Assignment of security credentials

Abstract

Techniques for using a digital identity token describing a computer application to obtain authorization to confidential data based on one or more policies are provided. For example, one or more embodiments described herein may include a system that may include a memory that may store computer executable components. The system may also include a processor that is operably coupled to the memory and may execute the computer executable components stored in the memory. The computer executable components may include a trusted platform module component that may generate a digital identity token bound to a computer application process. The computer executable components may also include a key authenticity component that may compare the digital identity token with a security key to retrieve a security credential.

Description

Technical Field

[0001] The present disclosure relates to the distribution of data security credentials and, more particularly, to one or more data security processes that can limit access to security credentials of a service provider administrator via a credential issuance system based on authorization of one or more computer application workloads. Background Art

[0002] Some cloud computing customers require a cloud where the service provider cannot access customer data. Conventional techniques implemented to achieve this goal may include secure key transport protocols, trusted platform modules, and / or host provenance and integrity. However, conventional techniques may be compromised by negligent and / or malicious administrators and / or entities impersonating administrators.

[0003] Therefore, there is a need in the art to solve the above problems. Summary of the invention

[0004] From a first aspect, the present invention provides a system for distributing security credentials, the system comprising: a memory storing computer executable components; a processor operably coupled to the memory and executing the computer executable components stored in the memory, wherein the computer executable components include: a trusted platform module component operable to generate a digital identity token bound to a computer application process; and an authenticity component operable to parse the digital identity token into a security key to retrieve the security credentials.

[0005] From another aspect, the present invention provides a computer-implemented method for distributing security credentials, the method comprising: generating, by a system operably coupled to a processor, a digital identity token bound to a computer application process; and parsing, by the system, the digital identity token into a security key to retrieve the security credentials.

[0006] From another aspect, the present invention provides a system comprising: a memory storing computer executable components; a processor operably coupled to the memory and executing the computer executable components stored in the memory, wherein the computer executable components include: a trusted platform module component generating a digital identity token bound to a computer application process; and a key authenticity component comparing the digital identity token with a security key to retrieve security credentials.

[0007] From another aspect, the present invention provides a system comprising: a memory storing computer executable components; a processor operably coupled to the memory and executing the computer executable components stored in the memory, wherein the computer executable components include: a trusted platform module component generating a digital identity token bound to a computer application process; and a policy authenticity component comparing the digital identity token with a defined policy governing the computer application process to retrieve security credentials.

[0008] From yet another aspect, the invention provides a computer-implemented method comprising: generating, by a system operatively coupled to a processor, a digital identity token bound to a computer application process; and comparing, by the system, the digital identity token with a security key to retrieve a security credential.

[0009] A computer-implemented method includes: generating, by a system operably coupled to a processor, a digital identity token bound to a computer application process; and comparing, by the system, the digital identity token to a defined policy governing the computer application process to retrieve security credentials.

[0010] From another aspect, the present invention provides a computer program product for distributing security credentials, the computer program product comprising a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by a processor to cause the processor to: generate a digital identity token bound to a computer application process by a system operatively coupled to the processor; and compare the digital identity token with a security key by the system to retrieve the security credential.

[0011] Viewed from another aspect, the invention provides a computer program product for distributing security credentials, the computer program product comprising a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit to perform the method for performing the steps of the invention.

[0012] Viewed from another aspect, the invention provides a computer program stored on a computer readable medium and loadable into the internal memory of a digital computer, the computer program comprising software code portions for performing the steps of the invention when said program is run on a computer.

[0013] The following presents a summary of the invention to provide a basic understanding of one or more embodiments of the invention. The summary of the invention is not intended to identify key or important elements, or to delineate any scope of a particular embodiment or any scope of the claims. Its sole purpose is to present concepts in a simplified form as a prelude to a more detailed description presented later. In one or more embodiments described herein, a system, computer-implemented method, apparatus, and / or computer program product that can facilitate the management of digital security credentials is described.

[0014] According to an embodiment, a system is provided. The system may include a memory that may store a computer executable component. The system may also include a processor that is operably coupled to the memory and may execute the computer executable component stored in the memory. The computer executable component may include a trusted platform module component that may generate a digital identity token bound to a computer application process. The computer executable component may also include a key authenticity component that may compare the digital identity token with a security key to retrieve a security credential.

[0015] According to an embodiment, a system is provided. The system may include a memory that may store a computer executable component. The system may also include a processor that is operably coupled to the memory and may execute the computer executable component stored in the memory. The computer executable component may include a trusted platform module component that may generate a digital identity token bound to a computer application process. The computer executable component may also include a policy authenticity component that may compare the digital identity token with a defined policy governing the computer application process to retrieve a security credential.

[0016] According to an embodiment, a computer-implemented method is provided. The computer-implemented method may include generating, by a system operatively coupled to a processor, a digital identity token bound to a computer application process. The computer-implemented method may also include comparing, by the system, the digital identity token with a security key to retrieve a security credential.

[0017] According to an embodiment, a computer-implemented method is provided. The computer-implemented method may include generating, by a system operatively coupled to a processor, a digital identity token bound to a computer application process. The computer-implemented method may also include comparing, by the system, the digital identity token with a defined policy governing the computer application process to retrieve security credentials.

[0018] According to an embodiment, a computer program product for distributing security credentials is provided. The computer program product may include a computer-readable storage medium having program instructions embodied thereon. The program instructions may be executed by a processor to cause the processor to generate a digital identity token bound to a computer application process through a system operably coupled to the processor. The program instructions may also be executed by the processor to compare the digital identity token with a security key by the system to retrieve the security credentials. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present invention will now be described, by way of example only, with reference to preferred embodiments as shown in the following drawings:

[0020] Figure 1 A block diagram is shown of an example non-limiting system that can manage security credentials to execute one or more computer applications in accordance with one or more embodiments described herein.

[0021] Figure 2 A block diagram is shown of an example non-limiting system that can restrict access to one or more security credentials of a service provider administrator via a credential issuance system based on authorization of one or more computer application workloads in accordance with one or more embodiments described herein.

[0022] Figure 3 A diagram illustrating an example non-limiting digital identity token that can facilitate management of security credentials in one or more data security systems in accordance with one or more embodiments described herein.

[0023] Figure 4 A diagram illustrating an example non-limiting system that can implement one or more identity authenticity mechanisms based on comparison of one or more digital identity tokens to a publicly available digital key in accordance with one or more embodiments described herein.

[0024] Figure 5 A diagram illustrating an example non-limiting system that can implement one or more identity authenticity mechanisms based on comparison of one or more digital identity tokens to management policies in accordance with one or more embodiments described herein.

[0025] Figure 6 A diagram of an example non-limiting computer application process that may be executed by one or more systems that may restrict access to one or more security credentials of a service provider administrator via a credential issuance system based on authorizations for one or more computer application workloads in accordance with one or more embodiments described herein.

