Protection for restricted actions on critical resources
Methods, systems, and computer programs are presented for protecting restricted actions on encryption keys that control the management of data stored by a service provider. In some implementations, a system of the service provider receives a request to generate a data encryption policy (DEP) for data stored by the system of the service provider for a customer, the request including a reference to a customer key and an availability key. The customer key and the availability key are root keys for encrypting a data encryption key. The data encryption key is used to encrypt the data stored by the service provider for the customer. Further, destructive changes to the availability key require receiving an approval from an account of the service provider. The system of the service provider validates the DEP. The system of the service provider stores the DEP based on the validation.
1. A computer-implemented method comprising:
receiving, by a server of a service provider and from a customer administrator, a request to revoke use of an availability key of a customer for accessing data stored by the server, the availability key being a root key for encrypting a data encryption key;
sending, by the server of the service provider, a notification to at least one approver of the customer requesting approval for the request to revoke the use of the availability key;
upon receiving approval from the at least one approver, sending a request to a system approver of the service provider requesting approval for the request to revoke the use of the availability key;
upon receiving approval from the system approver, providing access to the customer administrator to a key vault to perform a destructive operation to a customer key, the customer key being another root key for encrypting the data encryption key; and
upon detecting completion of the destructive operation by the customer administrator, purging a customer policy for accessing the data stored by the server.
2. The method as recited in claim 1 , wherein purging the customer policy further comprises:
performing a data purge of the data stored by the server for the customer.
3. The method as recited in claim 1 , wherein the availability key is inaccessible until the approval from the at least one approver and the approval from the system approver.
4. The method as recited in claim 1 , wherein the at least one approver of the customer comprises a plurality of approvers, wherein the approval from the at least one approver requires approval from the plurality of approvers.
5. The method as recited in claim 1 , wherein providing access to the customer administrator to a key vault further comprises:
providing time-bound access to the key vault.
6. The method as recited in claim 1 , wherein the service provider has to approve changes to the availability key even if the customer owns the availability key.
7. The method as recited in claim 1 , wherein having the service provider validate an intent of the destructive operations provides extra protection to the customer against error.
8. The method as recited in claim 1 , wherein the customer is able to have control of the data while the service provider does not have access to the availability key, and the customer benefits from the approval from the system approver.
9. The method as recited in claim 1 , further comprising:
encrypting the encryption key with the customer key to obtain a first encrypted encryption key;
encrypting the encryption key with the availability key to obtain a second encrypted encryption key; and
storing the first encrypted encryption key and the second encrypted encryption key, wherein the system provides control of the customer key to the customer and provides control of the availability key to the service provider.
10. The method as recited in claim 1 , further comprising:
providing, by the system, a user interface for entering approvals.
11. A system comprising:
a memory comprising instructions; and
one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
receiving, by a server of a service provider and from a customer administrator, a request to revoke use of an availability key of a customer for accessing data stored by the server, the availability key being a root key for encrypting a data encryption key;
sending, by the server of the service provider, a notification to at least one approver of the customer requesting approval for the request to revoke the use of the availability key;
upon receiving approval from the at least one approver, sending a request to a system approver of the service provider requesting approval for the request to revoke the use of the availability key;
upon receiving approval from the system approver, providing access to the customer administrator to a key vault to perform a destructive operation to a customer key, the customer key being another root key for encrypting the data encryption key; and
upon detecting completion of the destructive operation by the customer administrator, purging a customer policy for accessing the data stored by the server.
12. The system as recited in claim 11 , wherein purging the customer policy further comprises:
performing a data purge of the data stored by the server for the customer.
13. The system as recited in claim 11 , wherein the availability key is inaccessible until the approval from the at least one approver and the approval from the system approver.
14. The system as recited in claim 11 , wherein the at least one approver of the customer comprises a plurality of approvers, wherein the approval from the at least one approver requires approval from the plurality of approvers.
15. The system as recited in claim 11 , wherein providing access to the customer administrator to a key vault further comprises:
providing time-bound access to the key vault.
16. A tangible machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:
receiving, by a server of a service provider and from a customer administrator, a request to revoke use of an availability key of a customer for accessing data stored by the server, the availability key being a root key for encrypting a data encryption key;
sending, by the server of the service provider, a notification to at least one approver of the customer requesting approval for the request to revoke the use of the availability key;
upon receiving approval from the at least one approver, sending a request to a system approver of the service provider requesting approval for the request to revoke the use of the availability key;
upon receiving approval from the system approver, providing access to the customer administrator to a key vault to perform a destructive operation to a customer key, the customer key being another root key for encrypting the data encryption key; and
upon detecting completion of the destructive operation by the customer administrator, purging a customer policy for accessing the data stored by the server.
17. The tangible machine-readable storage medium as recited in claim 16 , wherein purging the customer policy further comprises:
performing a data purge of the data stored by the server for the customer.
18. The tangible machine-readable storage medium as recited in claim 16 , wherein the availability key is inaccessible until the approval from the at least one approver and the approval from the system approver.
19. The tangible machine-readable storage medium as recited in claim 16 , wherein the at least one approver of the customer comprises a plurality of approvers, wherein the approval from the at least one approver requires approval from the plurality of approvers.
20. The tangible machine-readable storage medium as recited in claim 16 , wherein providing access to the customer administrator to a key vault further comprises:
providing time-bound access to the key vault.