Protecting cloud application secret key with multi-party computation algorithm

A computer-implemented method associated with a cloud computing environment, comprising:

• detecting, by a proxy platform, that a first node needs to access a cloud application secret key via receipt of a request from the first node including a first node partial password key, wherein each node stores a respective partial password key prior to the detection and each partial password key is generated as a mathematical part of a single password;
• determining, based on information in a proxy platform data store, a set of nodes associated with the cloud application secret key that the first node needs to access, wherein the proxy platform data store contains node data associated with nodes of the cloud computing environment, each node storing multi-party computation information;
• generating the cloud application secret key in a secure enclave at the proxy platform, the generation via application of a multi-party computation algorithm to the multi-party computation information, the multi-party computation algorithm combining the multi-party computation information including the partial password keys received from the set of nodes and the received first node partial password key;
• and
• storing the generated cloud application secret key in the secure enclave at the proxy platform for some period and then evicting the generated cloud application secret key.

A non-transitory, computer readable medium having executable instructions stored therein that, when executed by a computer processor cause the processor to perform a method associated with a cloud computing environment, the method comprising:

• detecting, by a proxy platform, that a first node needs to access a cloud application secret key via receipt of a request from the first node including a first node partial password key, wherein each node stores a respective partial password key prior to the detection and each partial password key is generated as a mathematical part of a password;
• determining, based on information in a proxy platform data store, a set of nodes associated with the cloud application secret key that the first node needs to access, wherein the proxy platform data store contains node data associated with nodes of the cloud computing environment, each node storing multi-party computation information including a partial password key;
• generating the cloud application secret key in a secure enclave at the proxy platform, the generation via application of a multi-party computation algorithm to the multi-party computation information, the multi-party computation algorithm combining the multi-party computation information including the partial password keys received from the set of nodes and the received first node partial password key received with the request;
• and
• storing the generated cloud application secret key in the secure enclave at the proxy platform for some period and then evicting the generated cloud application secret key.