Key rotation service
A system for security key rotation in a cloud computing environment is disclosed. The system performs steps to at least initiate, at a predetermined interval, a call to determine whether to initiate generation of a public-private key pair for a client application. The system determines whether to initiate generation of the public-private key pair for the client application and based on determining to initiate generation of the public-private key pair for the client application, transmits a control signal requesting generation of the public-private key pair The system generates the public-private key pair and transmits a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application and transmits a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.
1. A computer implemented method for security key rotation in a cloud computing environment, the method comprising:
determining, by a key rotation control module, whether to initiate generation of a public-private key pair for a client application based on:
querying a database to obtain a product configuration for the client application, wherein the product configuration includes a key rotation period associated with the client application indicating a frequency at which the public-private key pair for the client application is to be generated,
determining whether a difference between a last time a previous public-private key pair was generated for the client application and a current time is greater than the key rotation period,
based on determining the difference between the last time the previous public-private key pair was generated for the client application and the current time is greater than the key rotation period, initiating generation of the public-private key pair;
generating, by a key rotation module, the public-private key pair; and
transmitting, by one or more computing devices, a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application.
2. The method of claim 1 , further comprising transmitting, by the one or more computing devices, a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.
3. The method of claim 1 , further comprising updating, by the key rotation module, the database with a timestamp indicating when the public-private key pair was generated for the client application, the timestamp to replace the last time the previous public-private key pair was generated for the client application.
4. The method of claim 1 , wherein the product configuration further includes a key validity period associated with the key rotation period, wherein the key validity period indicates a duration for which the public-private key pair is accessible by the client application and a client.
5. The method of claim 1 , wherein the public-private key pair is: Elliptic Curve (EC) keys, RSA keys, or digital signature keys.
6. The method of claim 1 , wherein the key rotation control module and the key rotation module are implemented as serverless functions of the cloud computing environment.
7. The method of claim 1 , further comprising:
receiving, by the one or more computing devices, a request by a user to initiate generation of the public-private key pair; and
based on receiving the request, initiating, by the key rotation control module, generation of the public-private key pair.
8. A non-transitory computer readable medium including instructions for security key rotation in a cloud computing environment, the instructions comprising:
determining, by a key rotation control module, whether to initiate generation of a public-private key pair for a client application based on:
querying a database to obtain a product configuration for the client application, wherein the product configuration includes a key rotation period associated with the client application indicating a frequency at which the public-private key pair for the client application is to be generated,
determining whether a difference between a last time a previous public-private key pair was generated for the client application and a current time is greater than the key rotation period,
based on determining the difference between the last time the previous public-private key pair was generated for the client application and the current time is greater than the key rotation period, initiating generation of the public-private key pair;
generating, by a key rotation module, the public-private key pair; and
transmitting, by one or more computing devices, a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application.
9. The non-transitory computer readable medium of claim 8 , wherein the instructions further comprise transmitting, by the one or more computing devices, a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.
10. The non-transitory computer readable medium of claim 8 , wherein the instructions further comprise updating, by the key rotation module, the database with a timestamp indicating when the public-private key pair was generated for the client application, the timestamp to replace the last time the previous public-private key pair was generated for the client application.
11. The non-transitory computer readable medium of claim 8 , wherein the product configuration further includes a key validity period associated with the key rotation period, wherein the key validity period indicates a duration for which the public-private key pair is accessible by the client application and a client.
12. The non-transitory computer readable medium of claim 8 , wherein the public-private key pair is: Elliptic Curve (EC) keys, RSA keys, or digital signature keys.
13. The non-transitory computer readable medium of claim 8 , wherein the key rotation control module and the key rotation module are implemented as serverless functions of the cloud computing environment.
14. The non-transitory computer readable medium of claim 8 , wherein the instructions further comprise:
receiving, by the one or more computing devices, a request by a user to initiate generation of the public-private key pair; and
based on receiving the request, initiating, by the key rotation control module, generation of the public-private key pair.
15. A computing system for security key rotation in a cloud computing environment comprising:
a memory of the cloud computing environment to store instructions;
one or more processors of the cloud computing environment, coupled to the memory, configured to process the stored instructions to:
determine, by a key rotation control module, whether to initiate generation of a public-private key pair for a client application based on:
query a database to obtain a product configuration for the client application, wherein the product configuration includes a key rotation period associated with the client application indicating a frequency at which the public-private key pair for the client application is to be generated,
determine whether a difference between a last time a previous public-private key pair was generated for the client application and a current time is greater than the key rotation period,
based on determining the difference between the last time the previous public-private key pair was generated for the client application and the current time is greater than the key rotation period, initiate generation of the public-private key pair;
generate, by a key rotation module, the public-private key pair; and
transmit a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application.
16. The computing system of claim 15 , wherein the one or more processors are further configured to transmit a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.
17. The computing system of claim 15 , wherein the one or more processors are further configured to update the database with a timestamp indicating when the public-private key pair was generated for the client application, the timestamp to replace the last time the previous public-private key pair was generated for the client application.
18. The computing system of claim 15 , wherein the product configuration further includes a key validity period associated with the key rotation period, wherein the key validity period indicates a duration for which the public-private key pair is accessible by the client application and a client.
19. The computing system of claim 15 , wherein the public-private key pair is: Elliptic Curve (EC) keys, RSA keys, or digital signature keys.
20. The computing system of claim 15 , wherein the key rotation control module and the key rotation module are implemented as serverless functions of the cloud computing environment.