Cryptographic Key Orchestration Between Trusted Containers in a Multi-Node Cluster
AssigneeInternational Business Machines Corporation
InventorsEduardo Rodriguez, Pratheek Karnati, Karunakar Bojjireddy
Life of this patent
Estimating the term…
Abstract
Accessing shared sensitive information in a managed container environment is provided. Each worker node in a plurality of worker nodes has access to shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key. Each worker node in the plurality of worker nodes protects the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node.
Claims25
A method for accessing shared sensitive information in a managed container environment, the method comprising:
- accessing, by each worker node in a plurality of worker nodes, shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key;
- and
- protecting, by each worker node in the plurality of worker nodes, the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node.
A system for accessing shared sensitive information in a managed container environment, the system comprising:
- a plurality of worker nodes, wherein:
- each worker node in the plurality of worker nodes accesses shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key;
- and
- each worker node in the plurality of worker nodes protects the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node.
A computer program product for accessing shared sensitive information in a managed container environment, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a set of processors to cause the set of processors to perform a method comprising:
- accessing, by each worker node in a plurality of worker nodes, shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key;
- and
- protecting, by each worker node in the plurality of worker nodes, the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node.
A computer-implemented method for cryptographic key orchestration, the computer-implemented method comprising:
- generating, by a set of processors, a first worker node with a first key orchestration agent in a cluster of an open source container orchestration framework;
- generating, by the set of processors, using the first key orchestration agent of the first worker node, a data encryption key;
- retrieving, by the set of processors, using the first key orchestration agent, a sealing key of the first key orchestration agent from a secure enclave of the first worker node;
- and
- sealing, by the set of processors, using the sealing key of the first key orchestration agent, the data encryption key
A computer program product for cryptographic key orchestration, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a set of processors to cause the set of processors to perform a method comprising:
- generating, by the set of processors, a first worker node with a first key orchestration agent in a cluster of an open source container orchestration framework;
- generating, by the set of processors, using the first key orchestration agent of the first worker node, a data encryption key;
- retrieving, by the set of processors, using the first key orchestration agent, a sealing key of the first key orchestration agent from a secure enclave of the first worker node;
- and
- sealing, by the set of processors, using the sealing key of the first key orchestration agent, the data encryption key
Dependencies are inferred from the claim text.