Data protection using policy-based digital vault rotation
Techniques are provided for data protection using policy-based digital vault rotation. One method comprises obtaining data to be stored; selecting one of multiple digital vaults; and storing the data in the selected digital vault, wherein a different one of the multiple digital vaults is selected using a rotation policy in response to rotation criteria being satisfied and wherein the data is moved to the selected different digital vault. The multiple digital vaults may comprise multiple digital vaults having different memory spaces on a given device and/or multiple digital vaults on different devices. The multiple digital vaults may only respond to a designated vault proxy service. An active digital vault may be identified using the rotation policy in response to a request for data and the data may be retrieved from the active digital vault and provided to a requester associated with the request.
1 . A method, comprising:
obtaining data to be stored;
selecting one of a plurality of digital vaults; and
storing, by at least one processor-based vault proxy service, the data in the selected digital vault, wherein a different one of the plurality of digital vaults is selected using a rotation policy in response to one or more rotation criteria being satisfied and wherein the data is moved, by the at least one processor-based vault proxy service, to the selected different digital vault, wherein one or more workloads request data stored in one or more of the plurality of digital vaults using the at least one processor-based vault proxy service, wherein the at least one processor-based vault proxy service identifies an active one of the plurality of digital vaults using the rotation policy in response to the request from the one or more workloads for at least a portion of the data;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2 . The method of claim 1 , further comprising retrieving the at least a portion of the data from the active digital vault and providing the at least a portion of the data to a requester associated with the request.
3 . The method of claim 1 , wherein the plurality of digital vaults comprises one or more of a plurality of digital vaults having different memory spaces of a given device and a plurality of digital vaults on different devices.
4 . The method of claim 1 , wherein the plurality of digital vaults only respond to the at least one processor-based vault proxy service.
5 . The method of claim 4 , wherein only the at least one processor-based vault proxy service has direct access to one or more of the plurality of digital vaults and other devices access the one or more of the plurality of digital vaults using the at least one processor-based vault proxy service.
6 . The method of claim 1 , wherein the data comprises one or more of a secret, a key, a certificate and designated data.
7 . An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
obtaining data to be stored;
selecting one of a plurality of digital vaults; and
storing, by at least one processor-based vault proxy service, the data in the selected digital vault, wherein a different one of the plurality of digital vaults is selected using a rotation policy in response to one or more rotation criteria being satisfied and wherein the data is moved, by the at least one processor-based vault proxy service, to the selected different digital vault, wherein one or more workloads request data stored in one or more of the plurality of digital vaults using the at least one processor-based vault proxy service, wherein the at least one processor-based vault proxy service identifies an active one of the plurality of digital vaults using the rotation policy in response to the request from the one or more workloads for at least a portion of the data.
8 . The apparatus of claim 7 , further comprising retrieving the at least a portion of the data from the active digital vault and providing the at least a portion of the data to a requester associated with the request.
9 . The apparatus of claim 7 , wherein the plurality of digital vaults comprises one or more of a plurality of digital vaults having different memory spaces of a given device and a plurality of digital vaults on different devices.
10 . The apparatus of claim 7 , wherein the plurality of digital vaults only respond to the at least one processor-based vault proxy service.
11 . The apparatus of claim 10 , wherein only the at least one processor-based vault proxy service has direct access to one or more of the plurality of digital vaults and other devices access the one or more of the plurality of digital vaults using the at least one one processor-based vault proxy service.
12 . The apparatus of claim 7 , wherein the data comprises one or more of a secret, a key, a certificate and designated data.
13 . A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
obtaining data to be stored;
selecting one of a plurality of digital vaults; and
storing, by at least one processor-based vault proxy service, the data in the selected digital vault, wherein a different one of the plurality of digital vaults is selected using a rotation policy in response to one or more rotation criteria being satisfied and wherein the data is moved, by the at least one processor-based vault proxy service, to the selected different digital vault, wherein one or more workloads request data stored in one or more of the plurality of digital vaults using the at least one processor-based vault proxy service, wherein the at least one processor-based vault proxy service identifies an active one of the plurality of digital vaults using the rotation policy in response to the request from the one or more workloads for at least a portion of the data.
14 . The non-transitory processor-readable storage medium of claim 13 , further comprising retrieving the at least a portion of the data from the active digital vault and providing the at least a portion of the data to a requester associated with the request.
15 . The non-transitory processor-readable storage medium of claim 13 , wherein the plurality of digital vaults comprises one or more of a plurality of digital vaults having different memory spaces of a given device and a plurality of digital vaults on different devices.
16 . The non-transitory processor-readable storage medium of claim 13 , wherein the plurality of digital vaults only respond to the at least one processor-based vault proxy service.
17 . The non-transitory processor-readable storage medium of claim 16 , wherein only the at least one processor-based vault proxy service has direct access to one or more of the plurality of digital vaults and other devices access the one or more of the plurality of digital vaults using the at least one processor-based vault proxy service.
18 . The method of claim 1 , wherein the at least one processor-based vault proxy service moves the data to the selected different digital vault by reading the stored data from the selected digital vault and storing the data in the selected different digital vault.
19 . The apparatus of claim 7 , wherein the at least one processor-based vault proxy service moves the data to the selected different digital vault by reading the stored data from the selected digital vault and storing the data in the selected different digital vault.
20 . The non-transitory processor-readable storage medium of claim 13 , wherein the at least one processor-based vault proxy service moves the data to the selected different digital vault by reading the stored data from the selected digital vault and storing the data in the selected different digital vault.