Systems and methods for distributed cryptography as a service key loading
An application server has a custodian application running thereon. The custodian application instantiates a cryptographic microservice. The custodian application transmits a request message to a centralized KMS requesting a data encryption key. In response, the centralized KMS returns the data encryption key. The custodian application transmits the authorization grant request to the centralized KMS and receives the authorization grant and encrypted data encryption key in return. The custodian application transmits the authorization grant and encrypted data encryption key to the cryptographic microservice application. The cryptographic microservice application transmits the authorization grant and encrypted data encryption key to the centralized KMS and receives the decrypted data encryption key in return.
1 . An application server having a custodian application running thereon, the application server comprising:
one or more processors; and
a memory, the memory storing computer-executable instructions that when executed by the one or more processors, cause the one or more processors to:
instantiate, by the custodian application, a cryptographic microservice application on the application server, the cryptographic microservice application having a unique identifier;
transmit, by the custodian application, a request message to a centralized key management system (KMS), the request message including a request for a data encryption key;
in response to the request message, receive, by the custodian application from the centralized KMS, the data encryption key, the data encryption key being encrypted via a master-level tenant key associated with the custodian application;
transmit, by the custodian application, an authorization request message to the centralized KMS, the authorization request message including the encrypted data encryption key and the unique identifier of the cryptographic microservice application;
in response to the authorization request message, receive, by the custodian application, as authorization grant from the centralized KMS;
transmit, by the custodian application, the authorization grant and the encrypted data encryption key to the cryptographic microservice application;
transmit, by the cryptographic microservice application, an authorization grant request to the centralized KMS, the authorization grant request including the authorization grant and the encrypted data encryption key; and
based on validation of a digitally signed certificate, receive, by the cryptographic microservice application, a decrypted data encryption key from the centralized KMS.
2 . The application server in accordance with claim 1 ,
the computer-executable instructions causing the one or more processors to store, by the custodian application, the encrypted data encryption key in the memory.
3 . The application server in accordance with claim 2 ,
wherein the encrypted data encryption key includes metadata, the metadata including key policy data,
the key policy data including data that identifies one or more authorized applications by unique attributes and associates the unique attributes with one or more selected actions the one or more authorized applications are permitted to perform using the data encryption key.
4 . The application server in accordance with claim 1 , wherein transmitting the authorization grant request to the centralized KMS includes transmitting a request that the centralized KMS decrypt the encrypted data encryption key and return the decrypted data access encryption key to the cryptographic microservice application.
5 . The application server in accordance with claim 1 ,
the computer-executable instructions causing the one or more processors to negotiate, by the cryptographic microservice application, a secure communication channel between the cryptographic microservice application and the centralized KMS,
wherein receiving the decrypted data encryption key from the centralized KMS comprises receiving the decrypted data encryption key over the secure communication channel.
6 . The application server in accordance with claim 5 ,
wherein negotiating the secure communication channel comprises negotiating an ephemeral Elliptic Curve Diffie-Hellman (ECDH) key agreement over Transport Layer Security (TLS) for the secure channel.
7 . The application server in accordance with claim 5 ,
wherein negotiating the secure communication channel comprises generating communication encryption keys for secure communication over the secure communication channel,
wherein receiving the decrypted data encryption key from the centralized KMS comprises receiving the decrypted data encryption key over the secure communication channel, the decrypted data encryption key being encrypted with the communication encryption keys, thereby generating a wrapped key,
the computer-executable instructions causing the one or more processors to unwrap, by the cryptographic microservice application, the wrapped key using the communication encryption keys.
8 . A method performed by an application server, the application server having a memory and a custodian application running thereon, the method comprising:
instantiating, by the custodian application, a cryptographic microservice application on the application server, the cryptographic microservice application having a unique identifier;
transmitting, by the custodian application, a request message to a centralized key management system (KMS), the request message including a request for a data encryption key;
in response to the request message, receiving, by the custodian application from the centralized KMS, the data encryption key, the data encryption key being encrypted via a master-level tenant key associated with the custodian application;
transmitting, by the custodian application, an authorization request message to the centralized KMS, the authorization request message including the encrypted data encryption key and the unique identifier of the cryptographic microservice application;
in response to the authorization request message, receiving, by the custodian application, an authorization grant from the centralized KMS;
transmitting, by the custodian application, the authorization grant and the encrypted data encryption key to the cryptographic microservice application;
transmitting, by the cryptographic microservice application, an authorization grant request to the centralized KMS, the authorization grant request including the authorization grant and the encrypted data encryption key; and
based on validation of a digitally signed certificate, receiving, by the cryptographic microservice application, a decrypted data encryption key from the centralized KMS.
