Attribute-based encryption for microservices

A system comprising:

• one or more processors;
• and
• a computer-readable medium comprising instructions stored therein, which when executed by the one or more processors, cause the one or more processors to:
• instantiate a first application service associated with a first attribute label and a second application service associated with a second attribute label in a cloud environment;
• generate a first key based on the first attribute label and a second key based on the second attribute label;
• associate a first data store with the first application service by encrypting the first data store with the first key, wherein the first application service is configured to access first data stored in the first data store through the first key based on the first attribute label;
• associate a second data store with the second application service by encrypting the second data store with the second key, wherein the second application service is configured to access second data stored in the second data store through the second key based on the second attribute label;
• and
• fill, based on the first attribute label, an application service request for the first application service from a client by providing the first application service access to the first data through the first key while refraining from providing the client access to the first data.

A non-transitory computer-readable storage medium comprising instructions stored therein, which when executed by one or more processors, cause the one or more processors to:

• instantiate a first application service associated with a first attribute label and a second application service associated with a second attribute label in a cloud environment;
• generate a first key based on the first attribute label and a second key based on the second attribute label;
• associate a first data store with the first application service by encrypting the first data store with the first key, wherein the first application service is configured to access first data stored in the first data store through the first key based on the first attribute label;
• associate a second data store with the second application service by encrypting the second data store with the second key, wherein the second application service is configured to access second data stored in the second data store through the second key based on the second attribute label;
• and
• fill, based on the first attribute label, an application service request for the first application service from a client by providing the first application service access to the first data through the first key while refraining from providing the client access to the first data.