Secure recovery key management for removable drive encryption enforcement

1 . A method, comprising:

transmitting, by a management service, a removable drive encryption policy to a client device, wherein the removable drive encryption policy causes a management service agent running on the client device to:

intercept launch of a first encryption user interface by an operating system of the client device;

generate a second encryption user interface that obscures removable drive recovery keys for removable drives accessed using the client device from view; and

enforce the operating system of the client device to perform volume encryption for the removable drives accessed using the client device;

receiving, by the management service, removable drive encryption data for a removable drive connected to the client device, the removable drive encryption data comprising: a removable drive recovery key, a recovery key identifier, and a removable drive identifier;

storing, by the management service, the removable drive encryption data within a removable drive recovery key escrow of the management service;

transmitting, by the management service, a recovery key verification message to the client device to which the removable drive is connected, the recovery key verification message comprising the removable drive recovery key stored in the removable drive recovery key escrow, wherein the recovery key verification message causes the management service agent running on the client device to:

determine whether the removable drive recovery key included in the recovery key verification message matches a removable drive recovery key stored on the client device, to verify that the removable drive recovery key in the removable drive encryption data has been successfully stored by the removable drive recovery key escrow; and

upon determining that the removable drive recovery key included in the recovery key verification message matches the removable drive recovery key stored on the client device, delete the removable drive recovery key stored on the client device from the client device; and

receiving, in response to the recovery key verification message and from the management service agent running on the client device, an indication that the removable drive recovery key included in the recovery key verification message matches the removable drive recovery key stored on the client device and an indication that the removable drive recovery key stored on the client device has been deleted from the client device.

2 . The method according to claim 1 , wherein the removable drive recovery key escrow comprises recovery keys that are exclusively removable drive recovery keys for removable drives managed by the management service.

3 . The method according to claim 1 , further comprising:

generating, by the management service, a third user interface that shows at least a subset of the removable drive encryption data, wherein the user interface obscures the removable drive recovery key from view.

4 . The method according to claim 3 , wherein the third user interface further comprises a user interface element that reveals the removable drive recovery key based on a user selection of the user interface element, and wherein the management service logs a recovery key access event along with a user identifier of a user that performs the user selection.

5 . The method according to claim 3 , wherein the third user interface further comprises a user interface element that causes the management service to transmit the removable drive recovery key to a client device identified based on a user account associated with the removable drive.

6 . The method according to claim 5 , wherein the management service transmits the removable drive recovery key to the client device using at least one of: an email message, a messaging service message, a short message service message, and a communication with a management agent executed on the client device.

7 . The method according to claim 1 , wherein

the removable drive encryption policy also causes the management service agent running on the client device to:

prevent printing and displaying of the removable drive recovery keys for removable drives, and prevent saving of the removable drive recovery keys for removable drives to an operation-system-affiliated account; and

enforce a removable drive to be used in read-only mode upon the volume encryption is cancelled or declined with respect to the removable drive.

8 . A non-transitory computer-readable medium embodying instructions executable by at least one computing device, the instructions, when executed, causing the at least one computing device to at least:

transmit, by a management service, a removable drive encryption policy to a client device, wherein the removable drive encryption policy causes a management service agent running on the client device to:

intercept launch of a first encryption user interface by an operating system of the client device;

generate a second encryption user interface that obscures removable drive recovery keys for removable drives accessed using the client device from view; and

enforce the operating system of the client device to perform volume encryption for the removable drives accessed using the client device;

receive, by the management service, removable drive encryption data for a removable drive connected to the client device, the removable drive encryption data comprising: a removable drive recovery key, a recovery key identifier, and a removable drive identifier;

store, by the management service, the removable drive encryption data within a removable drive recovery key escrow of the management service;

transmit, by the management service, a recovery key verification message to the client device to which the removable drive is connected, the recovery key verification message comprising the removable drive recovery key stored in the removable drive recovery key wherein the recovery key verification message causes the client device to:

determine whether the removable drive recovery key included in the recovery key verification message matches a removable drive recovery key stored on the client device, to verify that the removable drive recovery key in the removable drive encryption data has been successfully stored by the removable drive recovery key escrow; and

upon determining that the removable drive recovery key included in the recovery key verification message matches the removable drive recovery key stored on the client device, delete the removable drive recovery key stored on the client device from the client device; and

receive, in response to the recovery key verification message and from the management service agent running on the client device, an indication that the removable drive recovery key included in the recovery key verification message matches the removable drive recovery key stored on the client device and an indication that the removable drive recovery key stored on the client device has been deleted from the client device.

