Remote key management in a cloud-based environment

• US 9,628,268 B2
• Filed: 10/17/2013
• Issued: 04/18/2017
• Est. Priority Date: 10/17/2012
• Status: Active Grant

• Current Assignee: Box Incorporated
• Original Assignee: Box Incorporated
• Inventors: Kiang, Andy, Byron, Chris, Queisser, Jeffrey
• Primary Examiner(s): Kim, Tae
• Application Number:
  US14/056,899
• Publication Number:
  US 20140270178A1
• Time in Patent Office: 1,279 Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/0822 using key encryption key

Abstract

Systems and methods are disclosed for facilitating remote key management services in a collaborative cloud-based environment. In one embodiment, the remote key management architecture and techniques described herein provide for local key encryption and automatic generation of a reason code associated with content access. The reason code is used by a remote client device (e.g., an enterprise client) to control a second (remote) layer of key encryption. The remote client device provides client-side control and configurability of the second layer of key encryption.

Claims

1. A key service engine for facilitating remote key management services in a collaborative cloud-based environment, the key service engine comprising:

a processor;

a key service proxy device configured to initiate a remote key request responsive to a determination that a data item indicated by a content request is associated with remote key management functionality, the data item being encrypted or decrypted by an encryption key, and the remote key request corresponding to (a) an encryption of the encryption key performed by a remote key service engine to generate an encrypted encryption key or (b) a decryption of the encrypted encryption key performed by a remote key service engine to decrypt the encrypted encryption; and

a reason engine configured to determine a reason code associated with the content request, wherein determining the reason code comprises directing the processor to;

(a) identify the reason associated with the content request and (b) subsequently generate a corresponding reason code associated with the remote key request;

the remote key request being processed by the remote key service engine that is located on a second client device that is remote from the key service proxy device located on a first client device, the remote key request sent across a network from the first client to the second client device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code.

2. The key service engine of claim 1, wherein the content request comprises an upload request and wherein the remote key request includes a request to encrypt an encrypted encryption key.

3. The key service engine of claim 1, wherein the content request comprises an access request and wherein the remote key request includes a request to decrypt a encrypted encryption key.

4. The key service engine of claim 1, further comprising:

a key encryption/decryption engine (E/D) engine configured to encrypt and decrypt an encryption key using a local key encryption key (KEK).

5. The key service engine of claim 1, further comprising:

a metadata engine configured to process a received content request to identify metadata associated with the content request,

wherein the remote key request further includes the metadata.

6. The key service engine of claim 1, further comprising:

a client interface configured to send the remote key request to a remote client system for encryption with a once encrypted key or for decryption with a encrypted key,

wherein the client interface is configured to responsively receive the encrypted key or the once encrypted, respectively.

7. The key service engine of claim 6, wherein the client interface is further configured to receive a remote key encryption key (KEK) initiated by a remote client computer system responsive to an encryption request, wherein the remote KEK is utilized by a remote key management system to encrypt the encrypted encryption key.

8. The key service engine of claim 1, further comprising:

a cloud-based platform interface configured to receive the content request,

wherein the cloud-based platform is in communication with a data store to direct the data store to store or access a local or remote key encryption keys associated with an encryption key.

9. A collaboration system for facilitating remote key management services in a collaborative cloud-based environment, the system comprising:

a processor;

a memory unit having instructions stored thereon which when executed by the processor, causes the collaboration system to;

encrypt a content item indicated by a content request using an encryption key;

encrypt the encryption key using a local key encryption key (KEK);

determine if the content item is associated with remote key management functionality, a data item being encrypted by an encryption key, and a remote key request corresponding to encryption of the encryption key performed by a remote key service engine to generate an encrypted encryption key; and

if the content item is associated with remote key management functionality,

determine a reason code associated with the content request, wherein the reason code is determined by directing the processor to (a) identify the reason associated with the content request and (b) subsequently generate a corresponding reason code associated with the content request; and

the remote key request being processed by the remote key service engine that is located on a second computing device that is remote from a key service proxy device located on a first computing device, the remote key request sent across a network from the first computing to the second computing device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code; and

initiate a remote key encryption request including the encrypted encryption key and the reason code.

10. The collaboration system of claim 9, wherein the instructions, when executed by the processor, further causes the collaboration system to receive a encrypted encryption key responsive to initiating the remote key encryption request.

11. The collaboration system of claim 9, wherein the instructions, when executed by the processor, further causes the collaboration system to receive a receive a remote KEK responsive to initiating the remote key encryption request.

12. The collaboration system of claim 9, wherein the collaboration system is configured to randomly select the local KEK.

13. The collaboration system of claim 9, when the instructions, when executed by the processor, further causes the collaboration system to:

receive the content request;

process the content request to determine that a content item request is an upload request; and

identify the content item indicated by the content item request.

