Self-service device encryption key access
Disclosed are various embodiments for providing access to a recovery key of a managed device and rotating the recovery key after it has been accessed. In one example, among others, a system includes a computing device and program instructions. The program instructions can cause the computing device to store a first recovery key for a first managed computing device. The first recovery key is configured to access an encrypted data store of the first managed computing device. A request is received for the first recovery key from a second managed computing device. The first recovery key is transmitted for display on the second managed computing device. A key rotation command is generated for a command queue of the first managed computing device to rotate the first recovery key after transmitting the first recovery key. The second recovery key is received from the second computing device.
1. A system, comprising:
a computing device; and
program instructions executable in the computing device that, when executed by the computing device, cause the computing device to:
generate a first recovery key from an encryption of a data store associated with the computing device;
transmit to a management service the first recovery key in an instance in which the data store has been encrypted;
decrypt the encrypted data store based on an input of the first recovery key to the computing device;
retrieve a first key rotation command from a command queue of the management service, the first key rotation command including an instruction to rotate the first recovery key;
generate a second recovery key based on rotating the first recovery key according to the instruction to rotate the first recovery key; and
transmit the second recovery key to the management service.
2. The system of claim 1 , wherein the instruction to rotate the first recovery key comprises executing an application programming interface command of an operating system for generating the second recovery key.
3. The system of claim 1 , wherein the encryption of the data store is performed in an instance in which a device policy has been received from the management service, wherein the device policy comprises an encryption instruction to encrypt the data store associated with the computing device.
4. The system of claim 1 , wherein retrieving the first key rotation command from the command queue of the management service further comprising checking the command queue on a periodic interval.
5. The system of claim 1 , wherein the computing device comprises a first computing device, and further comprises program instructions executable in the computing device that, when executed by the computing device, cause the first computing device to:
display a user interface for requesting a third recovery key associated with a second computing device to the management service, wherein the user interface comprises a user interface component for selecting a device identifier for the second computing device; and
receive the third recovery key associated with the second computing device from the management service in an instance in which the selection of the device identifier for the second computing device has been made.
6. The system of claim 5 , further comprising program instructions executable in the computing device that, when executed, further cause the first computing device to:
display, for the first computing device, the third recovery key for a predetermined period of time; and
remove the third recovery key from the display in an instance in which the predetermined period of time has expired.
7. The system of claim 5 , wherein the management service has a management data store, and the management data store comprises a managed user profile associated with the first computing device and the second computing device.
8. A non-transitory computer-readable medium embodying program instructions executable in a computing device that, when executed by the computing device, cause the computing device to at least:
generate a first recovery key from an encryption of a data store associated with the computing device;
transmit to a management service the first recovery key in an instance in which the data store has been encrypted;
decrypt the encrypted data store based on an input of the first recovery key to the computing device;
retrieve a first key rotation command from a command queue of the management service, the first key rotation command including an instruction to rotate the first recovery key;
generate a second recovery key based on rotating the first recovery key according to the instruction to rotate the first recovery key; and
transmit the second recovery key to the management service.
9. The non-transitory computer-readable medium of claim 8 , wherein the instruction to rotate the first recovery key comprises executing an application programming interface command of an operating system for generating the second recovery key.
10. The non-transitory computer-readable medium of claim 8 , wherein the encryption of the data store is performed in an instance in which a device policy has been received from the management service, wherein the device policy comprises an encryption instruction to encrypt the data store associated with the computing device.
11. The non-transitory computer-readable medium of claim 8 , wherein the program instructions, when executed, further cause the computing device to at least:
retrieve the first key rotation command from the command queue of the management service further comprising checking the command queue on a periodic interval.
12. The non-transitory computer-readable medium of claim 8 , wherein the computing device comprises a first computing device, and the program instructions executable in the computing device that, when executed by the computing device, cause the first computing device to at least:
display a user interface for requesting a third recovery key associated with a second computing device to the management service, wherein the user interface comprises a user interface component for selecting a device identifier for the second computing device; and
receive the third recovery key associated with the second computing device from the management service in an instance in which the selection of the device identifier for the second computing device has been made.
13. The non-transitory computer-readable medium of claim 12 , wherein the program instructions, when executed, further cause the computing device to:
display, for the first computing device, the third recovery key for a predetermined period of time; and
remove the third recovery key from the display in an instance in which the predetermined period of time has expired.
14. The non-transitory computer-readable medium of claim 12 , wherein the management service has a management data store, and the management data store comprises a managed user profile associated with the first computing device and the second computing device.
15. A computer-implemented method, comprising:
generating a first recovery key from an encryption of a data store associated with a computing device;
transmitting to a management service the first recovery key in an instance in which the data store has been encrypted;
decrypting the encrypted data store based on an input of the first recovery key to the computing device;
retrieving a first key rotation command from a command queue of the management service, the first key rotation command including an instruction to rotate the first recovery key;
generating a second recovery key based on rotating the first recovery key according to the instruction to rotate the first recovery key; and
transmitting the second recovery key to the management service.
16. The computer-implemented method of claim 15 , wherein the instruction to rotate the first recovery key comprises executing an application programming interface command of an operating system for generating the second recovery key.
17. The computer-implemented method of claim 15 , wherein the encryption of the data store is performed in an instance in which a device policy has been received from the management service, wherein the device policy comprises an encryption instruction to encrypt the data store associated with the computing device.
18. The computer-implemented method of claim 15 , wherein retrieving the first key rotation command from the command queue of the management service further comprising checking the command queue on a periodic interval.
19. The computer-implemented method of claim 15 , wherein the computing device comprises a first computing device, and further comprising:
displaying a user interface for requesting a third recovery key associated with a second computing device to the management service, wherein the user interface comprises a user interface component for selecting a device identifier for the second computing device; and
receiving the third recovery key associated with the second computing device from the management service in an instance in which the selection of the device identifier for the second computing device has been made.
20. The computer-implemented method of claim 19 , further comprising:
displaying, for the first computing device, the third recovery key for a predetermined period of time; and
removing the third recovery key from the display in an instance in which the predetermined period of time has expired.