9 . The non-transitory computer-readable medium according to claim 8 , wherein the removable drive recovery key escrow comprises recovery keys that are exclusively removable drive recovery keys for removable drives managed by the management service.

10 . The non-transitory computer-readable medium according to claim 8 , wherein the instructions further cause the at least one computing device to at least:

generate, by the management service, a third user interface that shows at least a subset of the removable drive encryption data, wherein the user interface obscures the removable drive recovery key from view.

11 . The non-transitory computer-readable medium according to claim 10 , wherein the third user interface further comprises a user interface element that reveals the removable drive recovery key based on a user selection of the user interface element, and wherein the management service logs a recovery key access event along with a user identifier of a user that performs the user selection.

12 . The non-transitory computer-readable medium according to claim 10 , wherein the third user interface further comprises a user interface element that causes the management service to transmit the removable drive recovery key to a client device identified based on a user account associated with the removable drive.

13 . The non-transitory computer-readable medium according to claim 12 , wherein the management service transmits the removable drive recovery key to the client device using at least one of: an email message, a messaging service message, a short message service message, and a communication with a management agent executed on the client device.

14 . The non-transitory computer-readable medium according to claim 8 , wherein the removable drive encryption policy also causes the management service agent running on the client device to:

prevent printing and displaying of the removable drive recovery keys for removable drives, and prevent saving of the removable drive recovery keys for removable drives to an operation-system-affiliated account; and

enforce a removable drive to be used in read-only mode upon the volume encryption is cancelled or declined with respect to the removable drive.

15 . A system, comprising:

at least one computing device; and

instructions accessible by the at least one computing device, wherein the instructions, when executed, cause the at least one computing device to at least:

transmit, by a management service, a removable drive encryption policy to a client device, wherein the removable drive encryption policy causes a management service agent running on the client device to:

intercept launch of a first encryption user interface by an operating system of the client device;

generate a second encryption user interface that obscures removable drive recovery keys for removable drives accessed using the client device from view; and

enforce the operating system of the client device to perform volume encryption for the removable drives accessed using the at least one client device;

receive, by the management service, removable drive encryption data for a removable drive connected to a client device, the removable drive encryption data comprising: a removable drive recovery key, a recovery key identifier, and a removable drive identifier;

store, by the management service, the removable drive encryption data within a removable drive recovery key escrow of the management service;

transmit, by the management service, a recovery key verification message to the client device to which the removable drive is connected, the recovery key verification message comprising the removable drive recovery key stored in the removable drive recovery key escrow, wherein the recovery key verification message causes the client device to:

determine whether the removable drive recovery key included in the recovery key verification message matches a removable drive recovery key stored on the client device, to verify that the removable drive recovery key in the removable drive encryption data has been successfully stored by the removable drive recovery key escrow, and

upon determining that the removable drive recovery key included in the recovery key verification message matches the removable drive recovery key stored on the client device, delete the removable drive recovery key stored on the client device from the client device; and

receive, in response to the recovery key verification message and from the management service agent running on the client device, an indication that the removable drive recovery key included in the recovery key verification message matches the removable drive recovery key stored on the client device and an indication that the removable drive recovery key stored on the client device has been deleted from the client device.

16 . The system according to claim 15 , wherein the removable drive recovery key escrow comprises recovery keys that are exclusively removable drive recovery keys for removable drives managed by the management service.

17 . The system according to claim 15 , wherein the instructions further cause the at least one computing device to at least:

generate, by the management service, a third user interface that shows at least a subset of the removable drive encryption data, wherein the user interface obscures the removable drive recovery key from view.

18 . The system according to claim 17 , wherein the third user interface further comprises a user interface element that reveals the removable drive recovery key based on a user selection of the user interface element, and wherein the management service logs a recovery key access event along with a user identifier of a user that performs the user selection.

19 . The system according to claim 17 , wherein the third user interface further comprises a user interface element that causes the management service to transmit the removable drive recovery key to a client device identified based on a user account associated with the removable drive.

20 . The system according to claim 15 , wherein the removable drive encryption policy also causes the management service agent running on the client device to:

prevent printing and displaying of the removable drive recovery keys for removable drives, and prevent saving of the removable drive recovery keys for removable drives to an operation-system-affiliated account; and

enforce a removable drive to be used in read-only mode upon the volume encryption is cancelled or declined with respect to the removable drive.