[0026] Figure 7A block diagram is shown of an example non-limiting system that can restrict access to one or more security credentials of a service provider administrator via a credential issuance system based on authorization of one or more computer application workloads in accordance with one or more embodiments described herein.

[0027] Figure 8 A flow chart is shown of an example non-limiting method that can facilitate limiting access to credentials of a service provider administrator via a credential release system based on authorization of one or more computer application workloads in accordance with one or more embodiments described herein.

[0028] Fig. 9 A flow chart is shown of an example non-limiting method that can facilitate limiting access to credentials of a service provider administrator via a credential release system based on authorization of one or more computer application workloads in accordance with one or more embodiments described herein.

[0029] Fig.10 A cloud computing environment is depicted according to one or more embodiments described herein.

[0030] Fig.11 Abstract model layers are depicted in accordance with one or more embodiments described herein.

[0031] Fig.12 A block diagram is shown of an example non-limiting operating environment in which one or more embodiments described herein may be facilitated. DETAILED DESCRIPTION

[0032] The following detailed description is illustrative only and is not intended to limit the embodiments and / or the application or uses of the embodiments. Furthermore, there is no intention to be bound by any explicit or implicit information presented in the previous background or summary sections or the detailed description section.

[0033] One or more embodiments are now described with reference to the accompanying drawings, wherein the same reference numerals are used throughout to refer to the same elements. In the following description, for the purpose of explanation, many specific details are set forth in order to provide a more thorough understanding of one or more embodiments. However, it is apparent that in various cases, one or more embodiments may be practiced without these specific details.

[0034] Various embodiments of the present invention may relate to computer processing systems, computer-implemented methods, devices, and / or computer program products that facilitate efficient, effective, and autonomous (e.g., without direct human guidance) data security processes that may limit access to credentials of service provider administrators via a credential issuance system based on authorization of one or more computer application workloads. For example, one or more embodiments may include autonomously generating one or more digital identity tokens that may be bound to a computer application process and / or signed by a trust chain originating from one or more hardware devices. The one or more digital identity tokens may be further compared to one or more public keys and / or policies to facilitate authentication of the computer application process and retrieval of security credentials for extraction of the computer application process. For example, the one or more digital identity tokens may describe a subject computer application and / or may be used to obtain authorization to confidential data based on one or more user-defined policies.

[0035] A computer processing system, computer implemented method, apparatus and / or computer program product employs hardware and / or software to solve a problem that is highly technical in nature (e.g., limiting access to security credentials), is not abstract, and cannot be performed by a person as a set of mental actions. The various embodiments described herein implement enhanced data security measures by limiting access to security credentials to one or more persons, thereby reducing the likelihood of data security breaches caused by careless or malicious human actions.

[0036] Figure 1 A block diagram of an example non-limiting system 100 that can restrict access to one or more security credentials of a service provider administrator based on authorization of one or more computer application workloads is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. Aspects of the systems (e.g., system 100, etc.), devices, or processes in various embodiments of the present invention may constitute one or more machine-executable components embodied in one or more machines (e.g., embodied in one or more computer-readable media (or media) associated with one or more machines). Such components, when executed by one or more machines (e.g., computers, computing devices, virtual machines, etc.), may cause the machines to perform the described operations.

[0037] like Figure 1As shown, system 100 may include one or more servers 102, one or more networks 104, credential storage 106, and / or data storage unit 108. Server 102 may include security component 110. Security component 110 may also include one or more communication components 112 and / or application components 114. In addition, server 102 may include or otherwise be associated with at least one memory 116. Server 102 may also include system bus 118, which may be coupled to various components, such as, but not limited to, security component 110 and associated components, memory 116, and / or processor 120. Although in Figure 1 Server 102 is shown in FIG. 1 , but in other embodiments, multiple devices of various types may be associated with Figure 1 The features shown in Figure 1 Further, server 102 may be in communication with one or more cloud computing environments.

[0038] The one or more networks 104 may include wired and wireless networks, including, but not limited to, cellular networks, wide area networks (WANs) (e.g., the Internet), or local area networks (LANs). For example, the server 302 may communicate with the one or more credential stores 106 and / or data storage units 108 (or vice versa) using virtually any desired wired or wireless technology, including, for example, but not limited to, cellular, WAN, wireless fidelity (Wi-Fi), Wi-Max, WLAN, Bluetooth technology, combinations thereof, and / or the like. Further, although in the illustrated embodiment, the security component 110 may be disposed on one or more servers 102, it should be understood that the architecture of the system 100 is not limited thereto. For example, the security component 110 or one or more components of the security component 110 may be located at another computer device (such as another server device, a client device, etc.).

[0039] One or more credential stores 106 may store, access, and / or distribute one or more dynamic security credentials. In various embodiments, the dynamic security credentials stored, accessed, and / or distributed by one or more credential stores 106 may be secrets for one or more applications and / or computing systems. Example security credentials may include, but are not limited to: tokens, passwords, certificates, encryption keys, application program interface ("API") keys, secure shell ("SSH") credentials, secrets, combinations thereof, and / or the like. In various embodiments, one or more credential stores 106 may encrypt and / or store one or more security credentials. Further, one or more security credentials may be ephemeral (e.g., programmatically generated when accessed and not present until read).

[0040] The one or more data storage units 108 may include one or more databases of confidential information. In various embodiments, the one or more data storage units 108 may be one or more database management systems capable of facilitating the creation and / or access of one or more databases. Further, the one or more databases may be stored within one or more cloud computing environments, wherein the one or more data storage units 108 may manage access to the one or more databases. In addition, the one or more databases may include data stored in one or more programming languages, such as JavaScript Object Notation ("JSON") and / or Structured Query Language ("SQL"). Example data storage units 108 may include, but are not limited to, one or more databases, cloud object storage ("COS"), combinations thereof, and the like.

[0041] The one or more communication components 112 can share data received by the server 102 with one or more other components of the server (e.g., one or more other components associated with the security component 110). In addition, the one or more communication components 112 can utilize the one or more credential stores 106 and / or the data storage unit 108 to transmit one or more outputs of the security component 110. In one or more embodiments, the one or more communication components 112 can send and / or receive data via a direct electrical connection and / or one or more networks 104.

[0042] One or more application components 114 can run one or more computer applications. For example, one or more application components 114 can be one or more physical and / or virtual machines that execute one or more applications and / or programs. Further, one or more applications running on one or more application components 114 can be composed of one or more containers, wherein one or more application components 114 can utilize one or more container orchestration platforms. The subject application can be composed of a single container or multiple co-located containers that are tightly coupled and / or share resources. For example, containers can share resources and / or dependencies, communicate with each other, and / or coordinate when and / or how containers are terminated. In addition, one or more containers can be encapsulated by one or more pods, which can control how one or more containers can be run by one or more application components 114.

