Systems and methods for organizing devices in a policy hierarchy
In various embodiments, there is provide a method for organizing devices in a policy hierarchy. The method includes creating a first node. The method further includes assigning a first policy to the first node. The method further includes creating a second node, the second node referencing the first node as a parent node such that the second node inherits the first policy of the first node.
1. A method for authorizing a first device to use an encryption key of a second device, comprising:
receiving, by a system, an encryption key originating from the second device;
determining, by the system based on at least one policy for evaluating whether one or more cryptographic attributes of the encryption key are secure, that the encryption key is secure to be used in a communication involving the first device, wherein the first device is registered to a first node of a hierarchical structure of policies, the second device is registered to a second node of the hierarchical structure, and the at least one policy corresponds to the first node; and
authorizing, by the system, the first device to use the encryption key in the communication to encrypt data using the encryption key.
2. The method of claim 1 , wherein the system receives the encryption key responsive to the encryption key being requested by the first device for the communication.
3. The method of claim 1 , wherein the second device is one of a hardware security module, a key management device, or an encryption key source.
4. The method of claim 1 , wherein at least one policy comprises one or more policies different from one or more policies corresponding to the second node.
5. The method of claim 1 , wherein one or more policies of the at least one policy are inherited from the second node.
6. The method of claim 1 , wherein
the second node is one or more policies of the first node in the hierarchical structure; and
the first node inherits at least one policy from the second node.
7. The method of claim 1 , wherein
the hierarchical structure is a Directed Acyclic Graph having a plurality of nodes; and
the plurality of nodes comprises the first node and the second node.
8. The method of claim 1 , wherein the one or more cryptographic attributes comprise a size of the encryption key.
9. The method of claim 1 , wherein the one or more cryptographic attributes comprises a time at which encryption key is generated.
10. The method of claim 1 , wherein authorizing the first device to use the encryption key in the communication comprises distributing the encryption key to the first device in response to determining that the encryption key is secure to be used in the communication involving the first device.
11. The method of claim 1 , wherein the one or more cryptographic attributes comprise a utilization of the encryption key.
12. A non-transitory processor-readable medium comprising processor readable-instructions for authorizing a first device to use an encryption key of a second device, such that, when executed, causes a processor to:
receive an encryption key;
determine, based on at least one policy for evaluating whether one or more cryptographic attributes of the encryption key are secure, that the encryption key is secure to be used in a communication involving the first device, wherein the first device is registered to a first node of a hierarchical structure of policies, the second device is registered to a second node of the hierarchical structure, and the at least one policy corresponds to the first node; and
authorize the first device to use the encryption key in the communication to encrypt data using the encryption key.
13. The non-transitory processor-readable medium of claim 12 , wherein the encryption key is received responsive to the encryption key being requested by the first device for the communication.
14. The non-transitory processor-readable medium of claim 12 , wherein the second device is one of a hardware security module, a key management device, or an encryption key source.
15. The non-transitory processor-readable medium of claim 12 , wherein at least one policy comprises one or more policies different from one or more policies corresponding to the second node.
16. The non-transitory processor-readable medium of claim 12 , wherein one or more policies of the at least one policy are inherited from the second node.
17. The non-transitory processor-readable medium of claim 12 , wherein
the second node is one or more policies of the first node in the hierarchical structure; and
the first node inherits at least one policy from the second node.
18. The non-transitory processor-readable medium of claim 12 , wherein the one or more cryptographic attributes comprise at least one of a size of the encryption key or a time at which encryption key is generated.
19. The non-transitory processor-readable medium of claim 12 , wherein the one or more cryptographic attributes comprise a utilization of the encryption key.
20. A system for authorizing a first device to use an encryption key of a second device, comprising:
a processing circuit having a processor and a memory, wherein the processing circuit is configured to:
receive an encryption key originating from the second device;
determine, based on at least one policy for evaluating whether one or more cryptographic attributes of the encryption key are secure, that the encryption key is secure to be used in a communication involving the first device, wherein the first device is registered to a first node of a hierarchical structure of policies, the second device is registered to a second node of the hierarchical structure, and the at least one policy corresponds to the first node; and
authorize the first device to use the encryption key in the communication to encrypt data using the encryption key.