# US 10,771,252 B1 · Data center security services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,252 B1 - Document ID: US10771252B1 - Status: Granted - Kind: B1 - Application number: 16/006,458 - Filed: 2018-06-12 - Granted: 2020-09-08 - Earliest claimed: 2018-06-12 - Assignees: Equinix, Inc. - Applicants: Equinix, Inc. - Inventors: Juxiang Teng; Muhammad Durrani; Imam Sheikh; Lance Weaver; Brian J. Lillie - Web page: https://patentgrep.com/patent/US10771252B1 ## CPC - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/72: in cryptographic circuits - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/14: using a plurality of keys or algorithms - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract This disclosure describes techniques for securely, efficiently, and/or effectively providing cryptographic operations and key management services. Systems in accordance with one or more aspects of the present disclosure may provide secure management of cryptographic keys as service to a plurality of data center users or customers that contract for services provided by a data center. In one example, this disclosure describes a data center comprising a plurality of cloud service provider ports, a plurality of customer ports, network infrastructure coupling the plurality of cloud service provider ports to the plurality of customer ports, and a computing system including at least one hardware security module. ## Claims ### Claim 1 A data center comprising: a plurality of cloud service provider ports, each coupled over a private connection to a different one of a plurality of cloud service provider networks, wherein the plurality of cloud service provider networks includes a first cloud service provider network and a second cloud service provider network; network infrastructure coupling the plurality of cloud service provider ports; and a computing system including at least one hardware security module, wherein the computing system is deployed within the data center and is connected to the network infrastructure, and wherein the computing system is configured to: authenticate, based on input received over a plurality of customer ports, each of a plurality of customers to access services provided by the at least one hardware security module, including a first customer and a second customer; generate, by interacting with the at least one hardware security module, a plurality of cryptographic keys, including a first cryptographic key associated with the first customer and a second cryptographic key associated with the second customer, wherein each of the plurality of cryptographic keys are generated and stored securely within the at least one hardware security module without disclosure outside of the at least one hardware security module, enforce restrictions on use of the plurality of cryptographic keys, including preventing use of the first cryptographic key by the second customer and preventing use of the second cryptographic key by the first customer, access a first set of customer data, generate a first set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the first set of customer data using the first cryptographic key, output the first set of processed data over at least one of the plurality of cloud service provider ports to the first cloud service provider network, access a second set of customer data, generate a second set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the second set of customer data using the second cryptographic key, and output the second set of processed data over at least one of the plurality of cloud service provider ports to the second cloud provider network. ### Claim 2 (depends on 1) The data center of claim 1, wherein: the plurality of customer ports, each of the customer ports coupled to a computing device operated by one of a plurality of customers of data center services, including the first customer operating a first computing device, and the second customer operating a second computing device; and wherein the network infrastructure further couples the plurality of cloud service provider ports to the plurality of customer ports. ### Claim 3 (depends on 1) The data center of claim 1, wherein to generate the first set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the first set of customer data, the computing system is configured to cause the at least one hardware security module to perform an encryption operation on the first set of customer data using the first cryptographic key. ### Claim 4 (depends on 3) The data center of claim 3, wherein the first set of processed data is a first set of encrypted data; and wherein the computing system is further configured to: access, over at least one of the plurality of cloud service provider ports, encrypted data stored within first cloud service provider network, wherein the encrypted data includes at least a portion of the first set of encrypted data; generate decrypted data by causing the at least one hardware security module to decrypt the encrypted data using the first cryptographic key; process the decrypted data to generate new data; and output the new data over at least one of the plurality of cloud service provider ports to the second cloud provider network. ### Claim 5 (depends on 4) The data center of claim 4, wherein to process the decrypted data to generate the new data, the computing system is further configured to: generate the new data by causing the at least one hardware security module to encrypt the decrypted data using the first cryptographic key. ### Claim 6 (depends on 1) The data center of claim 1, wherein to generate the first set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the first set of customer data, the computing system is configured to cause the at least one hardware security module to perform, on the first set of customer data using the first cryptographic key, at least one of: an encryption operation; a decryption operation; a signing operation; and a verifying operation. ### Claim 7 (depends on 2) The data center of claim 2, wherein to access the first set of customer data, the computing system is further configured to: access the first set of customer data from the first computing device. ### Claim 8 (depends on 1) The data center of claim 1, wherein to access the first set of customer data, the computing system is further configured to: access the first set of customer data from a computing device within the data center. ### Claim 9 (depends on 1) The data center of claim 1, wherein to access the first set of customer data, the computing system