[0043] In different embodiments, one or more application components 114 may generate one or more sidecar containers for one or more applications. As used herein, the terms "sidecar container" and / or "sidecar containers" may refer to one or more containers co-located with one or more applications in a pod, wherein one or more sidecar containers may be coupled to one or more applications and share resources with one or more applications. The one or more sidecar containers may analyze the one or more applications. In one or more embodiments, the one or more applications and the sidecar container may be packaged together in a pod to form a single manageable entity. In addition, the one or more sidecar containers may analyze the one or more applications in the pod to collect one or more statements, which may be one or more measurements describing one or more workloads of the one or more applications.

[0044] Figure 2 A block diagram of an example non-limiting system 100 according to one or more embodiments described herein is shown, the system 100 further including one or more trusted platform module ("TPM") components 202. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. The one or more TPM components 202 may include hardware that can generate one or more digital identity tokens. For example, the one or more digital identity tokens may represent one or more statements in a uniform resource locator ("URL") encoded format, wherein the one or more statements may be digitally signed and / or encrypted. For example, the one or more digital identity tokens may be JSON web tokens ("JWT"), wherein the one or more statements may be encoded as one or more JSON objects; thereby enabling the one or more statements to be digitally signed and / or encrypted.

[0045] In various embodiments, one or more TPM components 202 may generate one or more digital identity tokens based on one or more claims collected by one or more sidecar containers generated by one or more application components 114. For example, one or more TPM components 202 may generate one or more digital identity tokens based on one or more claims using one or more private keys. Further, one or more private keys may be trusted to be maintained by one or more TPM components 202. For example, the private keys may be maintained in a manner that is inaccessible to one or more applications, sidecar containers, administrators of the system 100, other components of the system 100, and / or other third parties. In one or more embodiments, each application component 114 may be associated with a corresponding TPM component 202. Alternatively, one or more clusters of application components 114 may be associated with the same TPM component 202.

[0046] In one or more embodiments, one or more private keys, and therefore one or more digital identity tokens, may be associated with one or more public keys included in one or more public key stores 122. Figure 2 As shown, one or more public key stores 122 may be stored within one or more memories 116, and / or one or more public key stores 122 may be stored external to the server 102 (e.g., within a second server 102, an external memory unit, and / or a cloud computing environment). The one or more public keys may be readable by one or more components and / or administrators of the system 100. However, management of the one or more public key stores 122 may be reserved for a trusted system 100 administrator. Thus, different components of the system 100 and / or parties external to the system 100 may read the one or more public keys, but may not modify the one or more public key stores 122 (e.g., may not change the public keys, remove the public keys from the public key stores 122, and / or add the public keys to the public key stores 122).

[0047] The one or more TPM components 202 may utilize the data included in the declaration to generate one or more digital identity tokens that are bound to the execution of the subject application. In addition, the one or more TPM components 202 may use the one or more private keys to establish a chain of trust represented by the signature included in the one or more digital identity tokens. In addition, the one or more TPM components 202 may define an expiration date for the one or more digital identity tokens. For example, the one or more digital identity tokens may expire after a defined amount of time (e.g., a fraction of a second, a few seconds, a few minutes, a few hours, a few days, etc.).

[0048] Figure 3 A diagram of an example non-limiting structure 300 of one or more digital identity tokens that may be generated by one or more TPM components 202 according to one or more embodiments described herein is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. Figure 3 As shown, one or more digital identity tokens may include a header, a payload, and a signature.

[0049] The header may include a reference title of the subject digital identity token and / or may describe one or more cryptographic operations. For example, where the one or more digital identity tokens are JWTs, the header may be a JSON Web Signature ("JWS") header or a JSON Web Encryption ("JWE") header. The payload may include data contained within the one or more claims. Example data included within the one or more claims and / or within the payload of the one or more digital identity tokens may include, but is not limited to: a geographic region associated with one or more application components 114 running the subject application (e.g., in Figure 3), a reference name associated with one or more application components 114 running the subject application (e.g., in Figure 3 ), a reference name associated with a pod of a subject container that encapsulates an application (e.g., in Figure 3 pods), one or more container workloads (e.g. Figure 3 ), the expiration date of the digital identity token (e.g. Figure 3 ), the date on which the digital identity token was originated (e.g., Figure 3 ), the publisher of the subject application (e.g., represented by "iss" in FG.3), the namespace (e.g., Figure 3 ), compliance scan results, vulnerabilities, specific version information, current network configuration and / or information, open ports, combinations thereof, etc. Further, the signature may include a signature from one or more TPM components 202 generated by a digital identity token using one or more private keys.

[0050] Figure 4 1 shows a diagram of an exemplary non-limiting system 100 according to one or more embodiments described herein, the system 100 also includes a key authenticity component 402. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. Figure 4 As shown, one or more key authenticity components 402 may be included within one or more credential stores 106 .

[0051] In various embodiments, the credential store 106 may determine whether one or more applications running on one or more application components 114 are authorized to receive one or more security credentials based on the one or more digital identity tokens. For example, the key authenticity component 402 may utilize the one or more digital identity tokens to authenticate the one or more applications. In one or more embodiments, the key authenticity component 402 may compare the digital identity tokens with one or more public keys included in one or more public key stores 122. In one or more embodiments, the key authenticity component 402 may compare the digital identity tokens with a certificate chain and / or an intermediate certificate authority. In response to comparing the one or more digital identity tokens with the one or more public keys, the key authenticity component 402 may determine that the subject application is authorized to receive the one or more security credentials.

[0052] Figure 51 shows a diagram of an example non-limiting system 100 according to one or more embodiments described herein, the system 100 further comprising a policy authenticity component 502 and / or a policy library 504. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. Figure 5 As shown, one or more policy authenticity components 502 and / or policy repositories 504 may be included within one or more credential stores 106 .

[0053] In various embodiments, the credential store 106 may further determine which security credentials are assigned to the one or more applications based on one or more governing policies and / or digital identity tokens. For example, the policy authenticity component 502 may compare the data included in the payload of the one or more digital identity tokens with one or more governing policies included in one or more policy repositories 504. The one or more governing policies may describe which data managed by the one or more data storage units 108 can be accessed, the amount of data that can be accessed, and / or the environment in which the data can be accessed. For example, one or more governing policies may provide different applications with different levels of access to data managed by one or more data storage units 108. In another example, one or more governing policies may provide the same application with different levels of access to data managed by one or more data storage units 108 based on the context of the execution of the application (e.g., which application components 114 are running the application, and / or how the application components 114 run the application). In one or more embodiments, one or more governing policies may be defined by one or more owners of the data managed by one or more data storage units 108.

[0054] Based on the comparison between the one or more digital identity tokens and the governing policy, the policy authenticity component 502 can determine which restrictions, if any, are applicable to the subject execution of the one or more applications. Thus, the key authenticity component 402 can determine whether the subject application is authorized to access data managed by the one or more data storage units 108, and / or the policy authenticity component 502 can determine whether any data access restrictions are applied to the subject execution of the application. In one or more embodiments, the credential storage 106 can assign one or more security credentials to the authorized application based on the determination of the key authenticity component 402 and the policy authenticity component 502. In some embodiments, the credential storage 106 can assign one or more security credentials to the authorized application based on the determination of the key authenticity component 402 or the policy authenticity component 502. The security credentials can enable the application to access the data managed by the one or more data storage units 108. In addition, the one or more security credentials can limit the amount and / or level of access based on the application and / or the execution of the application according to one or more governing policies (e.g., which can be defined by the owner of the data).

