. A system, comprising:
at least one computing device; and
an application executable by the at least one computing device, the application configured to cause the at least one computing device to at least:
cause an encryption key to be deployed to a client device, wherein the client device is external to a protected network and configured with a virtual private network (VPN) configuration from a management service with which the client device is enrolled as a managed device, the VPN configuration identifying the encryption key and an address of the tunnel endpoint;
cause the encryption key to be deployed to at least one endpoint internal to the protected network, wherein the at least one endpoint uses the encryption key to encrypt communications within the protected network and with the client device;
obtain a packet from the client device that is encrypted using the encryption key, the packet associated with an endpoint within the protected network;
determine, based upon the packet encrypted using the encryption key, that the client device is non-compliant with at least one compliance rule based upon a packet header associated with the packet; and
cause revocation of the encryption key deployed to the client device by issuing a new encryption key to the at least one endpoint internal to the protected network, wherein the at least one endpoint uses the new encryption key for communications within the protected network and external to the protected network.
8. The system of claim 7 , wherein the application causes the at least one computing device to at least:
subsequently determine that the client device is compliant with the at least one compliance rule; and
issue the new encryption key to the client device.
9. The system of claim 7 , wherein determining that the client device is non-compliant is based upon a geolocation of the client device, a network type associated with the client device, or a device posture determined from data embedded within the packet header.
10. The system of claim 7 , wherein the at least one computing device causes revocation of the encryption key by causing the management service to issue a third encryption key to the client device, and an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.
11. The system of claim 7 , wherein the at least one computing device causes revocation of the encryption key by causing the management service to issue a third encryption key to the client device, and an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.
12. The system of claim 7 , wherein the at least one computing device causes revocation of the encryption key by discarding subsequent packets received from the client device that are encrypted using the encryption key.
13. A method implemented in a at least one computing device comprising:
causing an encryption key to be deployed to a client device, wherein the client device is external to a protected network and configured with a virtual private network (VPN) configuration from a management service with which the client device is enrolled as a managed device, the VPN configuration identifying the encryption key and an address of the tunnel endpoint;
causing the encryption key to be deployed to at least one endpoint internal to the protected network, wherein the at least one endpoint uses the encryption key to encrypt communications within the protected network and with the client device;
obtaining a packet from the client device that is encrypted using the encryption key, the packet associated with an endpoint within the protected network;
determining, based upon the packet encrypted using the encryption key, that the client device is non-compliant with at least one compliance rule based upon a packet header associated with the packet; and
causing revocation of the encryption key deployed to the client device by issuing a new encryption key to the at least one endpoint internal to the protected network, wherein the at least one endpoint uses the new encryption key for communications within the protected network and external to the protected network.
14. The method of claim 13 , further comprising
subsequently determining that the client device is compliant with the at least one compliance rule; and
issuing the new encryption key to the client device.
15. The method of claim 13 , wherein determining that the client device is non-compliant is based upon a geolocation of the client device, a network type associated with the client device or a device posture determined from data embedded within the packet header.
16. The method of claim 13 , wherein causing revocation of the encryption key further comprises issuing a third encryption key to the client device, and an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.
17. The method of claim 13 , wherein causing revocation of the encryption key further comprises causing the management service to issue a third encryption key to the client device, and an encryption level associated with the third encryption key is stronger than the encryption key that is revoked.