Key rotation service
A system for security key rotation in a cloud computing environment is disclosed. The system performs steps to at least initiate, at a predetermined interval, a call to determine whether to initiate generation of a public-private key pair for a client application. The system determines whether to initiate generation of the public-private key pair for the client application and based on determining to initiate generation of the public-private key pair for the client application, transmits a control signal requesting generation of the public-private key pair The system generates the public-private key pair and transmits a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application and transmits a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.
1. A computer implemented method for security key rotation in a cloud computing environment, the method comprising:
initiating, by one or more computing devices of the cloud computing environment and at a predetermined interval, a call to a key rotation control module to determine whether to initiate generation of a public-private key pair for a client application;
determining, by the key rotation control module, whether to initiate generation of the public-private key pair for the client application based on:
querying a database to obtain a product configuration for the client application, wherein the product configuration includes a key rotation period associated with the client application indicating a frequency at which the public-private key pair for the client application is to be generated,
determining whether a difference between a last time a previous public-private key pair was generated for the client application and a current time is greater than the key rotation period,
based on determining the difference between the last time the previous public-private key pair was generated for the client application and the current time is greater than the key rotation period, initiating generation of the public-private key pair;
based on determining to initiate generation of the public-private key pair for the client application, transmitting, by the one or more computing devices, a control signal from the key rotation control module to a key rotation module requesting generation of the public-private key pair;
generating, by the key rotation module, the public-private key pair;
updating, by the key rotation module, the database with a timestamp indicating when the public-private key pair was generated for the client application, the timestamp to replace the last time the previous public-private key pair was generated for the client application;
transmitting, by the one or more computing devices, a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application; and
transmitting, by the one or more computing devices, a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.
2. The computer implemented method of claim 1 , wherein the product configuration further includes a key validity period associated with the key rotation period, wherein the key validity period indicates a duration for which the public-private key pair is accessible by the client application and the client.
3. The computer implemented method of claim 2 , wherein the key validity period is greater than the key rotation period.
4. The computer implemented method of claim 1 , further comprising generating a notification based on generating the public-private key pair.
5. The computer implemented method of claim 1 , wherein the public-private key pair is: Elliptic Curve (EC) keys, RSA keys, or digital signature keys.
6. The computer implemented method of claim 1 , wherein the key rotation control module and the key rotation module are implemented as serverless functions of the cloud computing environment.
7. The computer implemented method of claim 1 , further comprising:
receiving, by the one or more computing devices, a request by a user to initiate generation of the public-private key pair; and
based on receiving the request, initiating, by the key rotation control module, generation of the public-private key pair.
8. A non-transitory computer readable medium including instructions for security key rotation in a cloud computing environment, the instructions comprising:
initiating, by one or more computing devices of the cloud computing environment and at a predetermined interval, a call to a key rotation control module to determine whether to initiate generation of a public-private key pair for a client application;
determining, by the key rotation control module, whether to initiate generation of the public-private key pair for the client application based on:
querying a database to obtain a product configuration for the client application, wherein the product configuration includes a key rotation period associated with the client application indicating a frequency at which the public-private key pair for the client application is to be generated,
determining whether a difference between a last time a previous public-private key pair was generated for the client application and a current time is greater than the key rotation period,
based on determining the difference between the last time the previous public-private key pair was generated for the client application and the current time is greater than the key rotation period, initiating generation of the public-private key pair;
based on determining to initiate generation of the public-private key pair for the client application, transmitting a control signal from the key rotation control module to a key rotation module requesting generation of the public-private key pair;
generating, by the key rotation module, the public-private key pair;
updating, by the key rotation module, the database with a timestamp indicating when the public-private key pair was generated for the client application, the timestamp to replace the last time the previous public-private key pair was generated for the client application;
transmitting a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application;
transmitting a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application; and
wherein the product configuration further includes a key validity period associated with the key rotation period, wherein the key validity period indicates a duration for which the public-private key pair is accessible by the client application and the client.
9. The non-transitory computer readable medium of claim 8 , with instructions wherein the key validity period is greater than the key rotation period.
10. The non-transitory computer readable medium of claim 8 , with instructions further comprising generating a notification based on generating the public-private key pair.
11. The non-transitory computer readable medium of claim 8 , with instructions wherein the public-private key pair is: Elliptic Curve (EC) keys, RSA keys, or digital signature keys.
12. The non-transitory computer readable medium of claim 8 , with instructions wherein the key rotation control module and the key rotation module are implemented as serverless functions of the cloud computing environment.
13. The non-transitory computer readable medium of claim 8 , with instructions further comprising:
receiving, by the one or more computing devices, a request by a user to initiate generation of the public-private key pair; and
based on receiving the request, initiating, by the key rotation control module, generation of the public-private key pair.
14. A computing system for security key rotation in a cloud computing environment comprising:
a storage unit of the cloud computing environment to store instructions;
a control unit of the cloud computing environment, coupled to the storage unit, configured to process the stored instructions to:
initiate, at a predetermined interval, a call to a key rotation control module to determine whether to initiate generation of a public-private key pair for a client application,
determine, by the key rotation control module, whether to initiate generation of the public-private key pair for the client application based on:
querying a database to obtain a product configuration for the client application, wherein the product configuration includes a key rotation period associated with the client application indicating a frequency at which the public-private key pair for the client application is to be generated,
determining whether a difference between a last time a previous public-private key pair was generated for the client application and a current time is greater than the key rotation period,
based on determining the difference between the last time the previous public-private key pair was generated for the client application and the current time is greater than the key rotation period, initiating generation of the public-private key pair; and
a communication unit of the cloud computing environment, coupled to the control unit, configured to transmit a control signal from the key rotation control module to a key rotation module requesting generation of the public-private key pair based on the key rotation control module determining to initiate generation of the public-private key pair for the client application; and
wherein the control unit is further configured to:
process the stored instructions to generate, by the key rotation module, the public-private key pair,
update, by the key rotation module, the database with a timestamp indicating when the public-private key pair was generated for the client application, the timestamp to replace the last time the previous public-private key pair was generated for the client application; and
wherein the communication unit is further configured to:
transmit a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application; and
transmit a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.
15. The computing system of claim 14 , wherein the product configuration further includes a key validity period associated with the key rotation period, wherein the key validity period indicates a duration for which the public-private key pair is accessible by the client application and the client.
16. The computing system of claim 15 , wherein the key validity period is greater than the key rotation period.
17. The computing system of claim 14 , wherein the control unit is further configured to process instructions to generate, by the key rotation module, a notification based on generating the public-private key pair.
18. The computing system of claim 14 , wherein the public-private key pair is: Elliptic Curve (EC) keys, RSA keys, or digital signature keys.
19. The computing system of claim 14 , wherein the key rotation control module and the key rotation module are implemented as serverless functions of the cloud computing environment.
20. The computing system of claim 14 , wherein:
the communication unit is further configured to receive a request by a user to initiate generation of the public-private key pair; and
the control unit is further configured to process the stored instructions to initiate, by the key rotation control module, generation of the public-private key pair based on receiving the request.