# US 2020/0403784 A1 · Cryptographic Key Orchestration Between Trusted Containers in a Multi-Node Cluster > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0403784 A1 - Document ID: US20200403784A1 - Status: Published application - Kind: A1 - Application number: 16/449,904 - Filed: 2019-06-24 - Published: 2020-12-24 - Earliest claimed: 2019-06-24 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Eduardo Rodriguez; Pratheek Karnati; Karunakar Bojjireddy - Web page: https://patentgrep.com/patent/US20200403784A1 ## CPC - H04L 9/0822: {using key encryption key} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Accessing shared sensitive information in a managed container environment is provided. Each worker node in a plurality of worker nodes has access to shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key. Each worker node in the plurality of worker nodes protects the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node. ## Claims ### Claim 1 A method for accessing shared sensitive information in a managed container environment, the method comprising: accessing, by each worker node in a plurality of worker nodes, shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key; and protecting, by each worker node in the plurality of worker nodes, the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node. ### Claim 2 (depends on 1) The method of claim 1 further comprising: establishing a first worker node in a cluster; generating, by the first worker node, the data encryption key; generating, by the first worker node, a first sealing key unique to the secure enclave on the first worker node for protecting the data encryption key; performing, by the first worker node, remote attestation with a second worker node in the cluster in response to creation of the second worker node in the cluster; and providing, by the first worker node, a copy of the data encryption key to the second worker node upon successful performance of the remote attestation. ### Claim 3 (depends on 2) The method of claim 2 further comprising: generating, by the second worker node, a second sealing key unique to the secure enclave on the second worker node for protecting the data encryption key by encrypting the data encryption key using the second sealing key. ### Claim 4 A system for accessing shared sensitive information in a managed container environment, the system comprising: a plurality of worker nodes, wherein: each worker node in the plurality of worker nodes accesses shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key; and each worker node in the plurality of worker nodes protects the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node. ### Claim 5 (depends on 4) The system of claim 4, wherein: a first worker node is established in a cluster; the first worker node generates the data encryption key; the first worker node generates a first sealing key unique to the secure enclave on the first worker node for protecting the data encryption key; the first worker node performs remote attestation with a second worker node in the cluster in response to creation of the second worker node in the cluster; and the first worker node provides a copy of the data encryption key to the second worker node upon successful performance of the remote attestation. ### Claim 6 (depends on 5) The system of claim 5, wherein: the second worker node generates a second sealing key unique to the secure enclave on the second worker node for protecting the data encryption key by encrypting the data encryption key using the second sealing key. ### Claim 7 A computer program product for accessing shared sensitive information in a managed container environment, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a set of processors to cause the set of processors to perform a method comprising: accessing, by each worker node in a plurality of worker nodes, shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key; and protecting, by each worker node in the plurality of worker nodes, the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node. ### Claim 8 (depends on 7) The computer program product of claim 7 further comprising: establishing a first worker node in a cluster; generating, by the first worker node, the data encryption key; generating, by the first worker node, a first sealing key unique to the secure enclave on the first worker node for protecting the data encryption key; performing, by the first worker node, remote attestation with a second worker node in the cluster in response to creation of the second worker node in the cluster; and providing, by the first worker node, a copy of the data encryption key to the second worker node upon successful performance of the remote attestation. ### Claim 9 (depends on 8) The computer program product of claim 8 further comprising: generating, by the second worker node, a second sealing key unique to the secure enclave on the second worker node for protecting the data encryption key by encrypting the data encryption key using the second sealing key. ### Claim 10 A computer-implemented method for cryptographic key orchestration, the computer-implemented method comprising: generating, by a set of processors, a first worker node with a first key orchestration agent in a cluster of an open source container orchestration framework; generating, by the set of processors, using the first key orchestration agent of the first worker node, a data encryption key; retrieving, by the set of processors, using the first key orchestration agent, a sealing key of the first key orchestration agent from a secure enclave of the first worker node; and sealing, by the set of processors, using the sealing key of the first key orchestration agent, the data encryption key ### Claim 11 (depends on 10) The computer-implemented method of claim 10 further comprising: determining, by the set of processors, whether a container has been created in the first worker node; and responsive to the set of processors determining that a container has been created in the first worker node, performing, by the set of processors, using the first key orchestration agent, local attestation with the container to establish authenticity of the container. ### Claim 12 (depends on 11) The computer-implemented method of claim 11 further comprising: determining, by the set of processors, whether the container is trusted based on the local attestation; and responsive to the set of processors determining that the container is untrusted based on the local attestation, denying, by the set of processors, access to the data encryption key by the container. ### Claim 13 (depends on 12) The