Managing encrypted data and encryption keys

1. A method comprising:

encrypting a first portion of a drive in a computing device in a data center, using a first encryption key;

encrypting the first encryption key using a second encryption key to obtain an encrypted encryption key;

responsive to obtaining the encrypted encryption key, deleting the first encryption key;

responsive to deleting the first encryption key, storing the second encryption key in a first location within the data center;

storing the encrypted encryption key in a second location within the data center, wherein access to the second location from outside the data center is selectively prevented by an access server and wherein the second location is separate from the first location; and

providing, by a processing device, an access component located on a second portion of the drive, the access component providing access to the encrypted encryption key, wherein the second portion of the drive is unencrypted, and wherein the access component, via the access server, selectively prevents access to the encrypted encryption key from outside the data center when the drive is outside the data center and communicatively coupled to the data center; wherein the access component further provides access to the second encryption key when the second encryption key is not stored on the computing device.

2. The method of claim 1 , further comprising:

receiving a request to access the drive from a client device;

obtaining the second encryption key from the first location;

obtaining the encrypted encryption key from the second location;

decrypting the encrypted encryption key to obtain the first encryption key;

determining whether the request comprises a read request or a write request;

when the request comprises the read request:

decrypting the first portion of the drive using the first encryption key;

accessing, in the first portion of the drive, a first data requested by the client device; and

providing the first data to the client device; and

when the request comprises the write request:

encrypting a second data provided by the client device; and

writing the encrypted second data to the drive.

3. The method of claim 2 , further comprising:

requesting an access credential;

authenticating the access credential prior to obtaining the second encryption key from the first location.

4. The method of claim 1 , wherein the second location comprises one or more of:

a server within the data center; or

a removable storage device coupled to the server within the data center.

5. The method of claim 1 , wherein the first location is within the second portion of the drive.

6. The method of claim 1 , wherein the first location comprises a secure memory within the computing device.

7. The method of claim 1 , wherein the second encryption key comprises a public-private key pair.

8. The method of claim 1 , wherein the access component comprises at least one of:

a file that includes instructions for accessing the second location;

an application; or

a script.

9. An apparatus comprising:

a memory to store one or more keys;

a processing device, coupled to the memory, to:

encrypt a first portion of a drive in a computing device in a data center, using a first encryption key;

encrypt the first encryption key using a second encryption key to obtain an encrypted encryption key;

responsive to obtaining the encrypted encryption key, deleting the first encryption key;

responsive to deleting the first encryption key, store the second encryption key in a first location within the data center;

store the encrypted encryption key at a second location within the data center, wherein access to the second location from outside the data center is selectively prevented by an access server and wherein the second location is separate from the first location; and

provide, by a processing device, an access component located on a second portion of the drive, the access component providing access to the encrypted encryption key, wherein the second portion of the drive is unencrypted, and wherein the access component, via the access server, selectively prevents access to the encrypted encryption key from outside the data center when the drive is outside the data center and communicatively coupled to the data center; wherein the access component further provides access to the second encryption key when the second encryption key is not stored on the computing device.

10. The apparatus of claim 9 , wherein the processing device is further configured to:

receive a request to access the drive from a client device;

obtain the second encryption key from the first location;

obtain the encrypted encryption key from the second location;

decrypt the encrypted encryption key to obtain the first encryption key;

determine whether the request comprises a read request or a write request;

when the request comprises the read request:

decrypt the first portion of the drive using the first encryption key;

access, in the first portion of the drive, a first data requested by the client device; and

provide the first data to the client device; and

when the request comprises the write request:

encrypt a second data provided by the client device; and

write the encrypted second data to the drive.

11. The apparatus of claim 10 , wherein the processing device is further configured to:

request an access credential;

authenticate the access credential prior to obtaining the second encryption key from the first location.

12. The apparatus of claim 9 , wherein the second location comprises at least one of:

a server within the data center; or

a removable storage device coupled to the server within the data center.

13. The apparatus of claim 9 , wherein the first location is within the second portion of the drive.

14. The apparatus of claim 9 , wherein the first location comprises a secure memory within the computing device.

15. The apparatus of claim 9 , wherein the access component comprises at least one of:

a file that includes instructions for accessing the second location;

an application; or

a script.

16. A non-transitory computer readable storage medium having instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

encrypting a first portion of a drive in a computing device in a data center, using a first encryption key;

encrypting the first encryption key using a second encryption key to obtain an encrypted encryption key;

responsive to obtaining the encrypted encryption key, deleting the first encryption key;

responsive to deleting the first encryption key, storing the second encryption key in a first location within the data center;

storing the encrypted encryption key in a second location within the data center, wherein access to the second location from outside the data center is selectively prevented by an access server and wherein the second location is separate from the first location; and

providing, by a processing device, an access component located on a second portion of the drive, the access component providing access to the encrypted encryption key, wherein the second portion of the drive is unencrypted, and wherein the access component, via the access server, selectively prevents access to the encrypted encryption key from outside the data center when the drive is outside the data center and communicatively coupled to the data center; wherein the access component further provides access to the second encryption key when the second encryption key is not stored on the computing device.

17. The non-transitory computer readable storage medium of claim 16 , wherein the operations further comprise:

receiving a request to access the drive from a client device;

obtaining the encrypted encryption key from the first location;

obtaining the second encryption key from the second location;

decrypting the encrypted encryption key to obtain the first encryption key;

determining whether the request comprises a read request or a write request;

when the request comprises the read request:

decrypting the first portion of the drive using the first encryption key;

accessing, in the first portion of the drive, a first data requested by the client device; and

providing the first data to the client device; and

when the request comprises the write request:

encrypting a second data provided by the client device; and

writing the encrypted second data to the drive.