扩展密钥管理 - 数千个客户端，数万亿次操作.pdf

SESSION ID:SESSION ID: ACB-F03 Scaling Key Management: Thousands of Clients, Trillions of Operations Yaron Sheffer Director, Security Technologies Product Development Intuit @yaronsheffer #RSAC#RSAC #RSAC Intuit A global financial platform company Maker of More than 50M customers trust us with their financial data Steadfast commitment to security Strategic move to the AWS cloud Acquired Israeli security startup Porticor in Feb. 2015 2 #RSAC IDPS, Intuit Data Protection Service Secret and Key Management service – Storage for secrets and encryption keys – Cryptographic operations Client Key Key Application Management Storage For highly sensitive data we require both transparent disk-level and application-level data encryption #RSAC#RSAC Core Features #RSAC Where to Encrypt Fetch the key into the client, then encrypt Alternatively, send the data to be encrypted on the KM service Derive Instead: RDLE – Remote Derive, Local Encrypt Encrypt Fine-grain keys: implications on threat model