14. A collaboration system for facilitating remote key management services in a collaborative cloud-based environment, the system comprising:

a processor;

a memory unit having instructions stored thereon which when executed by the processor, causes the collaboration system to;

determine if a content item associated with a received content request is associated with remote key management functionality, a data item being decrypted by an encryption key, and a remote key request corresponding to encryption of the encryption key performed by a remote key service to a decrypt the encrypted encryption key; and

if the content item is associated with the remote key management functionality,

determine a reason code associated with the content request, wherein determining the reason code is determined by directing the processor to;

(a) identify the reason code associated with the content request and (b) subsequently generate a corresponding reason code associated with the remote key request,

the remote key request being processed by a remote key service engine that is located on a second computing device that is remote from a key service proxy device located on a first computing device, the remote key request sent across a network from the first computing to the second computing device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code;

access a encrypted encryption key from a data store; and

initiate a remote key decryption request including the encrypted encryption key and the reason code.

15. The collaboration system of claim 14, wherein the instructions, when executed by the processor, further causes the collaboration system to:

receive the content request and identify the content item associated with the content request.

16. The collaboration system of claim 14, wherein the instructions when executed by the processor, further causes the collaboration system to:

receive a once encrypted encryption key responsive to initiating the remote key decryption request,

wherein the once encrypted encryption key comprises the encrypted encryption key when unencrypted using a remote key encryption key (KEK);

access a local KEK from a data store; and

decrypt the once encrypted encryption key using the local KEK resulting in an encryption key.

17. The collaboration system of claim 16, wherein the instructions when executed by the processor, further causes the collaboration system to:

access an encrypted content item from the data store,

wherein the encrypted content item is the content item requested via the content request; and

decrypt the encrypted content item using the encryption key.

18. The collaboration system of claim 16, wherein the instructions when executed by the processor;

further causes the collaboration system to provide a decrypted content item responsive to a content item request.

19. A computer program product embodied in a non-transitory computer readable storage medium, the computer readable medium having stored thereon a sequence of instructions which when executed by a processor causes the processor to execute a process to facilitate remote key management services in a collaborative cloud-based environment, the method comprising:

initiating a remote key request responsive to a determination that a data item indicated by a content request is associated with remote key management functionality, the data item being encrypted or decrypted by an encryption key, and the remote key request corresponding to (a) an encryption of the encryption key performed by a remote key service engine to generate an encrypted encryption key or (b) a decryption of the encrypted encryption key performed by a remote key service engine to decrypt the encrypted encryption key; and

determining a reason code associated with the content request, wherein determining the reason code comprises directing the processor to;

(a) identify the reason associated with the content request and (b) subsequently generate a corresponding reason code associated with the remote key request;

the remote key request being processed by the remote key service engine that is located on a second client device that is remote from a key service proxy device located on a first client device, the remote key request sent across a network from the first client to the second client device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code.

20. A non-transitory computer-readable storage medium of claim 19, wherein the instructions, when executed by a processor, further causes the processor to:

determine that a kill switch has been asserted; and

reject the remote key based on the kill switch being set regardless of pre-configured rules and the reason.

21. A computer program product embodied in a non-transitory computer readable storage medium, the computer readable medium having stored thereon a sequence of instructions which when executed by a processor causes the processor to execute a process to facilitate remote key management services in a collaborative cloud-based environment, the method comprising:

encrypting a content item indicated by a content request using an encryption key;

encrypting the encryption key using a local key encryption key (KEK);

determining if the content item is associated with remote key management functionality, a data item being encrypted by an encryption key, and a remote key request corresponding to encryption of the encryption key to generate an encrypted encryption key, wherein the encryption of the encryption key to generate the encrypted encryption key is performed by a remote key service engine; and

if the content item is associated with remote key management functionality,

determining a reason code associated with the content request, wherein the reason code is determined by directing the processor to (a) identify the reason associated with the content request and (b) subsequently generate a corresponding reason code associated with the content request; and

being processed by the remote key service engine that is located on a second client device that is remote from a key service proxy device located on a first client device, the remote key request sent across a network from the first client to the second client device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code; and

initiating a remote key encryption request including the encrypted encryption key and the reason code.

22. A computer program product embodied in a non-transitory computer-readable storage medium, the computer readable medium having stored thereon a sequence of instructions which when executed by a processor causes the processor to execute a process to facilitate remote key management services in a collaborative cloud-based environment, the method comprising:

determining if a content item associated with a received content request is associated with remote key management functionality, a data item being decrypted by an encryption key, and a remote key request corresponding to encryption of the encryption key performed by a remote key service to decrypt the encrypted encryption key; and

if the content item is associated with the remote key management functionality,

determining a reason code associated with the content request, wherein determining the reason code is determined by directing the processor to;

(a) identify the reason code associated with the content request and (b) subsequently generate a corresponding reason code associated with the remote key request,

the remote key request being processed by a remote key service engine that is located on a second computing device that is remote from a key service proxy device located on a first computing device, the remote key request sent across a network from the first computing to the second computing device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code;

accessing an encrypted encryption key from a data store; and

initiating a remote key decryption request including the encrypted encryption key and the reason code.

