JP7486530B2 - 管理されたコンテナ環境における共有機密情報へのアクセス方法、システム、プログラム - Google Patents

管理されたコンテナ環境における共有機密情報へのアクセス方法、システム、プログラム Download PDF

Info

Publication number
JP7486530B2
JP7486530B2 JP2021575206A JP2021575206A JP7486530B2 JP 7486530 B2 JP7486530 B2 JP 7486530B2 JP 2021575206 A JP2021575206 A JP 2021575206A JP 2021575206 A JP2021575206 A JP 2021575206A JP 7486530 B2 JP7486530 B2 JP 7486530B2
Authority
JP
Japan
Prior art keywords
key
worker node
data encryption
encryption key
container
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
JP2021575206A
Other languages
English (en)
Japanese (ja)
Other versions
JP2022537739A5 (cg-RX-API-DMAC7.html
JP2022537739A (ja
Inventor
ロドリゲス、エドアルド
カルナティ、パラテーク
ボッジレッディ、カルナカール
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
International Business Machines Corp
Original Assignee
International Business Machines Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by International Business Machines Corp filed Critical International Business Machines Corp
Publication of JP2022537739A publication Critical patent/JP2022537739A/ja
Publication of JP2022537739A5 publication Critical patent/JP2022537739A5/ja
Application granted granted Critical
Publication of JP7486530B2 publication Critical patent/JP7486530B2/ja
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)
JP2021575206A 2019-06-24 2020-06-10 管理されたコンテナ環境における共有機密情報へのアクセス方法、システム、プログラム Active JP7486530B2 (ja)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US16/449,904 US11044080B2 (en) 2019-06-24 2019-06-24 Cryptographic key orchestration between trusted containers in a multi-node cluster
US16/449,904 2019-06-24
PCT/EP2020/066133 WO2020260026A1 (en) 2019-06-24 2020-06-10 Cryptographic key orchestration between trusted containers in a multi-node cluster

Publications (3)

Publication Number Publication Date
JP2022537739A JP2022537739A (ja) 2022-08-29
JP2022537739A5 JP2022537739A5 (cg-RX-API-DMAC7.html) 2022-11-22
JP7486530B2 true JP7486530B2 (ja) 2024-05-17

Family

ID=71094329

Family Applications (1)

Application Number Title Priority Date Filing Date
JP2021575206A Active JP7486530B2 (ja) 2019-06-24 2020-06-10 管理されたコンテナ環境における共有機密情報へのアクセス方法、システム、プログラム

Country Status (12)

Country Link
US (1) US11044080B2 (cg-RX-API-DMAC7.html)
EP (1) EP3987712B1 (cg-RX-API-DMAC7.html)
JP (1) JP7486530B2 (cg-RX-API-DMAC7.html)
KR (1) KR102726547B1 (cg-RX-API-DMAC7.html)
CN (1) CN113826352A (cg-RX-API-DMAC7.html)
AU (1) AU2020305390B2 (cg-RX-API-DMAC7.html)
BR (1) BR112021026146A2 (cg-RX-API-DMAC7.html)
CA (1) CA3143383A1 (cg-RX-API-DMAC7.html)
IL (1) IL288689B2 (cg-RX-API-DMAC7.html)
MX (1) MX2021015223A (cg-RX-API-DMAC7.html)
SG (1) SG11202110433SA (cg-RX-API-DMAC7.html)
WO (1) WO2020260026A1 (cg-RX-API-DMAC7.html)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021056069A1 (en) * 2019-09-25 2021-04-01 Commonwealth Scientific And Industrial Research Organisation Cryptographic services for browser applications
US11354151B2 (en) * 2020-02-12 2022-06-07 International Business Machines Corporation Hardware memory encryption and protection for containers
US11494219B2 (en) * 2020-02-26 2022-11-08 Red Hat, Inc. Encryption and remote attestation of containers
US20240022423A1 (en) * 2021-03-12 2024-01-18 Meta Platforms, Inc. Processing private information in a distributed enclave framework
US11995197B2 (en) * 2021-07-27 2024-05-28 International Business Machines Corporation Sensitive data encryption
WO2023038817A1 (en) * 2021-09-08 2023-03-16 Thales Dis Cpl Usa, Inc. Extension of functionality to filesystems in container orchestration systems
US12041164B2 (en) 2021-09-10 2024-07-16 International Business Machines Corporation Encryption key hybrid deployment management
US12316765B2 (en) * 2023-05-10 2025-05-27 Google Llc Untrusted multi-party compute system
JPWO2024252681A1 (cg-RX-API-DMAC7.html) * 2023-06-09 2024-12-12
US20250062898A1 (en) * 2023-08-14 2025-02-20 Ally Financial Inc. Techniques for secret synchronization and management across multiple clusters
US12602502B2 (en) * 2023-10-13 2026-04-14 Privafy Inc System and method for providing trustworthy access enforcement to microservice container images on orchestration platforms
US12587838B2 (en) 2023-10-19 2026-03-24 International Business Machines Corporation Encrypted end-to-end messaging using near-field communication (NFC) tags

