Attestation engine(s) for authenticating software deployment
AssigneeOracle International Corporation
InventorsDavid Benson Cross, Lee Scott Vorthman
Life of this patent
Estimating the term…
Abstract
Various embodiments of the present technology generally relate to systems and methods for providing an attestation engine for authenticating compliance of assets within software and cloud-based systems. In an example, a method may include identifying, by an attestation engine, a request to deploy one or more assets, determining, by the attestation engine, that the one or more assets are compliant with one or more policies, and generating, by the attestation engine, a token certifying that the one or more assets are compliant with the one or more policies. Once generated, the attestation engine may assign the token to the one or more assets and validate the one or more assets as compliant with the one or more policies based on the token.
Claims25
A computing apparatus comprising:
- a computer-readable storage medium;
- an attestation engine comprising processor-executable instructions stored on the computer-readable storage medium;
- and
- one or more processors coupled to the computer-readable storage medium and configured to execute the processor-executable instructions, wherein the processor-executable instructions, when executed by the one or more processors, direct the computing apparatus, to at least:
- identify a request to deploy an executable asset;
- receive an indication that the executable asset is compliant with one or more security policies;
- generate a token certifying compliance of the executable asset with the one or more security policies, wherein generating the token comprises performing a cryptographic hash operation over an asset identifier and a baseline configuration state of the executable asset;
- assign the token to the executable asset;
- validate the executable asset as compliant with the one or more security policies based on the token;
- monitor the executable asset during runtime to detect a technical configuration change affecting compliance with the one or more security policies;
- and
- in response to detecting the technical configuration change, initiate a security enforcement action comprising at least revoking the token.
A method comprising:
- identifying, by an attestation engine, a request to deploy one or more an executable asset;
- determining, by the attestation engine, that the one or more the executable asset is compliant with one or more security policies;
- generating, by the attestation engine, a token certifying compliance, that the executable asset are compliant with the one or more security policies, wherein generating the token comprises performing a cryptographic hash operation over an asset identifier and a baseline configuration state of the executable asset;
- assigning, by the attestation engine, the token to the one or more executable asset;
- validating, by the attestation engine, the executable asset based on the token;
- monitoring, by the attestation engine, the executable asset during runtime to detect a technical configuration change affecting compliance with the one or more security policies;
- and
- in response to detecting the technical configuration change, automatically initiating, by the attestation engine, a security enforcement action comprising at least revoking the token authenticating, by the attestation engine, the executable asset as compliant with the one or more security policies based on the token.
A computer-readable storage medium comprising processor-executable instructions, wherein the processor-executable instructions comprise an attestation engine configured to cause one or more processors to:
- identify a request to deploy an executable asset;
- receive an indication that the executable asset is compliant with one or more security policies;
- generate a token certifying compliance of the executable asset with the one or more security policies, wherein generating the token comprises performing a cryptographic hash operation over an asset identifier and a baseline configuration state of the executable asset;
- assign the token to the executable asset;
- validate the executable asset as compliant with the one or more security policies based on the token;
- monitor the executable asset during runtime to detect a technical configuration change affecting compliance with the one or more security policies;
- and
- in response to detecting the technical configuration change, initiate a security enforcement action comprising at least revoking the token.
A computing apparatus comprising:
- a computer-readable storage medium;
- processor-executable instructions stored on the computer-readable storage medium;
- and
- one or more processors coupled to the computer-readable storage medium and configured to execute the processor-executable instructions, wherein the processor-executable instructions, when executed by the one or more processors, direct the computing apparatus, to at least:
- receive a request to deploy an executable asset;
- determine a token associated with the executable asset;
- validate the executable asset based on the token;
- deploy the executable asset based on the token;
- in response to receiving a notification that the token has been revoked due to a technical configuration change detected during runtime of the executable asset, automatically prevent further execution of the executable asset.
Dependencies are inferred from the claim text.