[0055] Figure 6 A diagram of an example, non-limiting computer application process 600 that can be implemented by system 100 according to one or more embodiments described herein is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, one or more networks 104 may facilitate communication with respect to Figure 6 Communications that describe and / or describe. Figure 6 As shown, during computer application processing 600, one or more application components 114 (e.g., a cluster of two application components 114) can facilitate execution of the application. For example, as described herein, one or more application components 114 can generate one or more sidecar containers.

[0056] At 602, one or more sidecar containers may collect one or more claims about an application and send the claims to one or more TPM components 202. For example, the claims may describe one or more workloads of the application. At 604, one or more TPM components 202 may generate one or more digital identity tokens based on the claims and one or more private keys confidently maintained by the one or more TPM components 202. Further, the one or more TPM components 202 may send the one or more digital identity tokens to the one or more sidecar containers. At 606, the one or more sidecar containers may share the one or more digital identity tokens with the one or more applications. In various embodiments, the application may remain unaware of how and / or what formed the one or more digital identity tokens. Thus, the system 100 does not require the security component 110 to store one or more security credentials for authentication with one or more credential storage devices; instead, the security component (e.g., via the application component 114 and / or the TPM component 202) may provide one or more digital identity tokens for authentication, which may be dynamically generated (e.g., via the TPM component 202) based on one or more claims collected by one or more sidecar containers (e.g., via the application component 114).

[0057] At 608, the application may send one or more digital identity tokens to one or more credential stores 106 to obtain one or more security credentials. At 610, the key authenticity component 402 may compare the one or more digital identity tokens with one or more public keys included in one or more public key stores 122. In various embodiments, the one or more public key stores 122 may be managed by one or more trusted system 100 administrators. In one or more embodiments, the one or more public key stores 122 may be managed by one or more entities and / or systems defined by one or more owners of confidential data stored in one or more data storage units 108. Trusted management of the one or more public stores 122 may enable identification of forged digital identity tokens attempting to obtain authorization from the one or more credential stores 106. In response to matching the one or more digital identity tokens with the one or more public keys, the key authenticity component 402 may determine that the application is authorized to receive the one or more security credentials. Conversely, the key authenticity component 402 may determine that the application is not authorized to receive the one or more security credentials in response to failing to match the one or more digital identity tokens with the one or more public keys.

[0058] In the event that the key authenticity component 402 determines that the application is an authorized application, the policy authenticity component 502 may also compare the one or more digital identity tokens to one or more policies included in the one or more policy libraries 504. The one or more policies may describe one or more data access restrictions that may be applied to the application and / or the subject execution of the application (e.g., as described herein). Based on the comparison at 612, the policy authenticity component 502 may determine which data access restrictions, if any, may be applied to the subject execution of the application. At 614, the credential store 106 may assign one or more security credentials to the application based on the determination of the key authenticity component 402 and / or the policy authenticity component 502. For example, one or more security credentials may be assigned in response to the application being authorized to access data managed by the one or more data storage units 108, and / or the security credentials may specify the amount and / or level of data access authorized to the application.

[0059] At 616, the application may use the one or more assigned security credentials to access the one or more data storage units 108 and / or retrieve the stored data in accordance with any data access restrictions specified by the one or more security credentials. The application may then utilize the retrieved data to perform one or more tasks and / or complete the computer application process 600.

[0060] Figure 7 A diagram of an example non-limiting system 100 including multiple servers 102 that can facilitate execution of applications at multiple locations according to one or more embodiments described herein is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. Figure 7 As shown, the system 100 may include, for example, a first server 702, a second server 704, a third server 706, and / or a fourth server 708. The first server 702, the second server 704, the third server 706, and / or the fourth server 708 may each include one or more of the various components described herein with respect to the server 102, be located in different locations, and / or communicate via one or more networks 104 (e.g., via a cloud computing environment). For example, the first server 702 may be located in London, the second server 704 may be located in Dallas, the third server 706 may be located in Berlin, and / or the fourth server 708 may be located in Washington, DC.

[0061] To illustrate one or more capabilities of the system 100, the following example scenario considers a multinational company with locations in Dallas and Berlin. The company may utilize the system 100 to execute one or more computer application processes 600 and / or define the following management policies regarding employee data stored in one or more data storage units 108. A first policy may depict that there are two levels of data access: full data access, which may include the following information about the company's employees: first name, last name, rank, social security number, and / or telephone number; and / or limited data access, which may include only first name, last name, and rank information. A second policy may depict that only applications that request from the Berlin company's servers and use a specific, trusted, signed container may be granted full data access; otherwise, applications that request from the Berlin company's servers may be granted limited data access. A third policy may depict that an auditing firm located in Washington, D.C. may temporarily obtain full data access for a tax audit. A fourth policy may depict that applications that request from the Dallas company's servers may be granted limited data access. Additionally, a fifth policy may depict that applications that request from geographic locations other than Dallas and / or Berlin are not authorized to access employee data.

[0062] The first server 702, the second server 704, the third server 706, and / or the fourth server 708 may each run the same application via one or more computer application processes 600, but implement different accessibility to the one or more data storage units 108. For example, the digital identity tokens generated on the respective servers 102 may be different due at least to the different geographical locations of each server 102. Further, the credential store 106 may reach different determinations regarding the execution of the application on the multiple servers 102 based on the different contents of the digital identity tokens and / or policies defined above (e.g., stored in one or more policy repositories 504).

[0063] For example, the credential store 106 may determine that the application is not assigned a security credential according to the fifth policy when executed on the first server 702 at least because the security credential request originates from London (e.g., as depicted by the digital identity token generated by the TPM component 202 of the first server 702). In another example, the credential store 106 may determine that the application is assigned a security credential that provides limited data access according to the fourth policy when executed on the second server 704 at least because the security credential request originates from an authorized application in Dallas (e.g., as depicted by the digital identity token generated by the TPM component 202 of the second server 704). In another example, the credential store 106 may determine that the application may be assigned a security credential that provides full data access when the details of the second policy are met, and / or assign a security credential that provides limited data access when the details of the second policy are not met at least because the security credential request originates from an authorized application in Berlin (e.g., as depicted by the digital identity token generated by the TPM component 202 of the third server 706). In another example, the credential store 106 can determine that the application, when executed on the fourth server 708, is assigned security credentials that provide full data access according to the third policy, at least because the security credential request originated from an authorized application in Washington, D.C. (e.g., as depicted by a digital identity token generated by the TPM component 202 of the fourth server 708).

