Container-based cryptography hardware security module management

Abstract

Described herein are techniques for container-based cryptography hardware security module (HSM) management in a computer system. One aspect includes providing a cryptography worker daemon container in a computer system, where the cryptography worker daemon container in the computer system has privileged access to a cryptography HSM of the computer system. Another aspect includes receiving, by the cryptography worker daemon container, a request for a cryptography function of the cryptography HSM from an application container in the computer system. Another aspect includes causing, by the cryptography worker daemon container, the cryptography HSM to perform the cryptography function based on receiving the request.

Description

BACKGROUND

[0001] The present invention relates generally to computer systems, and more particularly to container-based cryptography hardware security module (HSM) management in computer systems.

[0002] Encryption is the process of transforming information so that it is unreadable to anyone except the intended recipient. Decryption is the process of transforming encrypted information so that it is understandable again. Cryptographic algorithms, also referred to as ciphers, are mathematical functions used for encryption or decryption. In most cases, two related functions are used, one for encryption and one for decryption. Many individuals and companies use encryption to protect all types of sensitive information.

[0003] For most modern cryptography, the ability to keep encrypted information secret is not based on the well-known cryptographic algorithm, but rather on a number called a key that must be used with the algorithm to produce the encrypted result or to decrypt previously encrypted information. Decryption with the correct key is simple. Decryption without the correct key should be very difficult, and at most impossible for all practical purposes. Encryption can be used for many purposes. For example, encryption can be used to exchange sensitive data in a secure manner over an untrusted channel (e.g., the Internet), or to protect access to sensitive data stored on some type of storage medium or in computer memory. SUMMARY

[0004] Embodiments of the invention relate to container-based cryptography hardware security module (HSM) management in computer systems. A non-limiting example computer-implemented method includes providing a cryptography worker daemon container in a computer system, where the cryptography worker daemon container in the computer system has privileged access to a cryptography HSM of the computer system. The method also includes receiving, by the cryptography worker daemon container, a request for a cryptography function of the cryptography HSM from an application container in the computer system. The method also includes causing, by the cryptography worker daemon container, the cryptography HSM to perform the cryptography function based on receiving the request.

[0005] Other embodiments of the invention implement features of the above-described methods in computer systems and computer program products.

[0006] Additional technical features and benefits are realized through the techniques of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered a part of the claimed subject matter. For a better understanding, refer to the specific embodiments and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0007] The specifics of the exclusive right described herein are particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other features and advantages of the embodiments of the application will become apparent to those of skill in the art from the following, when considered in connection with the accompanying drawings, in which:

[0008] Figure 1 is a block diagram of components of a system for container-based cryptography hardware security module (HSM) management according to one or more embodiments of the application;

[0009] Figure 2 is a flow diagram of a process for container-based cryptography HSM management according to one or more embodiments of the application;

[0010] Figure 3 is a flow diagram of a process for loading a new master key for container-based cryptography HSM management according to one or more embodiments of the application;

[0011] Figure 4 is a flow diagram of a process for container-based cryptography HSM management according to one or more embodiments of the application;

[0012] Figure 5 depicts a cloud computing environment in accordance with an embodiment of the application;

[0013] Figure 6 depicts an abstraction layer in accordance with an embodiment of the application; and

[0014] Figure 7 is a block diagram of an example computer system for use in connection with one or more embodiments of container-based cryptography HSM management. DETAILED DESCRIPTION

[0015] One or more embodiments of the application provide for container-based cryptography hardware security module (HSM) management. Hardware cryptographic functionality (e.g., encryption and decryption of data) in a computer system can be provided by a cryptographic HSM (e.g., a hardware security module) that is isolated from the operating system and other software running on the computer system. The cryptographic HSM can be used to perform cryptographic operations on data, such as encrypting and decrypting data, signing data, and verifying signatures on data. The cryptographic HSM can be used to protect data and to provide secure communications between devices. The services in such a computer system can be provided in multiple containers; each container can host an application that provides a particular set of functionality. In a system in which hardware-based cryptography is used for data encryption and decryption across a set of containers, it can be necessary to manage access to the cryptography HSM. For example, only a single container can be allowed to access the cryptography HSM at a given time. Thus, a cryptography worker daemon container can be provided that has privileged access to the cryptography HSM. The cryptography worker daemon container can control access to the cryptography HSM by other containers in the system, such that other containers in the system can access the cryptography HSM through requests to the cryptography worker daemon container. For example, an application container can request that the cryptography worker daemon container perform decryption of data at application startup.

