Dynamic crypto key management for mobility in a cloud environment
Aspects of the disclosure relate to dynamic crypto key management for mobility in a cloud environment. A computing platform may receive a request to generate a new tenant master key and a new server recovery key. Subsequently, the computing platform may send to a cloud-based key vault server, the new tenant master key and the new server recovery key. The computing platform may send to a tenant database, the encrypted server recovery key. As a result, the computing platform may provision the enrollment servers with the encrypted server recovery key. In some embodiments, the enrollment servers are configured to manage enrollment of policy-managed devices in a policy enforcement scheme and to authenticate with the key update service based on the encrypted server recovery key.
1. A method comprising:
at a computing platform comprising at least one processor, memory, and a communication interface:
generating, by the at least one processor, a tenant master key and a server recovery key;
sending, by the at least one processor, via the communication interface, and to a cloud-based key vault server, the tenant master key and the server recovery key, wherein the cloud-based key vault server is configured to store the tenant master key and is further configured to encrypt the server recovery key with the tenant master key to produce an encrypted server recovery key;
storing the encrypted server recovery key in a tenant database server associated with one or more enrollment servers;
provisioning the one or more enrollment servers with the encrypted server recovery key; and
sending, by the at least one processor and via the communication interface, commands directing a device management server to send new variables to a plurality of policy-managed devices, wherein sending the commands causes the plurality of policy-managed devices to:
read offline variables from local storage of a policy-managed device of the plurality of policy-managed devices;
generate an offline device key based on the offline variables from the local storage;
read offline encrypted file keys from the local storage, wherein the offline encrypted file keys correspond to files residing on the policy-managed device;
decrypt the offline encrypted file keys with the offline device key to generate decrypted file keys; and
encrypt the decrypted file keys with the device key generated based on the new variables to generate encrypted file keys.
2. The method of claim 1 , wherein the one or more enrollment servers are configured to manage enrollment of the plurality of policy-managed devices in a policy enforcement scheme and to authenticate with a key update service based on the encrypted server recovery key.
3. The method of claim 1 , wherein provisioning the one or more enrollment servers comprises:
sending the encrypted server recovery key to the one or more enrollment servers via the communication interface.
4. The method of claim 1 , wherein the encrypted server recovery key enables the plurality of policy-managed devices associated with a tenant to authenticate with a key update service.
5. The method of claim 1 , further comprising:
prior to generating the master tenant key, receiving, by the at least one processor and via a key upgrade service provided by the computing platform, a request to generate one or more new keys.
6. The method of claim 1 , further comprising:
detecting, by the at least one processor, that a new enrollment server is online; and
sending, by the at least one processor and via the communication interface, the encrypted server recovery key to the new enrollment server.
7. The method of claim 1 ,
wherein the plurality of policy-managed devices are configured to generate a device key for each of the plurality of policy-managed devices based on the new variables.
8. The method of claim 1 , wherein sending the commands further causes the plurality of policy-managed devices to:
receive a passphrase from user associated with a policy-managed device of the plurality of policy-managed devices;
generate an encrypted device key based on the passphrase; and
store the encrypted device key in local storage of the corresponding policy-managed device.
9. The method of claim 1 , wherein sending the commands further causes the plurality of policy-managed devices to:
generate file keys for one or more files residing on the plurality of policy-managed devices.
10. The method of claim 1 , wherein the tenant database server is separate from the cloud-based key vault server.
11. The method of claim 1 , wherein the commands further cause the plurality of policy-managed devices to:
store the encrypted file keys in the local storage of the plurality of policy-managed devices; and
store the new variables in the local storage.
12. A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
generate, by the at least one processor, a tenant master key and a server recovery key;
send, by the at least one processor, via the communication interface, to a cloud-based key vault server, the tenant master key and the server recovery key, wherein the cloud-based key vault server is configured to store the tenant master key and is further configured to encrypt the server recovery key with the tenant master key to produce an encrypted server recovery key;
store the encrypted server recovery key in a tenant database server associated with one or more enrollment servers;
provision the one or more enrollment servers with the encrypted server recovery key;
send, via the communication interface, commands directing a device management server to send new variables to a plurality of policy-managed devices, wherein sending the commands causes the plurality of policy-managed devices to:
read offline variables from local storage of a policy-managed device of the plurality of policy-managed devices;
generate an offline device key based on the offline variables from the local storage;
read offline encrypted file keys from the local storage, wherein the offline encrypted file keys correspond to files residing on the policy-managed device;
decrypt the offline encrypted file keys with the offline device key to generate decrypted file keys; and
encrypt the decrypted file keys with the device key generated based on the new variables to generate encrypted file keys.
13. The computing platform of claim 12 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
detect that a new enrollment server is online; and
send, via the communication interface, the encrypted server recovery key to the new enrollment server.
14. The computing platform of claim 13 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
provision the new enrollment server enabling the plurality of policy-managed devices to enroll with the new enrollment server.
15. The computing platform of claim 12 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
cause the plurality of policy-managed devices to generate a device key for each of the plurality of policy-managed devices.
16. The computing platform of claim 12 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
cause the plurality of policy-managed devices to generate file keys for one or more files residing on the plurality of policy-managed devices.
17. The computing platform of claim 12 , wherein sending the commands directing the device management server to send the new variables to the plurality of policy-managed devices further causes the plurality of policy-managed devices to:
generate a device key based on the new variables from the device management server.
18. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:
generate, by the at least one processor, a tenant master key and a server recovery key;
send, by the at least one processor, via the communication interface, and to a cloud-based key vault server, the tenant master key and the server recovery key, wherein the cloud-based key vault server is configured to store the tenant master key and is further configured to encrypt the server recovery key with the tenant master key to produce an encrypted server recovery key;
store the encrypted server recovery key in a tenant database server associated with one or more enrollment servers;
provision the one or more enrollment servers with the encrypted server recovery key; and
send, via the communication interface, commands directing a device management server to send new variables to a plurality of policy-managed devices, wherein sending the commands causes the plurality of policy-managed devices to:
read offline variables from local storage of a policy-managed device of the plurality of policy-managed devices;
generate an offline device key based on the offline variables from the local storage;
read offline encrypted file keys from the local storage, wherein the offline encrypted file keys correspond to files residing on the policy-managed device;
decrypt the offline encrypted file keys with the offline device key to generate decrypted file keys; and
encrypt the decrypted file keys with the device key generated based on the new variables to generate encrypted file keys.