[0064] Figure 8 A flow chart is shown of an example non-limiting method 800 that can facilitate limiting access to credentials of a service provider administrator via the credential issuance system 100 based on authorization of one or more computer application workloads according to one or more embodiments described herein. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted.

[0065] At 802, method 800 may include generating (e.g., via TPM component 202) one or more digital identity tokens that may be bound to a computer application process (e.g., according to exemplary computer application process 600) by system 100 operatively coupled to one or more processors 120. Further, in various embodiments, the one or more digital identity tokens may be signed by a trust chain that may originate from hardware (e.g., TPM component 202). For example, as described herein, the one or more digital identity tokens may be generated based on one or more claims and / or one or more private keys collected from a subject application. For example, one or more sidecar containers (e.g., generated via application component 114) may analyze one or more subject applications and / or collect one or more measurements describing one or more workloads of the application. In various embodiments, the one or more digital identity tokens may be represented by the exemplary structure 300 described herein (e.g., the one or more digital identity tokens may be JWTs). In addition, in one or more embodiments, the one or more digital identity tokens may be set (e.g., via TPM component 202) to expire after a defined period of time (e.g., a fraction of a second, a few seconds, a few minutes, etc.).

[0066] At 804, method 800 may include comparing, by system 100, the one or more digital identity tokens to one or more security keys (e.g., via key authenticity component 402) to retrieve one or more security credentials (e.g., for executing a computer application process). As described herein, the one or more security keys may be public keys included within one or more public repositories 122 managed by one or more trusted administrators of system 100. Further, the one or more public keys may be associated with one or more private keys used to generate the one or more digital identity tokens, and / or may thereby facilitate authentication of the one or more digital identity tokens.

[0067] For example, the comparison at 804 may include determining whether one or more digital identity tokens match one or more of the public keys or are otherwise associated with one or more of the public keys. Based on the comparison at 804, the system 100 (e.g., via the key authenticity component 402) may determine whether the analyzed digital identity token is authentic (e.g., generated by the system 100) and / or whether the subject computer application process is authorized to receive one or more security credentials. For example, the system 100 (e.g., via the key authenticity component 402) may identify a digital identity token that includes fabricated data (e.g., a fictitious payload) and / or altered data (e.g., an altered payload) via the comparison at 804 (e.g., due to an inconsistency between the digital identity token and the available public keys). In another example, one or more applications that are not authorized to receive security credentials may be identified by the comparison at 804 (e.g., due to an inconsistency between the digital identity token and the available public keys).

[0068] At 806, the method 800 may further include comparing, by the system 100, the one or more digital identity tokens with one or more defined policies of the disposable subject computer application process (e.g., according to the exemplary computer application process 600) (e.g., via the policy authenticity component 502), wherein retrieving the one or more security credentials may be further based on the comparison at 806. As described herein, the one or more policies may be included in the one or more policy repositories 504 and / or may be defined by one or more data owners managed via the distribution of security credentials. The comparison at 806 may facilitate identifying any data accessibility restrictions applicable to the computer application process.

[0069] For example, the comparison at 806 may determine whether the authorization of the application to access the confidential data is subject to one or more restrictions. For example, the one or more security credentials assigned to the subject computer application process may be further based on one or more workloads of the subject application. Thus, in various embodiments, the system 100 may assign one or more security credentials to the subject application to facilitate execution of the computer application process based on the authorization status of the subject application, the authenticity of one or more digital identity tokens, and / or one or more data access restrictions defined by one or more governing policies.

[0070] Fig. 9 A flow chart is shown of an example non-limiting method 900 that can facilitate limiting access to credentials of a service provider administrator via the credential issuance system 100 based on authorization of one or more computer application workloads according to one or more embodiments described herein. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted.

[0071] At 902, method 900 may include generating (e.g., via application component 114), by system 100 operably coupled to one or more processors 120, one or more sidecar containers that may collect one or more statements about an application. For example, the one or more sidecar containers may collect one or more measurements describing one or more workloads of an application. In various embodiments, the one or more applications may be comprised of one or more containers encapsulated within one or more pods having one or more sidecar containers.

[0072] At 904, method 900 may include generating, by system 100 (e.g., via TPM component 202), one or more digital identity tokens that may be bound to a computer application process (e.g., according to exemplary computer application process 600). Further, in various embodiments, one or more digital identity tokens may be signed by a trust chain that may be derived from hardware (e.g., TPM component 202). For example, as described herein, the one or more digital identity tokens may be generated based on one or more claims collected by the one or more sidecar containers and / or one or more private keys. In various embodiments, one or more digital identity tokens may be represented by the exemplary structure 300 described herein (e.g., one or more digital identity tokens may be JWTs). In addition, in one or more embodiments, one or more digital identity tokens may be set (e.g., via TPM component 202) to expire after a defined time period (e.g., a fraction of a second, a few seconds, a few minutes, etc.).

[0073] At 906, method 900 may include comparing, by system 100, the one or more digital identity tokens to one or more security keys (e.g., via key authenticity component 402) to facilitate retrieving one or more security credentials (e.g., for executing a computer application process). As described herein, the one or more security keys may be public keys included within one or more public repositories 122 managed by one or more trusted administrators of system 100. Further, the one or more public keys may be associated with one or more private keys used to generate the one or more digital identity tokens, and / or may thereby facilitate authenticating the one or more digital identity tokens.

[0074] For example, the comparison at 906 may include determining whether one or more digital identity tokens match one or more of the public keys or are otherwise associated with one or more of the public keys. Based on the comparison at 906, the system 100 (e.g., via the key authenticity component 402) may determine whether the analyzed digital identity token is authentic (e.g., generated by the system 100) and / or whether the subject computer application process is authorized to receive one or more security credentials. For example, the system 100 (e.g., via the key authenticity component 402) may identify a digital identity token that includes fabricated data (e.g., a fictitious payload) and / or altered data (e.g., an altered payload) via the comparison at 906 (e.g., due to an inconsistency between the digital identity token and the available public key). In another example, one or more applications that are not authorized to receive security credentials may be identified by the comparison at 906 (e.g., due to an inconsistency between the digital identity token and the available public key).

[0075] At 908, method 900 may further include comparing, by system 100, the one or more digital identity tokens with one or more defined policies of the applicable subject computer application process (e.g., according to exemplary computer application process 600) (e.g., via policy authenticity component 502), wherein retrieving one or more security credentials may be further based on the comparison at 806. As described herein, the one or more policies may be included within one or more policy repositories 504 and / or may be defined by one or more data owners managed via distribution of security credentials. The comparison at 908 may facilitate identification of any data accessibility restrictions applicable to the computer application process.

[0076] For example, the comparison at 908 may determine whether the authorization of the application to access the confidential data is subject to one or more restrictions. For example, the one or more security credentials assigned to the subject computer application process may be further based on one or more workloads of the subject application. Thus, in various embodiments, the system 100 may assign one or more security credentials to the subject application to facilitate the execution of the computer application process based on the authorization status of the subject application, the authenticity of one or more digital identity tokens, and / or one or more data access restrictions defined by one or more governing policies.

