Encryption key management for international data residency
Media, method, and system for providing encryption key management for international data residency. Organizations using a group-based communication system can designate a particular geopolitical area where that organization's data can be stored and another geopolitical area (which may be the same or different) where encryption keys used to encrypt and decrypt that data should be stored. Users of that organization can post message or access messages previously posted on the group-based communication system from any geopolitical area, causing the system to automatically store and retrieve messages and encryption keys from the appropriate regions to allow the users to transparently access the group-based communication system while maintaining security and data residency requirements.
1. A system for providing encryption key management for international data residency, the system comprising:
a first data store, located in a first geopolitical area;
a second data store, located in a second geopolitical area distinct from the first geopolitical area;
a group-based communication system server, located in the first geopolitical area and programmed to:
receive, from a first client device of a first user associated with an organization, a message to be posted to a group of a group-based communication system;
determine, based on the organization, that data associated with the organization should be stored in the second geopolitical area;
encrypt, as an encrypted message, the message using an organization-specific encryption key;
store information indicative of a storage location for the encrypted message in the first data store;
store the encrypted message in the second data store;
receive, from a second client device of a second user associated with the organization, an indication of an attempt to access the message;
retrieve, from the first data store, the information indicative of the storage location for the encrypted message;
retrieve the encrypted message from the second data store using the information indicative of the storage location for the encrypted message;
decrypt, as a decrypted message, the message using an organization-specific decryption key; and
transmit, to the second client device of the second user, the decrypted message.
2. The system of claim 1 , wherein the organization-specific encryption key is the same as the organization-specific decryption key.
3. The system of claim 1 , wherein the organization-specific encryption key and the organization-specific decryption key form an asymmetric key pair.
4. The system of claim 1 , further comprising a key server located in the second geopolitical area storing the organization-specific encryption key and the organization-specific decryption key, and wherein the group-based communication system server is further programmed to:
retrieve, from the key server, the organization-specific encryption key responsive to receiving, from the first client device of the first user, the message to be posted to the group; and
retrieve, from the key server, the organization-specific decryption key responsive to receiving, from the second data store, the encrypted message.
5. The system of claim 4 , further comprising a key cache in the first geopolitical area programmed to cache keys received from the key server.
6. The system of claim 1 , wherein the second data store stores logging data for the organization.
7. The system of claim 1 , wherein the indication of the attempt to access the message comprises a selection by the second user of the group to view in the group-based communication system.
8. A method for providing encryption key management for international data residency, the method comprising:
receiving, by a group-based communication system server and from a first client device of a first user associated with an organization, a message to be posted to a group of a group-based communication system,
wherein the group-based communication system server is located in a first geopolitical area;
encrypting, as an encrypted message, the message using an organization-specific encryption key;
determining, by the group-based communication system server and based on the organization, that data associated with the organization should be stored in a second geopolitical area that is distinct from the first geopolitical area,
responsive to determining that the data should be stored in the second geopolitical area, storing the encrypted message in a second data store located in the second geopolitical area;
storing information indicative of a storage location for the encrypted message in a first data store located in the first geopolitical area;
receiving, by the group-based communication system server and from a second client device of a second user associated with the organization, an indication of an attempt to access the message;
retrieving, by the group-based communication system server and from the first data store, the information indicative of the storage location for the encrypted message;
retrieving, by the group-based communication system server, the encrypted message from the second data store using the information indicative of the storage location for the encrypted message;
decrypting, by the group-based communication system server and as a decrypted message, the message using an organization-specific decryption key; and
transmitting, by the group-based communication system server and to the second client device of the second user, the decrypted message.
9. The method of claim 8 , further comprising:
receiving, from the first client device of the first user, the message to be posted to the group;
responsive to receiving the message to be posted to the group, retrieving, by the group-based communication system server and from a key server located in a third geopolitical area, the organization-specific encryption key;
receiving, from the second data store, the encrypted message; and
responsive to receiving the encrypted message from the second data store, retrieving, from the key server, the organization-specific decryption key.
10. The method of claim 9 , wherein the third geopolitical area is distinct from the first geopolitical area and the second geopolitical area.
11. The method of claim 9 , further comprising:
storing, by the group-based communication system server, the organization-specific encryption key in a key cache located in the first geopolitical area.
12. The method of claim 9 , wherein retrieving, from the key server, the organization-specific decryption key includes a substep of sending a request for the organization-specific decryption key to a look-through key cache in the first geopolitical area.
13. The method of claim 8 , wherein the organization-specific encryption key is the same as the organization-specific decryption key.
14. The method of claim 8 , further comprising logging the storing of the message to the second data store.
15. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations for providing encryption key management for international data residency, the operations comprising:
receiving, by a group-based communication system server and from a first client device of a first user associated with an organization, a message to be posted to a group of a group-based communication system,
wherein the group-based communication system server is located in a first geopolitical area;
encrypting, as an encrypted message, the message using an organization-specific encryption key;
responsive to determining, by the group-based communication system server and based on the organization, that data associated with the organization should be stored in a second geopolitical area distinct from the first geopolitical area, storing the encrypted message in a second data store located in the second geopolitical area;
storing information indicative of a storage location for the encrypted message in a first data store located in the first geopolitical area;
receiving, by the group-based communication system server and from a second client device of a second user associated with the organization, an indication of an attempt to access the message;
retrieving, by the group-based communication system server and from the first data store, the information indicative of the storage location for the encrypted message;
retrieving, by the group-based communication system server, the encrypted message from the second data store using the information indicative of the storage location for the encrypted message;
decrypting, as a decrypted message and by the group-based communication system server, the message using an organization-specific decryption key; and
transmitting, by the group-based communication system server and to the second client device of the second user, the decrypted message.
16. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:
receiving, from the first client device of the first user, the message to be posted to the group;
responsive to receiving the message to be posted to the group, retrieving, by the group-based communication system server and from a key server located in a third geopolitical area, the organization-specific encryption key;
receiving, from the second data store, the encrypted message;
responsive to receiving the encrypted message from the second data store, retrieving, from the key server, the organization-specific decryption key.
17. The one or more non-transitory computer-readable media of claim 16 , wherein the third geopolitical area is the same as the second geopolitical area.
18. The one or more non-transitory computer-readable media of claim 16 , the operations further comprising:
storing, by the group-based communication system server, the organization-specific encryption key in a key cache located in the first geopolitical area.
19. The one or more non-transitory computer-readable media of claim 16 , wherein the indication of the attempt to access the message comprises scrolling, by the second user, to view a conversation history of the group.
20. The one or more non-transitory computer-readable media of claim 16 , where transmitting, to the second client device of the second user, the decrypted message comprises transmitting, to the second client device of the second user, the decrypted message using transport-layer encryption.