[0016] The cryptography worker daemon container can provide any suitable functionality, including but not limited to creating enterprise public key #11 (EP11) keys, storing the created keys in a public key cryptography standard #11 (PKCS11) keystore, and using the stored keys to encrypt and decrypt data. When a master key rollover or update occurs in the cryptography HSM, the cryptography worker daemon container can re-encrypt any stored keys. When a master key rollover is performed, a migration tool can be run to migrate existing token objects to be re-encrypted under the new master key. The migration tool can be run by the cryptography worker daemon container, as running the migration tool can require privileged access to the cryptography HSM. However, as only privileged users should be allowed to run the migration tool, a separate cryptography administrator container can be provided in order to separate the application administrator role from the security administrator role for the purpose of performing master key rollovers in the cryptography HSM. The security administrator role can have no rights to the application, and the application administrator role can have no rights to the cryptography HSM.

[0017] A diagnostic tool can be run by the cryptography worker daemon container in order to obtain diagnostic information from the cryptography HSM. The diagnostic information output by the diagnostic tool can be stored and shared among containers via a shared storage container. Once the diagnostic information is in shared storage, the diagnostic information persists and can be accessed by other containers as needed. For example, a first failure data capture (FFDC) container can monitor the diagnostic information in shared storage and can dump the diagnostic information upon user request. The FFDC container does not need physical access to the cryptography HSM in order to access the diagnostic information in shared storage. A support team can verify that the correct keys are being used based on the diagnostic information without needing to directly access the cryptography worker daemon container or the cryptography HSM, and key material can not be exposed to verification.

[0018] Turning now to Figure 1According to one or more embodiments of the present invention, a system 100 generally includes container-based cryptographic HSM management. Some embodiments of system 100 may be described below regarding... Figure 5 and Figure 6 The discussed cloud computing environment is used for implementation. System 100 includes multiple containers 101A-N. Each container 101A-N may host one or more applications and may each include a set of corresponding binaries and libraries running within the container to support any functionality provided by the corresponding application within the container. Containers 101A-N are managed by a container runtime environment 102 running on operating system 103. Operating system 103 may be any suitable operating system, and it is hosted by hardware infrastructure 104. Infrastructure 104 may correspond to any suitable computer system, including but not limited to... Figure 7 The computer system 700. Infrastructure 104 includes a cryptographic HSM 105. In some embodiments of the invention, the cryptographic HSM 105 may include... Card. Container runtime environment 102 may include any suitable container runtime environment, including but not limited to those described in some embodiments of the present invention. The management procedures, and may include, as in some embodiments of the present invention, [the following]. The container management system. The location of containers 101A-N can be dynamic, allowing the container runtime environment 102 to track the location and network addressing information of each container during the operation of system 100.

[0019] like Figure 1 As shown, containers 101A-N include a cryptographic worker daemon container 101A, a cryptographic administrator container 101B, a queue manager container 101C, a shared storage container 101D, and an FFDC container 101E. The cryptographic worker daemon container 101A has privileged access to the cryptographic HSM 105 and can be configured according to the following discussion. Figure 2 Method 200 is used to regulate access to the cryptographic HSM 105 for other containers 101B-N in system 100. This can be discussed below. Figure 3 Method 300 and Figure 4 Method 400 manages cryptography-related tasks within system 100. For example, the cryptography administrator container 101B can implement... Figure 3Method 300 updates the functionality required to update the master key in the cryptographic HSM 105. When a master key rollover or update occurs in the cryptographic HSM 105, the cryptographic worker daemon container 101A can run a migration tool to re-encrypt any stored keys. The migration tool can be run by the cryptographic worker daemon container 101A because running the migration tool may require privileged access to the cryptographic HSM. However, since only privileged users should be allowed to run the migration tool, a separate cryptographic administrator container 101B can be provided for the purpose of performing master key rollover in the cryptographic HSM 105 to separate the application administrator role from the security administrator role. The cryptographic administrator container 101B allows the cryptographic worker daemon container 101A to run the migration tool based on input from the security administrator. The security administrator role may not have permissions on the cryptographic worker daemon application, and the application administrator role may not have permissions on the cryptographic HSM 105. Furthermore, according to Figure 4 In method 400, diagnostic information regarding the cryptographic HSM 105 can be collected by the cryptographic worker daemon container 101A and stored in a shared storage device by the shared storage device container 101D. The diagnostic information in the shared storage device can be accessed by other containers in the system 100, such as the FFDC container 101E.

