Cryptographic key management using key proxies and generational indexes
Techniques are provided to implement a key management service using key proxies and generational indexes, which allows client applications to obtain data cryptographic services without having to utilize or otherwise have knowledge of cryptographic keys. For example, a key management service receives a data decryption request from a client application. The data decryption request includes encrypted data and a key proxy assigned to the client application. The key management service determines a generational index associated with the encrypted data. The generational index identifies a generation of a cryptographic key which is associated with the key proxy and which was used to create the encrypted data. The key management service obtains a cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index, decrypts the encrypted data using the obtained cryptographic key, and sends the decrypted data to the client application.
1. A method, comprising:
receiving, by a key management service executing on a first computing system, a data decryption request from a client application executing on a second computing system, wherein the data decryption request comprises encrypted data, a generational index associated with the encrypted data, and a key proxy assigned to the client application, wherein the key proxy comprises a unique identifier of a set of one or more cryptographic keys associated with the key proxy assigned to the client application;
determining, by the key management service, the generational index associated with the encrypted data, wherein the generational index identifies a generation of a given cryptographic key which is included in the set of one or more cryptographic keys associated with the key proxy and which was used to create the encrypted data;
obtaining, by the key management service, the generation of the cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index;
decrypting, by the key management service, the encrypted data using the obtained cryptographic key to generate decrypted data; and
sending, by the key management service, the decrypted data to the client application.
2. The method of claim 1 , wherein the key proxy comprises a key proxy tag that is stored as metadata in association with the encrypted data.
3. The method of claim 1 , wherein:
the generational index comprises a generational index tag that is stored as metadata in association with the encrypted data; and
the key management service extracts the generational index tag from the metadata of the encrypted data to determine the generational index associated with the encrypted data.
4. The method of claim 1 , comprising:
receiving, by the key management service, credentials of the client application;
authenticating, by the key management service, the client application using the received credentials; and
initiating, by the key management service, a secure communications channel between the first and second computing systems in response to the client application being authenticated;
wherein the data decryption request is received by the key management service over the secure communications channel; and
wherein the decrypted data is sent by the key management service to the client application over the secure communications channel.
5. The method of claim 4 , wherein authenticating the client application using the received credentials, comprises:
comparing, by the key management service, the received credentials of the client application to a client identifier associated with the received key proxy to determine whether the received credentials match the client identifier associated with the received proxy; and
authenticating the client application, in response to determining that the received credentials match the client identifier associated with the received key proxy.
6. The method of claim 1 , comprising:
receiving, by the key management service, a data encryption request from the client application, wherein the data encryption request comprises data to be encrypted and the key proxy assigned to the client application;
determining, by the key management service, a current generational index associated with the key proxy, wherein the current generational index identifies a primary version of a cryptographic key which is associated with the key proxy and which is used, by default, to encrypt the data received from the client application;
obtaining, by the key management service, the primary version of the cryptographic key from the secure key vault, which is mapped to the received key proxy and the current generational index;
encrypting, by the key management service, the received data using the obtained cryptographic key to generate encrypted data; and
sending, by the key management service, the encrypted data to the client application.
7. The method of claim 1 , comprising:
receiving, by the key management service, a key proxy assignment request from a second client application;
assigning, by the key management service, a key proxy to the second client application;
generating, by the key management service, a new cryptographic key for the second client application; and
storing, by the key management service, the new cryptographic key in the secure key vault in association with the assigned key proxy and an initial generational index.
8. The method of claim 7 , wherein assigning, by the key management service, the key proxy to the second client application comprises:
generating, by the key management service, a key proxy for the second client application; and
sending, by the key management service, the generated key proxy to the second client application.
9. The method of claim 1 , comprising:
monitoring, by the key management service, for the occurrence of a predetermined event that mandates rotation of a current cryptographic key associated with the key proxy assigned to the client application;
in response to detecting the predetermined event, the key management service generating a new cryptographic key for the client application and creating a new generational index that corresponds to the new cryptographic key; and
mapping, by the key management service, the key proxy of the client application to the new generational index and the new cryptographic key.
10. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code is executable by one or more processors to implement a method comprising:
receiving, by a key management service executing on a first computing system, a data decryption request from a client application executing on a second computing system, wherein the data decryption request comprises encrypted data, a generational index associated with the encrypted data, and a key proxy assigned to the client application, wherein the key proxy comprises a unique identifier of a set of one or more cryptographic keys associated with the key proxy assigned to the client application;
determining, by the key management service, the generational index associated with the encrypted data, wherein the generational index identifies a generation of a given cryptographic key which is included in the set of one or more cryptographic keys associated with the key proxy and which was used to create the encrypted data;
obtaining, by the key management service, the generation of the cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index;
decrypting, by the key management service, the encrypted data using the obtained cryptographic key to generate decrypted data; and
sending, by the key management service, the decrypted data to the client application.