[0077] At 910, method 900 may also include executing (e.g., via application component 114) a computer application process by system 100 using the assigned one or more security credentials to retrieve data from one or more databases (e.g., managed by one or more data stores 108). For example, one or more subject applications may retrieve data from one or more data stores 108 according to one or more accessibility restrictions specified by the one or more security credentials.

[0078] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0079] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the provider of the service. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0080] Features are as follows:

[0081] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed, without requiring human interaction with the provider of the service. Broad network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin-client platforms or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0082] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence, as consumers typically do not have control or knowledge of the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0083] Rapid elasticity: The ability to quickly and elastically provision capacity, in some cases automatically scaling down quickly and releasing quickly to scale up quickly. To the consumer, the capacity available for provisioning generally appears unlimited and can be purchased in any quantity at any time.

[0084] Measured services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0085] The service model is as follows:

[0086] Software as a Service (SaaS): The capability provided to consumers is to use the provider's applications running on a cloud infrastructure. The applications can be accessed from different client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even the individual application capabilities, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto the cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, or storage, but has control over the deployed applications and possible application hosting environment configuration.

[0087] Infrastructure as a Service (IaaS): The capabilities provided to consumers are the provision of processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0088] The deployment model is as follows:

[0089] Private Cloud: Cloud infrastructure is operated only for the organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0090] Community Cloud: Cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0091] Public cloud: Cloud infrastructure is made available to the public or large industry groups and is owned by an organization that sells cloud services.

[0092] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0093] Cloud computing environments are service-oriented and focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0094] See now Fig.10, describes an illustrative cloud computing environment 1000. As shown, cloud computing environment 1000 includes one or more cloud computing nodes 1002 with which local computing devices used by cloud consumers can communicate, such as, for example, personal digital assistants (PDAs) or cellular phones 1004, desktop computers 1006, laptop computers 1008, and / or automotive computer systems 1010. Nodes 1002 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above. This allows cloud computing environment 1000 to provide infrastructure, platform, and / or software as a service for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Fig.10 The types of computing devices 1004-1010 shown in are intended to be illustrative only, and computing node 1002 and cloud computing environment 1000 may communicate with any type of computerized device over any type of network and / or network-addressable connection (eg, using a web browser).

[0095] See now Fig.11 , showing a cloud computing environment 1000 ( Fig.10 ) provides a set of functional abstraction layers. For the sake of brevity, repeated descriptions of similar elements used in other embodiments described herein are omitted. It should be understood in advance that Fig.11 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As described, the following layers and corresponding functions are provided.

[0096] The hardware and software layer 1102 includes hardware and software components. Examples of hardware components include: mainframes 1104; servers based on RISC (Reduced Instruction Set Computer) architecture 1106; servers 1108; blade servers 1110; storage devices 1112; and network and networking components 1114. In some embodiments, software components include network application server software 1116 and database software 1118.

[0097] Virtualization layer 1120 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 1122 ; virtual storage 1124 ; virtual networks 1126 , including virtual private networks; virtual applications and operating systems 1128 ; and virtual clients 1130 .

[0098] In one example, the management layer 1132 may provide the functionality described below. Resource provisioning 1134 provides dynamic procurement of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 1136 provides cost tracking when resources are utilized within a cloud computing environment, and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 1138 provides access to the cloud computing environment for consumers and system administrators. Service level management 1140 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 1142 provides pre-scheduling and procurement for cloud computing resources, anticipating future requirements for the cloud computing resources based on the SLA.

[0099] Workload layer 1144 provides examples of functionality that can take advantage of a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include: mapping and navigation 1146; software development and lifecycle management 1148; virtual classroom education delivery 1150; data analytics processing 1152; transaction processing 1154; and security credential management 1156. Various embodiments of the present invention may utilize references to Fig.10 and Fig.11 A cloud computing environment is described to facilitate payment of one or more security credentials to facilitate execution of one or more computer application processes.

[0100] The present invention can be a system, method and / or computer program product of any possible technical details integration. The computer program product may include a computer-readable storage medium (or multiple media) having a computer-readable program instruction for making a processor perform various aspects of the present invention. The computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a protruding structure in a groove with instructions recorded thereon, and any suitable combination of the above. Computer-readable storage media as used herein should not be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0101] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or downloaded to an external computer or external storage device. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0102] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming languages ​​or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (for example, using an Internet service provider through the Internet). In certain embodiments, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can perform computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit so as to perform various aspects of the present invention.

[0103] The present invention will be described below with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present invention. It should be understood that each box of the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer readable program instructions.

[0104] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which causes the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium in which the instructions are stored includes a manufactured product containing instructions for implementing aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0105] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in or in multiple boxes in the flowchart and / or block diagram.

[0106] The flow chart and block diagram in the accompanying drawings show the architecture, function and operation of the possible implementation of the system, method and computer program product according to different embodiments of the present invention. To this end, each box in the flow chart or block diagram may represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing a specified logical function. In some alternative implementations, the function marked in the box may not occur in the order marked in the figure. For example, depending on the function involved, the two blocks shown in succession can actually be executed substantially at the same time, or these blocks can sometimes be executed in reverse order. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a system based on dedicated hardware that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

[0107] To provide context for various aspects of the disclosed subject matter, Fig.12 The following discussion is intended to provide a general description of a suitable environment in which aspects of the disclosed subject matter may be implemented. Fig.12 A block diagram of an example non-limiting operating environment in which one or more embodiments described herein may be facilitated is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. Fig.12, a suitable operating environment 1200 for implementing various aspects of the present disclosure may include a computer 1212. The computer 1212 may also include a processing unit 1214, a system memory 1216, and a system bus 1218. The system bus 1218 may operably couple system components including, but not limited to, the system memory 1216 to the processing unit 1214. The processing unit 1214 may be any of a variety of available processors. Dual microprocessors and other multi-processor architectures may also be used as the processing unit 1214. The system bus 1218 may be any of several types of bus structures, including a memory bus or memory controller, a peripheral bus or external bus, and / or a local bus using any of a variety of available bus architectures, including, but not limited to, Industry Standard Architecture (ISA), Micro Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Local Bus (VLB), Peripheral Component Interconnect (PCI), Card Bus, Universal Serial Bus (USB), Advanced Graphics Port (AGP), FireWire, and Small Computer System Interface (SCSI). The system memory 1216 may also include volatile memory 1220 and non-volatile memory 1222. A basic input / output system (BIOS), including basic routines such as transferring information between elements within the computer 1212 during startup, may be stored in the non-volatile memory 1222. By way of example and not limitation, the non-volatile memory 1222 may include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), flash memory, or a non-volatile random access memory (RAM) (e.g., ferroelectric RAM (FeRAM)). The volatile memory 1220 may also include a random access memory (RAM) that acts as an external cache memory. By way of illustration and not limitation, RAM may be obtained in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), direct Rambus RAM (DRRAM), direct Rambus dynamic RAM (DRDRAM), and Rambus dynamic RAM.

