Abstract: Embodiments are directed to a cloud based rotation of a secret stored in a secrets storage and stored in a target system. Embodiments receive an identifier of a function for rotating the secret or an identifier of the target system when the target system includes a management Application Programming Interface (“API”) for rotating the secret. Embodiments determine that the secret needs to be rotated based on a rotating schedule. When the identifier of the function is received, embodiments rotate the secret using the function and when the identifier of the target system is received, embodiments rotate the secret using the management API. Rotating the secret includes updating the secret at the secret storage and at the target system.

Abstract: Techniques are described for securing data stored on a non-volatile storage medium from unauthorized access using improved network-bound data security techniques. The data is secured using network-bound security techniques without the entities involved in the processing (e.g., clients and servers) having to exchange any client-specific or server-specific keys, secrets, or other secret data with each other. The techniques disclosed herein provide the network-bound data security functionality using a sequence of Message Authentication Codes (macs) generated using Hash-based Message Authentication Code (HMAC) generation techniques.

Abstract: Embodiments are directed to a cloud based rotation of a secret stored in a secrets storage and stored in a target system. Embodiments receive an identifier of a function for rotating the secret or an identifier of the target system when the target system includes a management Application Programming Interface (“API”) for rotating the secret. Embodiments determine that the secret needs to be rotated based on a rotating schedule. When the identifier of the function is received, embodiments rotate the secret using the function and when the identifier of the target system is received, embodiments rotate the secret using the management API. Rotating the secret includes updating the secret at the secret storage and at the target system.

Abstract: The present embodiments relate to a keystore service for encryption for a computing device of a cloud computing system. The computing device of the cloud computing system can receive a key identification, an encrypted key encryption key, an identity of a client device, and a request from the client device to store the key identification and the encrypted key identification key. The computing device can verify, based at least in part on the identity, an authority of the client device to store the key identification and encrypted key encryption key. The computing device can transmit, based at least in part on the verification, the key identification, the encrypted key encryption key, and request to store the key identification and the encrypted key encryption key to a keystore.

Abstract: The present embodiments relate to a keystore service for encryption for a computing device of a cloud computing system. The computing device of the cloud computing system can receive a key identification, an encrypted key encryption key, an identity of a client device, and a request from the client device to store the key identification and the encrypted key identification key. The computing device can verify, based at least in part on the identity, an authority of the client device to store the key identification and encrypted key encryption key. The computing device can transmit, based at least in part on the verification, the key identification, the encrypted key encryption key, and request to store the key identification and the encrypted key encryption key to a keystore.