11. The article of manufacture of claim 10 , wherein the key proxy comprises a key proxy tag that is stored as metadata in association with the encrypted data.
12. The article of manufacture of claim 10 , wherein:
the generational index comprises a generational index tag that is stored as metadata in association with the encrypted data; and
the key management service extracts the generational index tag from the metadata of the encrypted data to determine the generational index associated with the encrypted data.
13. The article of manufacture of claim 10 , wherein the program code is executable by the one or more processors to implement a method comprising:
receiving, by the key management service, credentials of the client application;
authenticating, by the key management service, the client application using the received credentials; and
initiating, by the key management service, a secure communications channel between the first and second computing systems in response to the client application being authenticated;
wherein the data decryption request is received by the key management service over the secure communications channel; and
wherein the decrypted data is sent by the key management service to the client application over the secure communications channel.
14. The article of manufacture of claim 13 , wherein the program code for authenticating the client application using the received credentials, comprises program code that is executable by the one or more processors to implement a method comprising:
comparing, by the key management service, the received credentials of the client application to a client identifier associated with the received key proxy to determine whether the received credentials match the client identifier associated with the received proxy; and
authenticating the client application, in response to determining that the received credentials match the client identifier associated with the received key proxy.
15. The article of manufacture of claim 10 , wherein the program code is executable by the one or more processors to implement a method comprising:
receiving, by the key management service, a data encryption request from the client application, wherein the data encryption request comprises data to be encrypted and the key proxy assigned to the client application;
determining, by the key management service, a current generational index associated with the key proxy, wherein the current generational index identifies a primary version of a cryptographic key which is associated with the key proxy and which is used, by default, to encrypt the data received from the client application;
obtaining, by the key management service, the primary version of the cryptographic key from the secure key vault, which is mapped to the received key proxy and the current generational index;
encrypting, by the key management service, the received data using the obtained cryptographic key to generate encrypted data; and
sending, by the key management service, the encrypted data to the client application.
16. The article of manufacture of claim 10 , wherein the program code is executable by the one or more processors to implement a method comprising:
receiving, by the key management service, a key proxy assignment request from a second client application;
assigning, by the key management service, a key proxy to the second client application;
generating, by the key management service, a new cryptographic key for the second client application; and
storing, by the key management service, the new cryptographic key in the secure key vault in association with the assigned key proxy and an initial generational index.
17. The article of manufacture of claim 16 , wherein assigning, by the key management service, the key proxy to the second client application comprises:
generating, by the key management service, a key proxy for the second client application; and
sending, by the key management service, the generated key proxy to the second client application.
18. The article of manufacture of claim 10 , wherein the program code is executable by the one or more processors to implement a method comprising:
monitoring, by the key management service, for the occurrence of a predetermined event that mandates rotation of a current cryptographic key associated with the key proxy assigned to the client application;
in response to detecting the predetermined event, the key management service generating a new cryptographic key for the client application and creating a new generational index that corresponds to the new cryptographic key; and
mapping, by the key management service, the key proxy of the client application to the new generational index and the new cryptographic key.
19. A computing system, comprising:
at least one processor; and
a system memory configured to store program code, wherein the program code is executable by the at least one processor to instantiate a key management service, wherein the key management service is configured to:
receive a data decryption request from a client application executing on a second computing system, wherein the data decryption request comprises encrypted data, a generational index associated with the encrypted data, and a key proxy assigned to the client application, wherein the key proxy comprises a unique identifier of a set of one or more cryptographic keys associated with the key proxy assigned to the client application;
determine the generational index associated with the encrypted data, wherein the generational index identifies a generation of a given cryptographic key which is included in the set of one or more cryptographic keys associated with the key proxy and which was used to create the encrypted data;
obtain the generation of the cryptographic key from a secure key vault, which is mapped to the received key proxy and the determined generational index;
decrypt the encrypted data using the obtained cryptographic key to generate decrypted data; and
send the decrypted data to the client application.
20. The computing system of claim 19 , wherein the key management service is configured to:
receive a data encryption request from the client application, wherein the data encryption request comprises data to be encrypted and the key proxy assigned to the client application;
determine a current generational index associated with the key proxy, wherein the current generational index identifies a primary version of a cryptographic key which is associated with the key proxy and which is used, by default, to encrypt the data received from the client application;
obtain the primary version of the cryptographic key from the secure key vault, which is mapped to the received key proxy and the current generational index;
encrypt the received data using the obtained cryptographic key to generate encrypted data; and
send the encrypted data to the client application.