[0108] The computer 1212 may also include removable / non-removable, volatile / nonvolatile computer storage media. Fig.12For example, disk storage 1224 is shown. Disk storage 1224 may also include, but is not limited to, devices such as a disk drive, a floppy disk drive, a tape drive, a Jaz drive, a Zip drive, an LS-100 drive, a flash card, or a memory stick. Disk storage 1224 may also include storage media, including but not limited to optical drives, such as compact disk ROM devices (CD-ROM), CD recordable drives (CD-R drives), CD rewritable drives (CD-RW drives), or digital versatile disk ROM drives (DVD-ROM), either alone or in combination with other storage media. To facilitate the connection of disk storage 1224 to system bus 1218, a removable or non-removable interface, such as interface 1226, may be used. Fig.12 Also depicted is software that can act as an intermediary between a user and the basic computer resources described in the appropriate operating environment 1200. Such software can also include, for example, an operating system 1228. The operating system 1228, which can be stored on the disk storage 1224, is used to control and allocate the resources of the computer 1212. The system application 1230 can utilize the management of resources by the operating system 1228 through, for example, program modules 1232 and program data 1234 stored on the system memory 1216 or the disk storage 1224. It should be understood that the present disclosure can be implemented with different operating systems or combinations of operating systems. The user enters commands or information into the computer 1212 through one or more input devices 1236. The input device 1236 can include, but is not limited to, pointing devices such as a mouse, trackball, stylus, touchpad, keyboard, microphone, joystick, game pad, satellite dish, scanner, TV tuner card, digital camera, digital video camera, web camera, etc. These and other input devices can be connected to the processing unit 1214 through the system bus 1218 via one or more interface ports 1238. One or more interface ports 1238 may include, for example, a serial port, a parallel port, a game port, and a universal serial bus (USB). One or more output devices 1240 may use some of the same type of ports as the input device 1236. Thus, for example, a USB port may be used to provide input to the computer 1212, and output information to the output device 1240 from the computer 1212. An output adapter 1242 may be provided to illustrate that there are some output devices 1240 such as monitors, speakers, and printers in addition to other output devices 1240 that require special adapters. As an illustration and not limitation, the output adapter 1242 may include a video and sound card that provides a connection device between the output device 1240 and the system bus 1218. It should be noted that other devices and / or systems of devices provide both input and output capabilities, such as one or more remote computers 1244.

[0109] The computer 1212 can operate in a networked environment using logical connections to one or more remote computers, such as remote computer 1244. The remote computer 1244 can be a computer, server, router, network PC, workstation, microprocessor-based appliance, peer device or other public network node, etc., and can also generally include many or all of the elements described relative to the computer 1212. For the purpose of brevity, the memory storage device 1246 is only illustrated with the remote computer 1244. The remote computer 1244 can be logically connected to the computer 1212 through a network interface 1248 and then physically connected via a communication connection 1250. Further, operations can be distributed across multiple (local and remote) systems. The network interface 1248 may include wired and / or wireless communication networks, such as a local area network (LAN), a wide area network (WAN), a cellular network, etc. LAN technologies include fiber distributed data interface (FDDI), copper distributed data interface (CDDI), Ethernet, token ring, etc. WAN technologies include, but are not limited to, point-to-point links, circuit switching networks such as Integrated Services Digital Networks (ISDN) and variations thereof, packet switching networks, and Digital Subscriber Lines (DSL). Communication connection(s) 1250 refers to the hardware / software used to connect the network interface 1248 to the system bus 1218. Although communication connection 1250 is shown internal to the computer 1212 for clarity, it can also be external to the computer 1212. For exemplary purposes only, the hardware / software used to connect to the network interface 1248 can also include internal and external technologies, such as modems, including conventional telephone grade modems, cable modems and DSL modems, ISDN adapters, and Ethernet cards.

[0110] Embodiments of the present invention can be systems, methods, devices and / or computer program products in any possible degree of technical detail integration. Computer program products may include computer-readable storage media (or multiple media) having computer-readable program instructions for making a processor perform various aspects of the present invention. Computer-readable storage media may be a tangible device that can retain and store instructions for use by instruction execution devices. Computer-readable storage media may be, for example but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media may also include the following: portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), portable compact disk read-only memories (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protruding structures in the grooves with instructions recorded thereon, and any suitable combination of the above. Computer-readable storage media as used herein should not be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through wires.

[0111] The computer-readable program instructions described herein can be downloaded to the corresponding computing / processing equipment from the computer-readable storage medium via a network (e.g., the Internet, a local area network, a wide area network and / or a wireless network), or downloaded to an external computer or an external storage device. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers and / or edge servers. The network adapter card or network interface in each computing / processing equipment receives the computer-readable program instructions from the network, and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in the corresponding computing / processing equipment. The computer-readable program instructions for performing the operation of various aspects of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcodes, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages, and the one or more programming languages ​​include object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming languages ​​or similar programming languages). Computer readable program instructions can be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (for example, using an Internet service provider through the Internet). In certain embodiments, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can be customized by utilizing the state information of the computer readable program instructions to execute the computer readable program instructions, so as to perform aspects of the present invention.

[0112] The present invention will be described below with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to an embodiment of the present invention.It should be understood that each square frame of the flowchart and / or block diagram and the combination of each square frame in the flowchart and / or block diagram can be realized by computer-readable program instructions.These computer-readable program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for realizing the function / action specified in one or more boxes of the flowchart and / or block diagram.These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions make the computer, programmable data processing device, and / or other equipment work in a specific manner, so that the computer-readable storage medium wherein the instruction is stored includes the manufacture of the instruction of the aspect of the function / action specified in one or more boxes in the flowchart and / or block diagram. Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational actions are performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0113] The flow charts and block diagrams in the accompanying drawings show the architecture, functions and operations of the possible implementations of the system, method and computer program product according to different embodiments of the present invention. To this end, each box in the flow chart or block diagram may represent a module, segment or part of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the box may not occur in the order marked in the figure. For example, depending on the functions involved, the two blocks shown in succession can actually be executed substantially simultaneously, or these blocks can sometimes be executed in reverse order. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

[0114] Although the subject matter has been described above in the general context of computer executable instructions of computer program products running on computers and / or computers, it will be appreciated by those skilled in the art that the present disclosure may also be implemented or combined with other program modules. Typically, program modules include routines, programs, components, data structures, etc. that perform specific tasks and / or implement specific abstract data types. In addition, it will be appreciated by those skilled in the art that the computer-implemented method of the present invention may be practiced with other computer system configurations, including single-processor or multi-processor computer systems, small computing devices, large computers, and computers, handheld computing devices (e.g., PDAs, phones), microprocessor-based or programmable consumer or industrial electronics, etc. The aspects shown may also be implemented in a distributed computing environment, wherein tasks are performed by remote processing devices linked by a communication network. However, some (if not all) aspects of the present invention may be practiced on stand-alone computers. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

