Consider an application in which users will install on-premise agents which communicate with a cloud hosted service (aws in this case). The users can interact with the cloud service to configure and assign work to the on-premise agents.
The cloud service will be multi-tenant, and will store some sensitive customer data in the cloud. This data will be passed to the customer on-premise agents which will need to decrypt and use the data. The problem is how to ensure that sensitive data that we are storing cannot be read by us, the cloud provider or any other customer.
Our current thinking is that the customer will generate a public/private key pair, upload the public key to the cloud service, but keep the private key local so it will never enter our cloud infrastructure. So the public key can be used by the cloud service to encrypt data (or to encrypt a symmetric key which encrypts the data), but without the private key it cannot be decrypted.
The agents would obviously need access to the private key to decrypt the data, but it would not be possible for anyone to unencrypt the data in the cloud as the private key is stored with the customer
Does this sound like a reasonable approach?
These seems like a problem that should already have a solution, is there a library or cloud service that would help with this?
I've looked at AWS KMS but it doesn't seem to support a scenario that would prevent us from gaining access to the customer's data as we could assign ourselves a role that has access to their customer master key
EDIT: I'm still trying to get an understanding of this apologies if I'm not clear or fully understanding your answer.
To clarify, a user will be entering sensitive data such as passwords into a web application which will be cloud hosted. Client side encryption is an option, the cloud service doesn't ever need to see the data unencrypted.
Could we store the public key for each customer in the cloud, and have the browser make a request to retrieve that key (based on info from their auth token) when the user is required to enter sensitive data. Then encrypt on the browser before passing to the cloud service.
Again, the cloud service will only need to store this data and will never need to see it in it's decrypted form.
It will be required to pass the encrypted info to agents running outside of the cloud infrastructure which will need to use the decrypted data. So when setting up an agent we'd somehow need to register the private key with each agent so they can decrypt the data.