Self-service device encryption key access
Disclosed are various embodiments for providing access to a recovery key of a managed device and rotating the recovery key after it has been accessed. In one example, among others, a system includes a computing device and program instructions. The program instructions can cause the computing device to authenticate a user on the computing device in order to unlock an operating system based on a first recovery key. A key rotation command can be received from the management service. The key rotation command can include an instruction to rotate the first recovery key. The computing device can generate a second recovery key and transmit the second recovery key to the management service.
1. A system, comprising:
a computing device; and
program instructions executable in the computing device that, when executed by the computing device, cause the computing device to at least:
authenticate a user on the computing device for unlocking an operating system based on an input of a first recovery key to the computing device;
receive a key rotation command from a management service, the key rotation command including an instruction to rotate the first recovery key;
generate a second recovery key for an encrypted data store using the operating system based on the key rotation command; and
transmit the second recovery key to the management service.
2. The system of claim 1 , wherein the user is authenticated during a power-on instance for the computing device.
3. The system of claim 1 , wherein the key rotation command is received from a command queue managed by the management service, the command queue being assigned to the computing device.
4. The system of claim 1 , wherein the program instructions, when executed by the computing device, cause the computing device to at least:
transmit a check-in notification to the management service based on the authentication of the user on the computing device.
5. The system of claim 4 , wherein the check-in notification indicates to the management service that the computing device is ready to receive a command from a command queue associated with the management service.
6. The system of claim 1 , wherein the instruction to rotate the first recovery key comprises executing an application programming interface command of the operating system for generating the second recovery key.
7. The system of claim 1 , wherein the program instructions, when executed by the computing device, cause the computing device to at least:
receive a device policy from the management service during an enrollment of the computing device with the management service; and
generate the encrypted data store based on the device policy, wherein the first recovery key is generated based on the generation of the encrypted data store.
8. A non-transitory computer-readable medium embodying program instructions executable in a computing device that, when executed by the computing device, cause the computing device to at least:
authenticate a user on the computing device for unlocking an operating system based on an input of a first recovery key to the computing device;
receive a key rotation command from a management service, the key rotation command including an instruction to rotate the first recovery key;
generate a second recovery key for an encrypted data store using the operating system based on the key rotation command; and
transmit the second recovery key to the management service.
9. The non-transitory computer-readable medium of claim 8 , wherein the user is authenticated during a power-on instance for the computing device.
10. The non-transitory computer-readable medium of claim 8 , wherein the key rotation command is received from a command queue managed by the management service, the command queue being assigned to the computing device.
11. The non-transitory computer-readable medium of claim 8 , wherein the program instructions, when executed by the computing device, cause the computing device to at least:
transmit a check-in notification to the management service based on the authentication of the user on the computing device.
12. The non-transitory computer-readable medium of claim 11 , wherein the check-in notification indicates to the management service that the computing device is ready to receive a command from a command queue associated with the management service.
13. The non-transitory computer-readable medium of claim 8 , wherein the instruction to rotate the first recovery key comprises executing an application programming interface command of the operating system for generating the second recovery key.
14. The non-transitory computer-readable medium of claim 8 , wherein the program instructions, when executed by the computing device, cause the computing device to at least:
receive a device policy from the management service during an enrollment; and
generate the encrypted data store based on the device policy, wherein the first recovery key is generated based on the generation of the encrypted data store.
15. A computer-implemented method, comprising:
authenticating a user on a computing device for unlocking an operating system based on an input of a first recovery key to the computing device;
receiving a key rotation command from a management service, the key rotation command including an instruction to rotate the first recovery key;
generating a second recovery key for an encrypted data store using the operating system based on the key rotation command; and
transmitting the second recovery key to the management service.
16. The computer-implemented method of claim 15 , wherein the user is authenticated during a power-on instance for the computing device.
17. The computer-implemented method of claim 15 , wherein the key rotation command is received from a command queue managed by the management service, the command queue being assigned to the computing device.
18. The computer-implemented method of claim 17 , further comprising:
transmitting a check-in notification to the management service based on the authentication of the user on the computing device.
19. The computer-implemented method of claim 18 , wherein the check-in notification indicates to the management service that the computing device is ready to receive a command from a command queue associated with the management service.
20. The computer-implemented method of claim 15 , wherein the instruction to rotate the first recovery key comprises executing an application programming interface command of the operating system for generating the second recovery key.