Key management system for disk encryption
A key management system for providing encryption of a disk in a client device is provided. The system comprises a trusted platform module (TPM) having a first fragment of a key, a remote storage having a second fragment of the key, and a processing unit to partially boot instructions relating to booting of the client device, send a request for validation to the TPM, receive the first fragment of the key from the TPM on successful validation, request for the second fragment of the key with credentials to access the remote storage. The credentials and a network of the request are verified, the second fragment of the key is transmitted on successful validation. The first fragment and the second fragment of the key are combined to generate an encryption key for booting the client device. The first fragment of the key and the second fragment of the key are rotatable.
1. A system for providing encryption of a disk in a client device, the system comprising:
a trusted platform module (TPM) comprising a first fragment of a key;
a remote storage connected with the TPM, wherein the remote storage comprises a second fragment of the key; and
the client device configured to:
partially boot a plurality of instructions in the client device from the disk;
send a request for validation of the plurality of instructions to the TPM;
receive the first fragment of the key from the TPM in response to the validation of the plurality of instructions; and
send a request for the second fragment of the key to the remote storage along with credentials, wherein:
the credentials are used to access the remote storage;
a network is verified; and
verification of the network includes checking Internet Protocol (IP) address;
receive the second fragment of the key if the credentials are verified by the remote storage and the network is checked;
combine the first fragment of the key and the second fragment of the key to generate an encryption key;
complete the booting of the plurality of instructions from the disk by decrypting data on the disk using the encryption key, and
access data stored on the client device in response to the completion of the booting of the plurality of instructions from the disk,
wherein the first fragment of the key and the second fragment of the key are rotated when: stealing of sensitive data in the client device, malware attack in the client device, or a leakage of the first fragment of the key or the second fragment of the key is detected, and after the first fragment of the key and the second fragment of the key are rotated, the first fragment of the key is updated in the TPM.
2. The system for providing encryption of a disk in the client device, as recited in claim 1 , wherein the client device is configured to prevent booting of the plurality of instructions if the verification of the credentials fails and/or the verification of the network fails.
3. The system for providing encryption of a disk in the client device, as recited in claim 1 , wherein the client device-is configured to prevent accessing of the data if the verification of the credentials fails and/or the verification of the network fails.
4. The system for providing encryption of a disk in the client device, as recited in claim 1 , wherein the client device is configured to prevent booting of the plurality of the instructions if the disk is unmounted from the client device.
5. The system for providing encryption of a disk in the client device, as recited in claim 1 , wherein the client device is configured to prevent booting of the plurality of the instructions if a connection of the client device with the network fails.
6. The system for providing encryption of a disk in the client device, as recited in claim 1 , wherein the credentials include a username and a password.
7. The system for providing encryption of a disk in the client device, as recited in claim 1 , wherein the remote storage comprises a secure vault.
8. A method for providing encryption of a disk in a client device, the method comprising:
partially booting a plurality of instructions from a non-volatile memory;
sending a request for validation of the plurality of instructions to a Trusted Platform Module (TPM);
receiving a first fragment of a key from the TPM in response to the validation of the plurality of instructions;
sending a request for a second fragment of the key to a remote storage along with credentials, wherein:
the credentials are used to access the remote storage;
the remote storage is configured to verify a network; and
verification of the network includes checking Internet Protocol (IP) address;
receiving the second fragment of the key if the credentials are verified by the remote storage and the network is checked;
combining the first fragment of the key and the second fragment of the key to generate an encryption key;
completing the booting of the plurality of instructions from the disk by decrypting data on the disk using the encryption key; and
accessing data stored on the client device in response to the completion of the booting of the plurality of instructions from the disk,
wherein the first fragment of the key and the second fragment of the key are rotated when: stealing of sensitive data in the client device, malware attack in the client device, or a leakage of the first fragment of the key or the second fragment of the key is detected, and after the first fragment of the key and the second fragment of the key are rotated, the first fragment of the key is updated in the TPM.
9. The method for providing encryption of a disk in the client device, as recited in claim 8 , further comprising preventing booting of the plurality of instructions if the verification of the credentials fails and/or the verification of the network fails.
10. The method for providing encryption of a disk in the client device, as recited in claim 8 , further comprising preventing accessing of the data if the verification of the credentials fails and/or the verification of the network fails.
11. The method for providing encryption of a disk in the client device, as recited in claim 8 , further comprising preventing booting of the plurality of the instructions if the disk is unmounted from the client device.
12. The method for providing encryption of a disk in the client device, as recited in claim 8 , further comprising preventing booting of the plurality of the instructions if a connection of the client device with the network fails.
13. The method for providing encryption of a disk in the client device, as recited in claim 8 , wherein the credentials include a username and a password.
14. The method for providing encryption of a disk in the client device, as recited in claim 8 , wherein the remote storage comprises a secure vault.
15. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a client device to perform operations including:
partially booting a plurality of instructions from a non-volatile memory;
sending a request for validation of the plurality of instructions to a Trusted Platform Module (TPM);
receiving a first fragment of a key from the TPM in response to the validation of the plurality of instructions;
sending a request for a second fragment of the key to a remote storage along with credentials, wherein:
the credentials are used to access the remote storage;
the remote storage is configured to verify a network; and
verification of the network includes checking Internet Protocol (IP) address;
receiving the second fragment of the key if the credentials are verified by the remote storage and the network is checked;
combining the first fragment of the key and the second fragment of the key to generate an encryption key;
completing the booting of the plurality of instructions from a disk by decrypting data on the disk using the encryption key; and
accessing data stored on the client device in response to the completion of the booting of the plurality of instructions from the disk,
wherein the first fragment of the key and the second fragment of the key are rotated when: stealing of sensitive data in the client device, malware attack in the client device, or a leakage of the first fragment of the key or the second fragment of the key is detected, and after the first fragment of the key and the second fragment of the key are rotated, the first fragment of the key is updated in the TPM.
16. The computer-program product for providing encryption of a disk in the client device, as recited in claim 15 , further comprising preventing booting of the plurality of instructions if the verification of the credentials fails and/or the verification of the network fails.
17. The computer-program product for providing encryption of a disk in the client device, as recited in claim 15 , further comprising preventing accessing of the data if the verification of the credentials fails and/or the verification of the network fails.
18. The computer-program product for providing encryption of a disk in the client device, as recited in claim 15 , further comprising preventing booting of the plurality of the instructions if the disk is unmounted from the client device.
19. The computer-program product for providing encryption of a disk in the client device, as recited in claim 15 , further comprising preventing booting of the plurality of the instructions if a connection of the client device with the network fails.
20. The computer-program product for providing encryption of a disk in the client device, as recited in claim 15 , wherein the credentials include a username and a password.