is further configured to: access the first set of customer data over the private connection to the second cloud service provider network. ### Claim 10 (depends on 2) The data center of claim 2, wherein at least one of the first computing device and the second computing device is coupled to the plurality of customer ports through a network service provider. ### Claim 11 (depends on 1) The data center of claim 1, wherein the computing system is further configured to: provide cryptographic key management services to each of the plurality of customers, wherein the cryptographic key management services include capabilities for performing at least one of: cryptographic key creation, cryptographic key deletion, cryptographic key sharing, cryptographic key importing, and cryptographic key exporting. ### Claim 12 (depends on 1) The data center of claim 1, wherein the cryptographic keys are symmetric encryption keys. ### Claim 13 (depends on 1) The data center of claim 1, wherein the cryptographic keys are private encryption keys for use in a public key encryption system. ### Claim 14 (depends on 1) The data center of claim 1, wherein the at least one hardware security module is a plurality of hardware security modules, and wherein each of the plurality of hardware security modules is configured to provide cryptographic key services to more than one of the plurality of customers. ### Claim 15 (depends on 2) The data center of claim 2, wherein the first computing device is included within a first customer network, and wherein the network infrastructure further includes a virtual circuit connecting the first customer network with the first cloud service provider network. ### Claim 16 A method comprising: authenticating, by a computing system within a data center and based on input received over a plurality of customer ports, each of a plurality of customers to access services provided by at least one hardware security module included within the computing system, including a first customer and a second customer; generating, by the at least one hardware security module, a plurality of cryptographic keys, including a first cryptographic key associated with the first customer and a second cryptographic key associated with the second customer, wherein each of the plurality of cryptographic keys are generated and stored securely within the at least one hardware security module without disclosure outside of the at least one hardware security module; enforcing, by the computing system, restrictions on use of the plurality of cryptographic keys, including preventing use of the first cryptographic key by the second customer and preventing use of the second cryptographic key by the first customer; accessing, by the computing system and based on input received from a computing device operated by the first customer, a first set of customer data; generating, by the computing system, a first set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the first set of customer data using the first cryptographic key; outputting, by the computing system, the first set of processed data over a private connection to a first cloud service provider network; accessing, by the computing system and based on input received from a computing device operated by the second customer, a second set of customer data; generating, by the computing system, a second set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the second set of customer data using the second cryptographic key; and outputting, by the computing system, the second set of processed data over a private connection to a second cloud service provider network. ### Claim 17 (depends on 16) The method of claim 16, wherein generating the first set of processed data includes performing an encryption operation on the first set of customer data using the first cryptographic key, and wherein the method further comprises: accessing, by the computing system, encrypted data over the private connection to the first cloud service provider network, wherein the encrypted data includes at least a portion of the first set of encrypted data; generating, by the computing system, decrypted data by causing the at least one hardware security module to decrypt the encrypted data using the first cryptographic key; processing, by the computing system, the decrypted data to generate new data; and outputting, by the computing system, the new data over the private connection to the second cloud provider network. ### Claim 18 (depends on 17) The method of claim 17, wherein processing the decrypted data to generate the new data includes: generating the new data by causing the at least one hardware security module to encrypt the decrypted data using the first cryptographic key. ### Claim 19 A non-transitory computer-readable storage medium comprising instructions that, when executed, configure processing circuitry of a computing system within a data center to: authenticate, based on input received over a plurality of customer ports, each of a plurality of customers to access services provided by at least one hardware security module included within the computing system, including a first customer and a second customer; generate, by the at least one hardware security module, a plurality of cryptographic keys, including a first cryptographic key associated with the first customer and a second cryptographic key associated with the second customer, wherein each of the plurality of cryptographic keys are generated and stored securely within the at least one hardware security module without disclosure outside of the at least one hardware security module; enforce restrictions on use of the plurality of cryptographic keys, including preventing use of the first cryptographic key by the second customer and preventing use of the second cryptographic key by the first customer; access, based on input received from a computing device operated by the first customer, a first set of customer data; generate a first set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the first set of customer data using the first cryptographic key; output the first set of processed data over a private connection to a first cloud service provider network; access, based on input received from a computing device operated by the second customer, a second set of customer data; generate a second set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the second set of customer data using the second cryptographic key; and output the second set of processed data over a private connection to a second cloud service provider network.