Diese Präsentation wurde erfolgreich gemeldet.
Wir verwenden Ihre LinkedIn Profilangaben und Informationen zu Ihren Aktivitäten, um Anzeigen zu personalisieren und Ihnen relevantere Inhalte anzuzeigen. Sie können Ihre Anzeigeneinstellungen jederzeit ändern.

How we implemented SSO into a zero knowledge cloud encryption solution

654 Aufrufe

Veröffentlicht am

Find out what the challenges of Single Sign-on (SSo) for an encryption solution for clouds are. Learn, how we solved the issue in Boxcryptor.

Veröffentlicht in: Software
  • D0WNL0AD FULL ▶ ▶ ▶ ▶ http://1lite.top/OJNkw ◀ ◀ ◀ ◀
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier

How we implemented SSO into a zero knowledge cloud encryption solution

  1. 1. SSO with Boxcryptor
  2. 2. 2 Overview S S O w i t h B o x c r y p t o r Table of Content • Preconditions for Boxcryptor SSO • SSO from a user’s and from an admin’s perspective • The special case of SSO with encryption and zero knowledge • SSO and encryption – How we handle key management • SSO and zero knowledge – Why you need a device management service • Conclusion
  3. 3. 3 What do you need to implement SSO with Boxcryptor S S O w i t h B o x c r y p t o r • Identity Provider (IdP or “SSO Provider”)  Boxcryptor is compatible with any SAML-based SSO solution  Examples: Active Directory Federation Services (ADFS), Azure Active Directory (Azure AD), Okta, PingIdentity, OneLogin, LastPass, etc. • Key Management Service (KMS)  Examples: Hashicorp Vault (On-Premise), Amazon KMS (Cloud), Azure Key Vault (Cloud), etc. • Device Management System  Optional  Examples: Active Directory (Desktops), MobileIron (Mobile), etc.
  4. 4. 4 SSO from a User’s Perspective S S O w i t h B o x c r y p t o r (1) The user logs into Boxcryptor with his/her email address. (2) The user is redirected to the company’s Identity Provider (e.g. Active Directory). (3) The user enters his/her common password for all applications in the company.
  5. 5. 5 SSO from an Admin’s Perspective S S O w i t h B o x c r y p t o r • The admin adds the user to the company’s SSO solution. • The admin does not have to go to the Boxcryptor app and add the user there. • The user does not need a Boxcryptor password and therefore cannot forget it or accidentally lock himself out of his account. Note: With the new SSO it is also possible that companies manage and store their own keys in- house. Therefore, it becomes even simpler to meet compliance standards.
  6. 6. SSO and Zero Knowledge Encryption
  7. 7. 7 SSO and Zero Knowledge Encryption S S O w i t h B o x c r y p t o r Standard SSO protocols only handle user authentication, but Boxcryptor also needs zero knowledge key management for decrypting and encrypting. Therefore, creating a zero knowledge SSO solution is more complex.
  8. 8. 8 Zero Knowledge Encryption without SSO S S O w i t h B o x c r y p t o r • Every Boxcryptor user has his/her own password. • Derivations of single user’s passwords are used for two operations: authentication and encryption key management. • When an account is created, Boxcryptor generates a secure password hash and a password key. • The password hash is used for authentication. • The password key is used for encryption. SSO: Authentication is handled by every standard SSO solution. For key management (encryption) after the zero knowledge paradigm we had to develop a new solution.
  9. 9. 9 Encryption – Key Management with SSO S S O w i t h B o x c r y p t o r Pre-condition: The Company has a Key Management Service (KMS), because we need another entity to hold the “password key”. We cannot do it, because then we would be able to use it. Examples of key management services: • Amazon KMS • Azure Key Vault by Microsoft • Open Source KMS “Vault” by HashiCorp
  10. 10. 10 Encryption – Key Management with SSO S S O w i t h B o x c r y p t o r • Your KMS creates a user key for each user. • The KMS sends an ID of this key to Boxcryptor (to the device of the user). • On the device of the user, Boxcryptor creates a second, secure “password key”. • Boxcryptor sends this “password key” and the ID of the user key to the KMS. • The KMS encrypts the “password key” with the user key created earlier. Result: An encrypted version of the random “password key”. We will store this version and the ID on our server.
  11. 11. 11 What Happens When a User Signs in S S O w i t h B o x c r y p t o r • When a user attempts to sign in, the Boxcryptor client requests the encrypted “password key” and the ID from our server. It sends both to the KMS, which will return the “password key” to the client. • The “password key” is used to derive all other keys that Boxcryptor needs to encrypt files or manage permissions and groups. Result: Key management is handled only between the user’s device (client) and your KMS.
  12. 12. 12 What Happens When a User Signs in S S O w i t h B o x c r y p t o r (1) Request encrypted “password key” and ID from the Boxcryptor Server (2) & (3) Request and reception of the “password key“ via KMS
  13. 13. 13 Zero Knowledge SSO S S O w i t h B o x c r y p t o r An important factor for zero knowledge is that we do not have access to the company’s KMS. This can be achieved by: • Network access restriction: The KMS is only accessible within the company’s firewall. • Device Management System: The KMS configuration is not stored on our servers in plaintext, but encrypted with another key that we do not know: The key store key. Only in combination with this key, the KMS configuration can be read in order to access the KMS. The key store key is installed on the user’s device with a certificate, handed out by your company’s central device management system. Result: Only devices of the company can decrypt and encrypt files.
  14. 14. 14 Zero Knowledge: A Device Management System S S O w i t h B o x c r y p t o r (1) Reception of the key store key from the company‘s device management system via certificate (2) Request & reception of the encrypted KMSConfig. from the Boxcryptor server (3) Decryption of the KMSConfig. with the key store key on the user’s device: access to KMS
  15. 15. 15 Conclusion S S O w i t h B o x c r y p t o r • Pre-conditions for Boxcryptor SSO:  Identity Provider  Key Management Service  Device Management System (optional) • Standard SSO handles user authentication • Boxcryptor SSO handles zero knowledge encryption key management as well • This is achieved with a KMS and (optionally) a Device Management System
  16. 16. Thank you! Secomba GmbH Werner-von-Siemens-Str. 6 86159 Augsburg +49 821 907861-50 sales@boxcryptor.com