[0115] As used in this application, the terms "component", "system", "platform", "interface", etc. may refer to and / or may include computer-related entities or entities related to an operating machine having one or more specific functions. The entities disclosed herein may be hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process, a processor, an object, an executable file, an execution thread, a program, and / or a computer running on a processor. As an illustration, both an application running on a server and a server may be a component. One or more components may reside within a process and / or a thread of execution, and a component may be located on one computer and / or distributed between two or more computers. In another example, a corresponding component may be executed from different computer-readable media having different data structures stored thereon. Components may communicate via local and / or remote processes, such as according to a signal having one or more data packets (e.g., data from a component interacting with another component in a local system, a distributed system, and / or data from a component interacting with other systems across a network such as the Internet via the signal). As another example, a component may be a device having a specific function provided by a mechanical part operated by an electrical or electronic circuit, which is operated by a software or firmware application executed by a processor. In such cases, the processor may be internal or external to the device and may execute at least a portion of a software or firmware application. As yet another example, a component may be a device that provides a particular functionality through an electronic component without mechanical parts, where the electronic component may include a processor or other device for executing software or firmware that at least partially imparts the functionality to the electronic component. In one aspect, the component may emulate the electronic component via, for example, a virtual machine within a cloud computing system.

[0116] In addition, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or". That is, unless otherwise specified or clear from the context, "X employs A or B" is intended to mean any natural inclusive arrangement. That is, if X employs A; X employs B; or X employs both A and B, then "X employs A or B" is satisfied in any of the foregoing cases. In addition, the articles "a" and "an" as used in the subject specification and drawings should generally be interpreted as meaning "one or more" unless otherwise specified or clearly pointed to the singular form from the context. As used herein, the terms "example" and / or "exemplary" are used to indicate use as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited to such examples. In addition, any aspect or design described herein as an "example" and / or "exemplary" is not necessarily to be interpreted as superior or superior to other aspects or designs, nor is it meant to exclude equivalent exemplary structures and techniques known to ordinary technicians in the art.

[0117] As used in this specification, the term "processor" may refer to substantially any computing processing unit or device, including but not limited to a single-core processor; a single processor with software multithreaded execution capability; a multi-core processor; a multi-core processor with software multithreaded execution capability; a multi-core processor with hardware multithreading technology; a parallel platform; and a parallel platform with distributed shared memory. In addition, a processor may refer to an integrated circuit, an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic controller (PLC), a complex programmable logic device (CPLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. Further, the processor may utilize nanoscale architectures, such as, but not limited to, transistors, switches, and gates based on molecules and quantum dots, in order to optimize space usage or enhance the performance of user devices. The processor may also be implemented as a combination of computing processing units. In the present disclosure, terms such as "save", "storage", "data save", "data storage", "data storage", "database", and substantially any other information storage component related to the operation and function of the component are used to refer to a "memory component", an entity embodied in a "memory", or a component including a memory. It should be understood that the memory and / or memory components described herein may be volatile memory or non-volatile memory, or may include both volatile memory and non-volatile memory. As an example and not limitation, non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM), flash memory, or non-volatile random access memory (RAM) (e.g., ferroelectric RAM (FeRAM)). Volatile memory may include, for example, RAM that can act as an external cache memory. As an illustration and not limitation, RAM can be obtained in many forms, such as synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), direct Rambus RAM (DRRAM), direct Rambus dynamic RAM (DRDRAM) and Rambus dynamic RAM (RDRAM). In addition, the memory components of the system or computer-implemented method disclosed herein are intended to include (but not limited to) these and any other suitable types of memory.

[0118] What has been described above only includes examples of systems, computer program products, and computer-implemented methods. Of course, for the purpose of describing the present disclosure, it is impossible to describe every conceivable combination of components, products, and / or computer-implemented methods, but those of ordinary skill in the art will recognize that many further combinations and permutations of the present disclosure are possible. In addition, with respect to the use of the terms "including," "having," "having," and the like in the detailed description, claims, appendices, and drawings, these terms are intended to be inclusive in a manner similar to that in which the term "comprising" is interpreted as a transitional word in the claims. Descriptions of different embodiments have been presented for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Without departing from the scope of the described embodiments, many modifications and variations are apparent to those of ordinary skill in the art. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technologies found in the market, or to enable those of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A system for distributing security credentials, the system comprising: a memory storing computer executable components; a processor operably coupled to the memory and executing the computer executable components stored in the memory, wherein the computer executable components include: a trusted platform module component operable to generate a digital identity token bound to a computer application process; as well as A key authenticity component operable to compare the digital identity token to a security key to retrieve security credentials, wherein the digital identity token includes measurements describing a workload of the computer application process, wherein the computer application process generates a plurality of containers co-located within a network pod that governs how the plurality of containers are run by the computer application process and describes the workload of the computer application process.

2. The system of claim 1, further comprising: A policy authenticity component is operable to perform a comparison of the digital identity token with a defined policy governing the computer application process, wherein the retrieval of the security credentials is further based on the comparison.

3. The system of claim 1, wherein the digital identity token is signed by a hardware-derived chain of trust.

4. The system of claim 1, further comprising: An application component is configured to execute the computer application process by retrieving data from a database using the security credentials.

5. A system as described in claim 1, wherein the digital identity token is operable to expire after a defined amount of time, and wherein a header of the digital identity token includes a payload indicating data of a geographic region associated with one or more components running the computer application process.

6. A computer-implemented method for distributing security credentials, the method comprising: generating, by a system operatively coupled to the processor, a digital identity token bound to a computer application process; as well as comparing, by the system, the digital identity token to a security key to retrieve security credentials, wherein the digital identity token includes a measurement describing a workload of the computer application process; as well as A plurality of containers co-located within a pod are generated by the system, wherein the pod governs how the plurality of containers are run by a computer application process, and wherein the plurality of containers collect one or more statements about the computer application process and describe the workload of the computer application process.

7. The computer-implemented method of claim 6, further comprising: The digital identity token is compared, by the system, to a defined policy governing the computer application process, wherein retrieving the security credential is further based on the comparing the digital identity token to the defined policy.

8. The computer-implemented method of claim 6, wherein the digital identity token is signed by a hardware-derived chain of trust.

9. The computer-implemented method of claim 6, further comprising: The computer application process is executed by the system by retrieving data from a database using the security credentials.

10. The computer-implemented method of claim 6, wherein the digital identity token expires after a defined amount of time.

11. A computer program product for distributing security credentials, the computer program product comprising: A computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit to perform the method of any one of claims 6 to 10.

12. A computer-readable storage medium having a computer program stored thereon, the computer program being loaded into an internal memory of a digital computer, the computer program comprising a software code portion, and when the computer program is run on a computer, the software code portion is used to execute the method as claimed in any one of claims 6 to 10.

Images