Systems and methods of protecting secrets in use with containerized applications
AssigneeVisa International Service Association
InventorsMichael Joseph Quinlan, Ajit Gaddam, Rashmi Krishnan
Life of this patent
Estimating the term…
Abstract
Data encryption keys (and other sensitive data) can be secured during use by a key protection service that performs cryptographic operations on behalf of a client application. The key protection service can be implemented as a lightweight virtual machine that appears externally as a container and that can be executed in a secured environment. The lightweight virtual machine can include containerized processes to support an application program interface to interact with the client application and an attestation client to interact with a secured key storage system external to the secured environment.
Claims18
A method implemented in a virtual machine that executes program code in a processor of a computer system, the method comprising:
- receiving a request to access a data encryption key from a client app via an application program interface executing in the virtual machine;
- establishing a secure connection between a key storage system and an attestation client executing in the virtual machine;
- requesting, by the attestation client, via the secure connection, the data encryption key from the key storage system;
- receiving, by the attestation client, via the secure connection, an attestation challenge from the key storage system;
- generating, by the attestation client, a response to the attestation challenge, wherein the response includes a data block generated by the processor based on the program code being executed in the virtual machine;
- sending, by the attestation client, via the secure connection, the response to the key storage system;
- receiving, via the secure connection, the data encryption key from the key storage system;
- storing the data encryption key in a secured memory area of the virtual machine;
- and
- using the data encryption key to respond to a subsequent request received from the client app via the application program interface.
A computer-readable storage medium having stored therein program code instructions that, when executed by a processor of a computer system, cause the computer system to perform a method comprising:
- establishing a secure virtual machine in the computer system;
- executing an application program interface within the secure virtual machine;
- receiving a request to access a data encryption key from a client app via the application program interface;
- establishing a secure connection to a key storage system by an attestation client executing in the virtual machine;
- requesting the data encryption key by the attestation client via the secure connection;
- receiving, by the attestation client, an attestation challenge from the key storage system via the secure connection;
- generating, by the attestation client, a response to the attestation challenge, wherein the response includes a data block generated by the processor based on the program code being executed in the virtual machine;
- sending, by the attestation client, via the secure connection, the response to the key storage system;
- receiving, via the secure connection, the data encryption key from the key storage system;
- storing the data encryption key in a secured memory area of the virtual machine;
- and
- using the data encryption key to respond to a subsequent request received from the client app via the application program interface.
A system comprising:
- a secure memory to store program code and data;
- a communication interface to communicate with one or more client applications;
- and
- a processor coupled to the secure memory and configured to execute the stored program code,
- wherein the stored program code includes a virtual machine compatible with the Open Container Initiative and the virtual machine includes:
- a first module exposing an application program interface for a client application;
- a second module implementing a set of key-using functions that are invocable via the client application program interface;
- and
- a third module implementing an attestation client configured to establish a secure connection with a key storage system to request execution of key-management operations;
- to receive and respond to attestation challenges from the key storage system, wherein the response to each attestation challenge includes an attestation report comprising a data block generated by the processor based on the program code being executed in the virtual machine;
- and to store, in the secure memory, one or more data encryption keys received from the key storage system responsive to execution of the key-management operation.
Dependencies are inferred from the claim text.