Question

I am working on a HIPAA cloud project and am implementing a Key Store as a central repository for all of the key pairs for PHI(Private Health Information) encryption… I am not worried about the actual data because it will be encrypted at rest and in transit.

However when a worker or webrole needs to work with the data they need to decrypt and reencrypt it (if they do updates). That’s where the key Store comes into play. However, I don’t want this internal service exposed and I also need it to be SSLed, because sending keys in the clear, even inside a virtual network of roles wouldn’t pass a security audit.

So any suggestions on how I can get a web or worker role to use SSL with an internal endpoint?

Thanks

Answer 1

I don’t think you can. Internal endpoints are on a closed network branch, so https would normally be redundant (although I understand your compliance issues). I found this answer (to my question) very useful in figuring out the security of internal endpoints: How secure are Windows Azure internal endpoints? – see the more detailed post that Brent links to.