Cloud based key management

1. A method of managing cryptographic keys in a multitenant cloud based system, the method comprising:

receiving from a client a wrapping request for a wrapped data encryption key (DEK); generating a random key;

fetching additional authentication data (AAD) that corresponds to the client, the AAD comprising a first location of the client and a first tenancy of the multi-tenant cloud based system;

generating the wrapped DEK comprising the random key and the AAD encoded in the wrapped DEK, wherein the wrapped DEK comprises a header and the AAD is encoded in the header; and

returning the wrapped DEK to the client;

receiving a unwrapping request from the client to unwrap the wrapped DEK, the unwrapping request comprising a second location from which the client is making the unwrapping request and is directed to a second tenancy of the multi-tenant cloud based system;

before unwrapping the DEK, using the encoded AAD in the header to compare the first location to the second location and compare the first tenancy to the second tenancy to determine whether the client is authorized to unwrap the wrapped DEK; and

unwrapping the DEK when the first location matches the second location and the first tenancy matches the second tenancy.

2. The method of claim 1 , further comprising embedding tags in the wrapped DEK, the tags used for enforcing policy decisions in response to the unwrapping request to unwrap.

3. The method of claim 1 , wherein the wrapped DEK comprises a JavaScript Object Notation (JSON) Web Encryption (JWE) structure.

4. The method of claim 1 , further comprising:

receiving the unwrapping request to unwrap the wrapped DEK; parsing the wrapped DEK;

validating the encoded AAD;

validating a master encryption key (MEK) presence in a hardware security module (HSM); and

returning an unwrapped DEK.

5. The method of claim 1 , the generating the wrapped DEK further comprising an Initialization Vector (IV) and an authentication TAG key.

6. The method of claim 1 , wherein the unwrapping request comprises a representational state transfer (REST) application program interface (API).

7. The method of claim 2 , the tags comprising a service instance identifier.

8. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to manage cryptographic keys in a multi-tenant cloud based system, the managing comprising:

receiving from a client a wrapping request for a wrapped data encryption key (DEK);

generating a random key;

fetching additional authentication data (AAD) that corresponds to the client, the AAD comprising a first location of the client and a first tenancy of the multi-tenant cloud based system;

generating the wrapped DEK comprising the random key and the AAD encoded in the wrapped DEK, wherein the wrapped DEK comprises a header and the AAD is encoded in the header; and

returning the wrapped DEK to the client;

receiving a unwrapping request from the client to unwrap the wrapped DEK, the unwrapping request comprising a second location from which the client is making the unwrapping request and is directed to a second tenancy of the multi-tenant cloud based system;

before unwrapping the DEK, using the encoded AAD in the header to compare the first location to the second location and compare the first tenancy to the second tenancy to determine whether the client is authorized to unwrap the wrapped DEK; and

unwrapping the DEK when the first location matches the second location and the first tenancy matches the second tenancy.

9. The computer readable medium of claim 8 , further comprising embedding tags in the wrapped DEK, the tags used for enforcing policy decisions in response to the unwrapping request to unwrap.

10. The computer readable medium of claim 8 , wherein the wrapped DEK comprises a JavaScript Object Notation (JSON) Web Encryption (JWE) structure.

11. The computer readable medium of claim 8 , the managing further comprising:

receiving the unwrapping request to unwrap the wrapped DEK;

parsing the wrapped DEK; validating the encoded AAD;

validating a master encryption key (MEK) presence in a hardware security module (HSM); and returning an unwrapped DEK.

12. The computer readable medium of claim 8 , the generating the wrapped DEK further comprising an Initialization Vector (IV) and an authentication TAG key.

13. The computer readable medium of claim 8 , wherein the unwrapping request comprises a representational state transfer (REST) application program interface (API).

14. The computer readable medium of claim 9 , the tags comprising a service instance identifier.

15. A multi-tenant cloud based key management system comprising:

a mid-tier comprising one or more microservices, each of the one or more microservices comprising a hardware processor executing instructions; and

a data tier coupled to the mid-tier and comprising one or more databases and one or more hardware security modules;

the one or more microservices:

receiving from a client a wrapping request for a wrapped data encryption key (DEK);

generating a random key;

fetching additional authentication data (AAD) that corresponds to the client, the AAD comprising a first location of the client and a first tenancy of the multi-tenant cloud based system;

generating the wrapped DEK comprising the random key and the AAD encoded in the wrapped DEK, wherein the wrapped DEK comprises a header and the AAD is encoded in the header; and

returning the wrapped DEK to the client;

receiving a unwrapping request from the client to unwrap the wrapped DEK, the unwrapping request comprising a second location from which the client is making the unwrapping request and is directed to a second tenancy of the multi-tenant cloud based system;

before unwrapping the DEK, using the encoded AAD in the header to compare the first location to the second location and compare the first tenancy to the second tenancy to determine whether the client is authorized to unwrap the wrapped DEK; and

unwrapping the DEK when the first location matches the second location and the first tenancy matches the second tenancy.

16. The multi-tenant cloud based key management system of claim 15 , wherein the wrapped DEK comprises a JavaScript Object Notation (JSON) Web Encryption (JWE) structure.

17. The multi-tenant cloud based key management system of claim 15 , the one or more microservices further:

receiving the unwrapping request to unwrap the wrapped DEK;

parsing the wrapped DEK;

validating the encoded AAD;

validating a master encryption key (MEK) presence in a hardware security module (HSM); and

returning an unwrapped DEK.

18. The multi-tenant cloud based key management system of claim 5 , the generating the wrapped DEK further comprising an Initialization Vector (IV) and an authentication TAG key.

19. The multi-tenant cloud based key management system of claim 15 , wherein the unwrapping request comprises a representational state transfer (REST) application program interface (API).

20. The multi-tenant cloud based key management system of claim 15 , the one or more microservices further comprising embedding tags in the wrapped DEK, the tags used for enforcing policy decisions in response to the unwrapping request to unwrap.