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2012530961A (ja) 2009-12-22 2012-12-06 インテル・コーポレーション セキュアなアプリケーションの実行を提供する方法および装置
US20140108805A1 (en) 2012-10-12 2014-04-17 Ned M. Smith Technologies labeling diverse content
WO2019081348A1 (en) 2017-10-25 2019-05-02 International Business Machines Corporation VIRTUALIZATION OF CONTROL PLANE FUNCTION BASED ON A SECURE PROCESSOR IN CLOUD SYSTEMS

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7421741B2 (en) 2003-10-20 2008-09-02 Phillips Ii Eugene B Securing digital content system and method
KR100904549B1 (ko) * 2007-10-22 2009-06-25 성균관대학교산학협력단 이동 에이전트에 상응하여 링 토폴로지 형성 방법 및 그시스템
EP2874093A1 (en) * 2013-11-13 2015-05-20 Gemalto SA Method to protect a set of sensitive data associated to public data in a secured container
US9461821B1 (en) * 2014-06-30 2016-10-04 Emc Corporation System and method for key material protection on devices using a secret sharing scheme
WO2017034642A2 (en) * 2015-06-05 2017-03-02 Nutanix, Inc. Optimizable full-path encryption in a virtualization environment
US10534724B2 (en) * 2015-12-24 2020-01-14 Intel Corporation Instructions and logic to suspend/resume migration of enclaves in a secure enclave page cache
US10523427B2 (en) * 2016-01-11 2019-12-31 Dell Products L.P. Systems and methods for management controller management of key encryption key
US11063980B2 (en) * 2016-02-26 2021-07-13 Fornetix Llc System and method for associating encryption key management policy with device activity
US10326744B1 (en) * 2016-03-21 2019-06-18 EMC IP Holding Company LLC Security layer for containers in multi-tenant environments
US10498726B2 (en) * 2016-03-22 2019-12-03 International Business Machines Corporation Container independent secure file system for security application containers
CN107959567B (zh) * 2016-10-14 2021-07-27 阿里巴巴集团控股有限公司 数据存储方法、数据获取方法、装置及系统
US11165565B2 (en) * 2016-12-09 2021-11-02 Microsoft Technology Licensing, Llc Secure distribution private keys for use by untrusted code
US11438155B2 (en) * 2017-01-24 2022-09-06 Microsoft Technology Licensing, Llc Key vault enclave
US10567359B2 (en) 2017-07-18 2020-02-18 International Business Machines Corporation Cluster of secure execution platforms
US10554634B2 (en) * 2017-08-18 2020-02-04 Intel Corporation Techniques for shared private data objects in a trusted execution environment
US10776459B2 (en) * 2017-12-07 2020-09-15 International Business Machines Corporation Facilitating build and deploy runtime memory encrypted cloud applications and containers
US11388272B2 (en) * 2018-03-30 2022-07-12 Intel Corporation Technologies for network packet processing between cloud and telecommunications networks
US10884814B2 (en) * 2018-09-28 2021-01-05 Intel Corporation Mobile edge-cloud security infrastructure
US11048800B2 (en) * 2018-12-17 2021-06-29 Intel Corporation Composable trustworthy execution environments

