Systems and methods of protecting secrets in use with containerized applications
AssigneeVisa International Service Association
InventorsMichael Joseph Quinlan, Ajit Gaddam, Rashmi Krishnan
Life of this patent
Estimating the term…
Abstract
Data encryption keys (and other sensitive data) can be secured during use by a key protection service that performs cryptographic operations on behalf of a client application. The key protection service can be implemented as a lightweight virtual machine that appears externally as a container and that can be executed in a secured environment. The lightweight virtual machine can include containerized processes to support an application program interface to interact with the client application and an attestation client to interact with a secured key storage system external to the secured environment.
Claims20
A method implemented in a virtual machine that executes program code in a processor of a computer system, the method comprising:
- receiving a request to access a data encryption key from a client app via an application program interface executing in the virtual machine;
- connecting to a key storage system via an attestation client executing in the virtual machine to request the data encryption key;
- receiving an attestation challenge from the key storage system;
- generating a response to the attestation challenge, wherein the response includes a data block generated by the processor based on the program code being executed in the virtual machine;
- sending the response to the key storage system;
- receiving the data encryption key from the key storage system;
- storing the data encryption key in a secured memory area of the virtual machine;
- and
- using the data encryption key to respond to a subsequent request received from the client app via the application program interface.
A computer-readable storage medium having stored therein program code instructions that, when executed by a processor of a computer system, cause the computer system to perform a method comprising:
- establishing a secure virtual machine in the computer system;
- executing an application program interface within the secure virtual machine;
- receiving a request to access a data encryption key from a client app via the application program interface;
- connecting to a key storage system via an attestation client executing in the virtual machine to request the data encryption key;
- receiving an attestation challenge from the key storage system;
- generating a response to the attestation challenge, wherein the response includes a data block generated by the processor based on the program code being executed in the virtual machine;
- sending the response to the key storage system;
- receiving the data encryption key from the key storage system;
- storing the data encryption key in a secured memory area of the virtual machine;
- and
- using the data encryption key to respond to a subsequent request received from the client app via the application program interface.
A system comprising:
- a secure memory to store program code and data;
- a communication interface to communicate with one or more client applications;
- and
- a processor coupled to the secure memory and configured to execute the stored program code,
- wherein the stored program code includes a virtual machine compatible with the Open Container Initiative and the virtual machine includes:
- a first module exposing an application program interface for a client application;
- a second module implementing a set of key-using functions that are invocable via the client application program interface;
- and
- a third module implementing an attestation client configured to communicate with a key storage system to request execution of key-management operations and to store, in the secure memory, one or more data encryption keys received from the key storage system responsive to execution of the key-management operation.
Dependencies are inferred from the claim text.