Securely storing and distributing sensitive data in a cloud-based application

1. A method, comprising:

receiving a request, a first secret data, and a second secret data including a public key of a remote security proxy server;

mapping the request to the first secret data;

identifying a first encrypted data to retrieve based on the request;

using the first secret data to decrypt the first encrypted data to generate a decrypted data including by recovering a public key from the first secret data;

discarding the first secret data;

generating a second encrypted data by using the second secret data to encrypt the decrypted data; and

providing the second encrypted data to the remote security proxy server, wherein the security proxy server does not own the first secret data and the second encrypted data is decryptable by a private key of the security proxy server.

2. The method of claim 1 , wherein the first secret data includes a password.

3. The method of claim 1 , further comprising prior to the receipt of the first secret data and the second secret data:

receiving a storage request, wherein the storage request includes data to be stored and a third secret;

encrypting the data using the third secret;

writing the data to memory; and

discarding the third secret.

4. The method of claim 3 , wherein the writing the data to memory includes storing the data to a cloud service such that the cloud service is unable to decrypt the data.

5. The method of claim 1 , further comprising registering a security proxy server including:

receiving login data including an administrator password, a security proxy password, and tenant information;

authenticating the security proxy based on the received login data;

receiving registration information including a security proxy public key; and

storing the security proxy public key.

6. The method of claim 1 , further comprising creating a profile including:

receiving a request to create a profile;

retrieving an administrator public key;

generating a profile password;

associating the administrator public key and the profile password;

generating a profile key pair;

generating the profile; and

creating a file with the profile key pair protected with the generated profile password.

7. The method of claim 6 , further comprising assigning a security proxy server to the profile including:

receiving a request to add a security proxy server to a profile;

recovering an administrator key with an administrator password;

decrypting a profile password using the administrator key;

encrypting the profile password with a security proxy public key; and

storing the encrypted profile password.

8. The method of claim 1 , further comprising removing a security proxy server, wherein the security proxy is removed without re-provisioning other security proxy servers.

9. The method of claim 1 , further comprising removing a security proxy server including:

receiving a request to remove a security proxy from a profile;

recovering a profile password with an administrator password;

changing the profile password; and

disseminating the changed profile password to other administrators and security proxies.

10. A cloud management system, comprising:

a communications interface to:

receive a request, a first secret data and a second secret data including a public key of a remote security proxy server; and

a processor to:

map the request to the first secret data;

identify a first encrypted data to retrieve based on the request;

use the first secret data to decrypt the first encrypted data to generate a decrypted data including by recovering a public key from the first secret data;

discard the first secret data;

generate a second encrypted data by using the second secret data to encrypt the decrypted data; and

provide the second encrypted data to the remote security proxy server, wherein the security proxy server does not own the first secret data and the second encrypted data is decryptable by a private key of the security proxy server; and

a memory coupled to the processor to provide the processor with instructions.

11. The cloud management system of claim 10 , wherein the communications interface further:

receives a storage request, the storage request including data to be stored and a third secret; and

the processor further:

encrypts the data using the third secret;

writes the data to memory; and

discards the third secret.

12. The cloud management system of claim 10 , wherein the cloud management system provides access control and key management and distribution.

13. The cloud management system of claim 10 , wherein the cloud management system services a plurality of security proxies and a security proxy server is addable or removable without re-provisioning each of the other security proxy servers.

14. The cloud management system of claim 10 , wherein no private keys from the security proxy are stored in the cloud management system.

15. The cloud management system of claim 10 , wherein the cloud management system:

accommodates a plurality of tenants and respective data security domains; and

provides only an entity with a key to decrypt certificate private keys access to a protected resource belonging to a tenant.

16. The cloud management system of claim 10 , wherein the first secret data includes a password using which a public key is recoverable.

17. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving a request, a first secret data, and a second secret data including a public key of a remote security proxy server;

mapping the request to the first secret data;

identifying a first encrypted data to retrieve based on the request;

using the first secret data to decrypt the first encrypted data to generate a decrypted data including by recovering a public key from the first secret data;

discarding the first secret data;

generating a second encrypted data by using the second secret data to encrypt the decrypted data; and

providing the second encrypted data to the remote security proxy server, wherein the security proxy server does not own the first secret data and the second encrypted data is decryptable by a private key of the security proxy server.