9 . The method in accordance with claim 8 , further comprising storing, by the custodian application, the encrypted data encryption key in the memory.
10 . The method in accordance with claim 9 ,
wherein the encrypted data encryption key includes metadata, the metadata including key policy data,
the key policy data including data that identifies one or more authorized applications by unique attributes and associates the unique attributes with one or more selected actions the one or more authorized applications are permitted to perform using the data encryption key.
11 . The method in accordance with claim 8 , wherein transmitting the authorization grant request to the centralized KMS includes transmitting a request that the centralized KMS decrypt the encrypted data encryption key and return the decrypted data access encryption key to the cryptographic microservice application.
12 . The method in accordance with claim 8 , further comprising:
negotiating, by the cryptographic microservice application, a secure communication channel between the cryptographic microservice application and the centralized KMS,
wherein receiving the decrypted data encryption key from the centralized KMS comprises receiving the decrypted data encryption key over the secure communication channel.
13 . The method in accordance with claim 12 , wherein negotiating the secure communication channel comprises negotiating an ephemeral Elliptic Curve Diffie-Hellman (ECDH) key agreement over Transport Layer Security (TLS) for the secure channel.
14 . The method in accordance with claim 12 ,
wherein negotiating the secure communication channel comprises generating communication encryption keys for secure communication over the secure communication channel,
wherein receiving the decrypted data encryption key from the centralized KMS comprises receiving the decrypted data encryption key over the secure communication channel, the decrypted data encryption key being encrypted with the communication encryption keys, thereby generating a wrapped key,
the method further comprising unwrapping, by the cryptographic microservice application, the wrapped key using the communication encryption keys.
15 . A non-transitory computer-readable storage medium having computer-executable instructions stored thereon, the computer-executable instructions, when executed by one or more processors, causing the one or more processors to:
instantiate a cryptographic microservice application, the cryptographic microservice application having a unique identifier;
transmit a request message to a centralized key management system (KMS), the request message including a request for a data encryption key;
in response to the request message, receive, from the centralized KMS, the data encryption key, the data encryption key being encrypted via a master-level tenant key associated with a custodian application;
transmit an authorization request message to the centralized KMS, the authorization request message including the encrypted data encryption key and the unique identifier of the cryptographic microservice application;
in response to the authorization request message, receive an authorization grant from the centralized KMS;
transmit the authorization grant and the encrypted data encryption key to the cryptographic microservice application;
transmit, by the cryptographic microservice application, an authorization grant request to the centralized KMS, the authorization grant request including the authorization grant and the encrypted data encryption key; and
based on validation of a digitally signed certificate, receive, by the cryptographic microservice application, a decrypted data encryption key from the centralized KMS.
16 . The non-transitory computer-readable storage medium in accordance with claim 15 ,
the computer-executable instructions causing the one or more processors to store the encrypted data encryption key in a memory.
17 . The non-transitory computer-readable storage medium in accordance with claim 16 ,
wherein the encrypted data encryption key includes metadata, the metadata including key policy data,
the key policy data including data that identifies one or more authorized applications by unique attributes and associates the unique attributes with one or more selected actions the one or more authorized applications are permitted to perform using the data encryption key.
18 . The non-transitory computer-readable storage medium in accordance with claim 15 , wherein transmitting the authorization grant request to the centralized KMS includes transmitting a request that the centralized KMS decrypt the encrypted data encryption key and return the decrypted data access encryption key to the cryptographic microservice application.
19 . The non-transitory computer-readable storage medium in accordance with claim 15 ,
the computer-executable instructions causing the one or more processors to negotiate, by the cryptographic microservice application, a secure communication channel between the cryptographic microservice application and the centralized KMS,
wherein receiving the decrypted data encryption key from the centralized KMS comprises receiving the decrypted data encryption key over the secure communication channel.
20 . The non-transitory computer-readable storage medium in accordance with claim 19 ,
wherein negotiating the secure communication channel comprises generating communication encryption keys for secure communication over the secure communication channel,
wherein receiving the decrypted data encryption key from the centralized KMS comprises receiving the decrypted data encryption key over the secure communication channel, the decrypted data encryption key being encrypted with the communication encryption keys, thereby generating a wrapped key,
the computer-executable instructions causing the one or more processors to unwrap, by the cryptographic microservice application, the wrapped key using the communication encryption keys.