23. A method for facilitating remote key management services in a collaborative cloud-based environment, the method comprising:

initiating a remote key request responsive to a determination that a data item indicated by a content request is associated with remote key management functionality, the data item being encrypted or decrypted by an encryption key, and the remote key request corresponding to (a) an encryption of the encryption key performed by a remote key service engine to generate an encrypted encryption key or (b) a decryption of the encrypted encryption key performed by a remote key service engine to decrypt the encrypted encryption key; and

determining a reason code associated with the content request, wherein determining the reason code comprises directing a processor to;

(a) identify the reason associated with the content request and (b) subsequently generate a corresponding reason code associated with the remote key request;

the remote key request being processed by the remote key service engine that is located on a second client device that is remote from a first client device that initiates the remote key request, the remote key request sent across a network from the first client to the second client device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code.

24. The method claim of 23, wherein the content request comprises an upload request and wherein the remote key request includes a request to encrypt an encrypted encryption key.

25. The method of claim 23, the content request comprises an access request and wherein the remote key request includes a request to decrypt an encrypted encryption key.

26. A method for facilitating remote key management services in a collaborative cloud-based environment, the method comprising:

encrypting a content item indicated by a content request using an encryption key;

encrypting the encryption key using a local key encryption key (KEK);

determining if the content item is associated with remote key management functionality, a data item being encrypted by an encryption key, and a remote key request corresponding to encryption of the encryption key to generate an encrypted encryption key, wherein the encryption of the encryption key to generate the encrypted encryption key is performed by a remote key service engine; and

if the content item is associated with remote key management functionality,

determining a reason code associated with the content request, wherein the reason code is determined by directing a processor to (a) identify the reason associated with the content request and (b) subsequently generate a corresponding reason code associated with the content request; and

being processed by the remote key service engine that is located on a second client device that is remote from a key service proxy device located on a first client device, the remote key request sent across a network from the first client to the second client device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code; and

initiating a remote key encryption request including the encrypted encryption key and the reason code.

27. The method of claim 26, further comprising receiving an encrypted encryption key responsive to initiating the remote key encryption request.

28. The method of claim 26, further comprising receiving a remote KEK responsive to initiating the remote key encryption request.

29. A method for facilitating remote key management services in a collaborative cloud-based environment, the method comprising:

determining if a content item associated with a received content request is associated with remote key management functionality, a data item being decrypted by an encryption key, and a remote key request corresponding to a decryption of an encrypted encryption key to performed by a remote key service engine decrypt the encrypted encryption key; and

if the content item is associated with the remote key management functionality,

determining a reason code associated with the content request, wherein determining the reason code is determined by directing a processor to;

(a) identify the reason code associated with the content request and (b) subsequently generate a corresponding reason code associated with the remote key request,

the remote key request being processed by the remote key service engine that is located on a second computing device that is remote from a key service proxy device located on a first computing device, the remote key request sent across a network from the first computing to the second computing device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code, accessing an encrypted encryption key from a data store; and

initiating a remote key decryption request including the encrypted encryption key and the reason code.

30. The method claim of 29, further comprising receiving the content request and identifying the content item associated with the content request.

31. The method of claim 29, further comprising:

receiving a once encrypted encryption key responsive to initiating the remote key decryption request, wherein the once encrypted encryption key comprises the encrypted encryption key when unencrypting using a remote key (KEK);

accessing a local KEK from a data store; and

decrypting the once encrypted encryption key using the local KEK resulting in an encryption key.

32. A computer program product embodied in a non-transitory computer readable medium, the computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a process to facilitate remote key management services in a collaborative cloud-based environment, the method comprising:

encrypting a content item indicated by a content request using an encryption key;

encrypting the encryption key using a local key encryption key (KEK);

determining if the content item is associated with remote key management functionality, a data item being encrypted by an encryption key, and a remote key request corresponding to encryption of the encryption key to generate an encrypted encryption key, wherein the encryption of the encryption key to generate the encrypted encryption key is performed by a remote key service engine; and

if the content item is associated with remote key management functionality,

determining a reason code associated with the content request, wherein the reason code is determined by directing the processor to (a) identify the reason associated with the content request and (b) subsequently generate a corresponding reason code associated with the content request; and

the remote key request being processed by the remote key service engine that is located on a second computing device that is remote from a key service proxy device located on a first computing device, the remote key request sent across a network from the first computing to the second computing device, wherein the remote key request is processed by the remote key service engine based at least in part on the reason code; and

initiating a remote key encryption request including the encrypted encryption key and the reason code.

33. The computer program product of 21, further comprising instructions for receiving an encrypted encryption key responsive to initiating the remote key encryption request.

34. The computer program product of 22,further comprising instructions for receiving the content request and identifying the content item associated with the content request.