Centralized volume encryption key management for edge devices with trusted platform modules

A method performed by instructions executed by at least one computing device, the method comprising:

• generating, by a management service, a volume encryption key for a gateway device that is associated with a gateway-specific account with the management service;
• storing, in the gateway-specific account, a predetermined platform configuration register (PCR) mask that is identified based on a particular gateway model of the gateway device, the predetermined PCR mask specifying at least one PCR that measures extractor code of the gateway device that unseals volume encryption keys;
• generating, by the management service, a sealing authorization policy based on the predetermined PCR mask and expected PCR values, wherein the management service identifies the predetermined PCR mask based on the gateway-specific account;
• and
• transmitting, from the management service to the gateway device, a command to seal the volume encryption key in a non-volatile memory of a trusted platform module (TPM) of the gateway device based on the predetermined PCR mask and the expected PCR values.

A non-transitory computer-readable medium comprising instructions executable by at least one computing device, wherein the instructions, when executed by at least one processor, cause the at least one computing device to at least:

• generate, by a management service, a volume encryption key for a gateway device that is associated with a gateway-specific account with the management service;
• store, in the gateway-specific account, a predetermined platform configuration register (PCR) mask that specifies at least one PCR that measures an extractor of the gateway device that unseals volume encryption keys;
• generate, by the management service, a sealing authorization policy based on the predetermined PCR mask and expected PCR values, wherein the management service identifies the predetermined PCR mask based on the gateway-specific account;
• and
• transmit, from the management service to the gateway device, a command to seal the volume encryption key in a non-volatile memory of a trusted platform module (TPM) of the gateway device based on the predetermined PCR mask and the expected PCR values.