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2012530961A (ja) 2009-12-22 2012-12-06 インテル・コーポレーション セキュアなアプリケーションの実行を提供する方法および装置
US20140108805A1 (en) 2012-10-12 2014-04-17 Ned M. Smith Technologies labeling diverse content
WO2019081348A1 (en) 2017-10-25 2019-05-02 International Business Machines Corporation VIRTUALIZATION OF CONTROL PLANE FUNCTION BASED ON A SECURE PROCESSOR IN CLOUD SYSTEMS

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
阿佐 志保 ほか，なぜプログラマの役に立つのか いまはじめるＤｏｃｋｅｒ ～コンテナ技術を身につける～ 第２章，ＳｏｆｔｗａｒｅＤｅｓｉｇｎ，日本，（株）技術評論社，2017年02月18日，通巻３８２号（発刊３１６号） ，pp. 24-29

Also Published As

Publication number Publication date
CN113826352A (zh) 2021-12-21
IL288689B2 (en) 2024-06-01
EP3987712B1 (en) 2025-07-23
US11044080B2 (en) 2021-06-22
CA3143383A1 (en) 2020-12-30
US20200403784A1 (en) 2020-12-24
KR102726547B1 (ko) 2024-11-06
EP3987712A1 (en) 2022-04-27
MX2021015223A (es) 2022-01-18
IL288689A (en) 2022-02-01
JP2022537739A (ja) 2022-08-29
AU2020305390B2 (en) 2023-07-13
KR20220002616A (ko) 2022-01-06
IL288689B1 (en) 2024-02-01
SG11202110433SA (en) 2021-10-28
WO2020260026A1 (en) 2020-12-30
AU2020305390A1 (en) 2021-10-14
BR112021026146A2 (pt) 2022-02-08

Similar Documents

Publication Publication Date Title
JP7486530B2 (ja) 管理されたコンテナ環境における共有機密情報へのアクセス方法、システム、プログラム
US20220292180A1 (en) Systems and methods for offline usage of saas applications
US11558484B2 (en) Systems and methods for secure peer-to-peer caching
US11647025B2 (en) Systems and methods for continuous authentication
US10097544B2 (en) Protection and verification of user authentication credentials against server compromise
US12095822B2 (en) Systems and methods for responsible intermediation of privacy policies
US10157290B1 (en) Systems and methods for encrypting files
US10686586B2 (en) Re-encrypting data on a hash chain
CN111954879B (zh) 互不信任的飞地
CN117693749A (zh) 敏感数据加密
US11550448B2 (en) Systems and methods for intellisense for SaaS application
CN116745766A (zh) 安全存储器共享
US12088697B1 (en) Systems and methods for protecting the security of authentication credentials utilized to access sensitive data during online transactions
US20230396434A1 (en) Multi-party computation framework based on trusted execution environment
US11228583B2 (en) Systems and methods for slogan based sharing of living SaaS objects
US20250310093A1 (en) Blind secret management and rotation
US20250245360A1 (en) Systems and Methods for Enabling Secured Communications Between Non-Quantum Equipped Devices and Quantum Equipped Devices
US20250322396A1 (en) Encrypted subnets and secure containers
US20260067083A1 (en) Secure token exchange for automated systems

Legal Events

Date Code Title Description
RD04 Notification of resignation of power of attorney

Free format text: JAPANESE INTERMEDIATE CODE: A7424

Effective date: 20220512

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A523

Effective date: 20221014

A621 Written request for application examination

Free format text: JAPANESE INTERMEDIATE CODE: A621

Effective date: 20221121

A977 Report on retrieval

Free format text: JAPANESE INTERMEDIATE CODE: A971007

Effective date: 20231122

A131 Notification of reasons for refusal

Free format text: JAPANESE INTERMEDIATE CODE: A131

Effective date: 20231212

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A523

Effective date: 20240229

TRDD Decision of grant or rejection written
A01 Written decision to grant a patent or to grant a registration (utility model)

Free format text: JAPANESE INTERMEDIATE CODE: A01

Effective date: 20240423

A61 First payment of annual fees (during grant procedure)

Free format text: JAPANESE INTERMEDIATE CODE: A61

Effective date: 20240507

R150 Certificate of patent or registration of utility model

Ref document number: 7486530

Country of ref document: JP

Free format text: JAPANESE INTERMEDIATE CODE: R150