# US 12,003,488 B2 · Protecting cloud application secret key with multi-party computation algorithm > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,488 B2 - Document ID: US12003488B2 - Status: Granted - Kind: B2 - Application number: 16/950,314 - Filed: 2020-11-17 - Published: 2022-05-19 - Granted: 2024-06-04 - Earliest claimed: 2020-11-17 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Shashank Mohan Jain - Web page: https://patentgrep.com/patent/US12003488B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/0281: {Proxies} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 2101/663: Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems may be associated with a cloud computing environment. A proxy platform data store may contain node data associated with nodes of the cloud computing environment. Each node might, for example, store multi-party computation information. A proxy platform, able to access the proxy platform data store, may detect that a first node needs to access a cloud application secret key and determine, based on information in the proxy platform data store, a set of nodes associated with the secret key that the first node needs to access. The proxy platform may then use a multi-party computation algorithm and information received from the set of nodes to generate the secret key. ## Claims ### Claim 1 A system associated with a cloud computing environment, comprising: a proxy platform data store containing node data associated with nodes of the cloud computing environment, each node storing multi-party computation information including a partial password key, wherein each partial password key is generated as a mathematical part of a single password; and a proxy platform able to access the proxy platform data store, including: a computer processor, and computer memory, coupled to the computer processor, storing instructions that, when executed by the computer processor cause the processor to: (i) detect that a first node needs to access a cloud application secret key via receipt of a request from the first node including a first node partial password key, wherein each node stores a respective partial password key prior to the detection, (ii) determine, based on information in the proxy platform data store, a set of nodes associated with the cloud application secret key that the first node needs to access, (iii) generate the cloud application secret key in a secure enclave at the proxy platform, the generation via application of a multi-party computation algorithm to the multi-party computation information, the multi-party computation algorithm combining the multi-party computation information including the partial password keys received from each node in the set of nodes and the received first node partial password key; and (iv) store the generated cloud application secret key in the secure enclave at the proxy platform for some period and then evict the generated cloud application secret key. ### Claim 2 (depends on 1) The system of claim 1, wherein the secret key is associated with a cloud application password. ### Claim 3 (depends on 1) The system of claim 1, wherein the nodes are associated with at least one of (i) a virtual machine, and (ii) a container. ### Claim 4 (depends on 1) The system of claim 1, wherein the proxy platform executes on the first node. ### Claim 5 (depends on 1) The system of claim 1, wherein said detection is associated with a transmission control protocol proxy server that communicates via localhost. ### Claim 6 (depends on 1) The system of claim 1, wherein said detection comprises interception of an encrypted password request. ### Claim 7 (depends on 1) The system of claim 1, wherein multi-party computation information is stored in the secure enclave of each node. ### Claim 8 (depends on 7) The system of claim 7, wherein the secure enclaves are associated with at least one of: (i) a trusted execution environment, (ii) a software guard extension, (iii) a secure encrypted virtualization, and (iv) a similar enclaving technology. ### Claim 9 A computer-implemented method associated with a cloud computing environment, comprising: detecting, by a proxy platform, that a first node needs to access a cloud application secret key via receipt of a request from the first node including a first node partial password key, wherein each node stores a respective partial password key prior to the detection and each partial password key is generated as a mathematical part of a single password; determining, based on information in a proxy platform data store, a set of nodes associated with the cloud application secret key that the first node needs to access, wherein the proxy platform data store contains node data associated with nodes of the cloud computing environment, each node storing multi-party computation information; generating the cloud application secret key in a secure enclave at the proxy platform, the generation via application of a multi-party computation algorithm to the multi-party computation information, the multi-party computation algorithm combining the multi-party computation information including the partial password keys received from the set of nodes and the received first node partial password key; and storing the generated cloud application secret key in the secure enclave at the proxy platform for some period and then evicting the generated cloud application secret key. ### Claim 10 (depends on 9) The method of claim 9, wherein the secret key is associated with a cloud application password. ### Claim 11 (depends on 9) The method of claim 9, wherein the nodes are associated with at least one of (i) a virtual machine, and (ii) a container. ### Claim 12 (depends on 9) The method of claim 9, wherein the proxy platform executes on the first node. ### Claim 13 (depends on 9) The method of claim 9, wherein said detection is associated with a transmission control protocol proxy server that communicates via localhost. ### Claim 14 (depends on 9) The method of claim 9, wherein said detection comprises interception of an encrypted password request. ### Claim 15 (depends on 9) The method of claim 9, wherein multi-party computation information is stored in the secure enclave of each node. ### Claim 16 (depends on 15) The method of claim 15, wherein the secure enclaves are associated with at least one of: (i) a trusted execution environment, (ii) a software guard extension, (iii) a secure encrypted virtualization, and (iv) a similar enclaving technology. ### Claim 17 A non-transitory, computer readable medium having executable instructions stored therein that, when executed by a computer processor cause the processor to perform a method associated with a cloud computing environment, the method comprising: detecting, by a proxy platform, that a first node needs to access a cloud application secret key via receipt of a request from the first node including a first node partial password key, wherein each node stores a respective partial password key prior to the detection and each partial password key is generated as a mathematical part of a password; determining, based on information in a proxy platform data store, a set of nodes associated with the cloud application secret key that the first node needs to access, wherein the proxy platform data store contains node data associated with nodes of the cloud computing environment, each node storing multi-party computation information including a partial password key; generating the cloud application secret key in a secure enclave at the proxy platform, the generation via application of a multi-party computation algorithm to the multi-party computation information, the multi-party computation algorithm combining the multi-party computation information including the partial password keys received from the set of nodes and the received first node partial password key received with the request; and storing the generated cloud application secret key in the secure enclave at the proxy platform for some period and then evicting the generated cloud application secret key. ### Claim 18 (depends on 17) The medium of claim 17, wherein the secret key is associated with a cloud application password and the nodes are associated with at least one of (i) a virtual machine, and (ii) a container. ### Claim 19 (depends on 17) The medium of claim 17, wherein the proxy platform executes on the first node and said detection is associated with a transmission control protocol proxy server that communicates via localhost. ### Claim 20 (depends on 17) The medium of claim 17, wherein multi-party computation information is stored in the secure enclave of each node.