computer-implemented method of claim 12 further comprising: responsive to the set of processors determining that the container is trusted based on the local attestation, sharing, by the set of processors, using the first key orchestration agent, the data encryption key with the container; encrypting, by the set of processors, using the data encryption key shared with the container, data corresponding to a workload of the container; and storing, by the set of processors, an identifier of the first worker node and the data encryption key sealed with a unique sealing key of the container in a shared database. ### Claim 14 (depends on 10) The computer-implemented method of claim 10 further comprising: generating, by the set of processors, a second worker node with a second key orchestration agent within the cluster; and performing, by the set of processors, using the second key orchestration agent of the second worker node, remote attestation with the first key orchestration agent of the first worker node to establish authenticity of the second key orchestration agent. ### Claim 15 (depends on 14) The computer-implemented method of claim 14 further comprising: determining, by the set of processors, whether the second key orchestration agent is trusted based on the remote attestation; and responsive to the set of processors determining that the second key orchestration agent is untrusted based on the remote attestation, denying, by the set of processors, access to the data encryption key of the first key orchestration agent by the second key orchestration agent. ### Claim 16 (depends on 15) The computer-implemented method of claim 15 further comprising: responsive to the set of processors determining that the second key orchestration agent is trusted based on the remote attestation, sharing, by the set of processors, using the first key orchestration agent of the first worker node, the data encryption key of the first key orchestration agent with the second key orchestration agent; retrieving, by the set of processors, using the second key orchestration agent, a unique sealing key of the second key orchestration agent from a secure enclave of the second worker node; and sealing, by the set of processors, using the unique sealing key of the second key orchestration agent, the data encryption key. ### Claim 17 (depends on 10) The computer-implemented method of claim 10, wherein sensitive application data is only shared among trusted containers, even when containers move within the cluster. ### Claim 18 (depends on 17) The computer-implemented method of claim 17, wherein the sensitive application data is protected in any form of storage. ### Claim 19 A computer program product for cryptographic key orchestration, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a set of processors to cause the set of processors to perform a method comprising: generating, by the set of processors, a first worker node with a first key orchestration agent in a cluster of an open source container orchestration framework; generating, by the set of processors, using the first key orchestration agent of the first worker node, a data encryption key; retrieving, by the set of processors, using the first key orchestration agent, a sealing key of the first key orchestration agent from a secure enclave of the first worker node; and sealing, by the set of processors, using the sealing key of the first key orchestration agent, the data encryption key ### Claim 20 (depends on 19) The computer program product of claim 19 further comprising: determining, by the set of processors, whether a container has been created in the first worker node; and responsive to the set of processors determining that a container has been created in the first worker node, performing, by the set of processors, using the first key orchestration agent, local attestation with the container to establish authenticity of the container. ### Claim 21 (depends on 20) The computer program product of claim 20 further comprising: determining, by the set of processors, whether the container is trusted based on the local attestation; and responsive to the set of processors determining that the container is untrusted based on the local attestation, denying, by the set of processors, access to the data encryption key by the container. ### Claim 22 (depends on 21) The computer program product of claim 21 further comprising: responsive to the set of processors determining that the container is trusted based on the local attestation, sharing, by the set of processors, using the first key orchestration agent, the data encryption key with the container; encrypting, by the set of processors, using the data encryption key shared with the container, data corresponding to a workload of the container; and storing, by the set of processors, an identifier of the first worker node and the data encryption key sealed with a unique sealing key of the container in a shared database. ### Claim 23 (depends on 19) The computer program product of claim 19 further comprising: generating, by the set of processors, a second worker node with a second key orchestration agent within the cluster; and performing, by the set of processors, using the second key orchestration agent of the second worker node, remote attestation with the first key orchestration agent of the first worker node to establish authenticity of the second key orchestration agent. ### Claim 24 (depends on 23) The computer program product of claim 23 further comprising: determining, by the set of processors, whether the second key orchestration agent is trusted based on the remote attestation; and responsive to the set of processors determining that the second key orchestration agent is untrusted based on the remote attestation, denying, by the set of processors, access to the data encryption key of the first key orchestration agent by the second key orchestration agent. ### Claim 25 (depends on 24) The computer program product of claim 24 further comprising: responsive to the set of processors determining that the second key orchestration agent is trusted based on the remote attestation, sharing, by the set of processors, using the first key orchestration agent of the first worker node, the data encryption key of the first key orchestration agent with the second key orchestration agent; retrieving, by the set of processors, using the second key orchestration agent, a unique sealing key of the second key orchestration agent from a secure enclave of the second worker node; and sealing, by the set of processors, using the unique sealing key of the second key orchestration agent, the data encryption key.