We are building a data processing platform on Amazon AWS. We are going to store sensitive data in the S3 (encrypted) and then the Amazon EC2 node is going to be utilized to process this data. We are planning to use hybrid encryption for the S3 data i.e. using symmetric Data Encryption Keys (DEK) & asymmetric Key Encryption Keys (KEK) & it will be done on client side before uploading the data to S3. The encrypted DEK will be stored with S3 object in metadata The are going to be group of datasets & the keys will be different for these datasets.
We are planning to build a small KMS system which can distribute keys to the EC2 nodes when they are going to process the data to decrypt it. The KMS will be hosted on our premises and the transfer of the keys will be on VPN.
The question we are having is regarding the most suitable Key Distribution Protocol to build to distribute the keys to EC2 nodes. We are considering building a webservice using REST/SSL to distribute the keys however since there are no WS-Security spec available for REST, we feel only REST/SSL will not suffice.
- What can be additional implementation to tighten security?
- What are ways to authenticate/provision the EC2 node when it calls the REST webservice that it is spawned by us?
- What is most suitable - passing encrypted DEK to webservice & getting decrypted DEK vs simply getting KEK from the webservice & using it to decrypt DEK to decrypt the data?
- Any additional points to consider?