[0020] It should be understood that Figure 1 The block diagram is not intended to indicate that system 100 will include Figure 1 All components shown. Conversely, system 100 may include... Figure 1 Any suitable fewer or additional components not shown herein (e.g., additional memory components, embedded controllers, function blocks, connections between function blocks, modules, inputs, outputs, containers, applications, etc.). Furthermore, the embodiments described herein with respect to system 100 can be implemented with any suitable logic, wherein the logic mentioned herein may include any suitable hardware (e.g., processor, embedded controller, or application-specific integrated circuit, etc.), software (e.g., applications, etc.), firmware, or any suitable combination of hardware, software, and firmware.

[0021] Figure 2 A processing flowchart of a method 200 for container-based cryptographic HSM management according to one or more embodiments of the present invention is shown. Figure 2 Method 200 can be combined Figure 1The system 100 is implemented and discussed with reference thereto. In block 201, an application container in system 100, such as application container 101N, sends a request to queue manager container 101C to decrypt previously encrypted data. The encrypted data may belong to application container 101N and may be stored in memory in infrastructure 104. In some embodiments of the invention, the request for block 201 may be sent when an application in application container 101N starts. In some embodiments of the invention, the request for block 201 may be... Message Service (JMS) message sending. In box 202, the cryptographic worker daemon container 101A receives a request from the queue manager container 101C and uses cryptographic HSM 105 to decrypt the encrypted data. In box 203, the cryptographic worker daemon container 101A sends the decrypted data to the requesting application container 101N. In some embodiments of box 203, the decrypted data may be sent as a JMS message. In box 204, the application container 101N stores the decrypted data in memory within infrastructure 104. In some embodiments of box 204, the application container 101N may store the decrypted data in temporary file storage (tmpfs) in virtual memory within infrastructure 104. The application container 101N can then use the decrypted data to perform any suitable operations.

[0022] Figure 2 The process flowchart is not intended to indicate that the operations of method 200 will be performed in any particular order, or that all operations of method 200 will be included in every case. Furthermore, method 200 may include any suitable number of additional operations.

[0023] Figure 3 A process flowchart of a method 300 for loading a new master key for container-based cryptographic HSM management is shown according to one or more embodiments of the present invention. Figure 3 Method 300 can be combined Figure 1 The implementation of System 100 is described below, and will be discussed with reference thereto. In block 301, the cryptographic work daemon container 101A is stopped and removed from System 100 to give control of the cryptographic HSM 105 to a host including operating system 103 and infrastructure 104. In block 302, a master key rolling service is started on the host. In some embodiments of the invention, the master key rolling service may include an Enterprise Public Key Cryptography Standard #11 Trusted Key Input Daemon (ep11TKEd). In block 303, a new master key is loaded and submitted to the cryptographic HSM 105 using the master key rolling service. In some embodiments of the invention, in block 303, the new master key may be loaded and submitted to the cryptographic HSM 105 via a Trusted Key Entry (TKE).

[0024] In block 304, the cryptography worker daemon container 101 A is recreated and restarted in the system 100. In block 305, the cryptography administrator container 101 B sends a re-encryption request to the queue manager container 101 C. The request of block 305 can be initiated by a security administrator of the system 100 and can be a JMS message in some embodiments of the present application. In block 306, the cryptography worker daemon container 101 A receives the request of block 305 from the queue manager container 101 C and re-encrypts the token objects using the new master key loaded and committed in block 303 by running the migration tool. In block 307, the re-encrypted token objects are stored in shared storage (e.g., a network file system) in the system 100 using the shared storage container 101 D.

[0025] In block 308, the cryptography worker daemon container 101 A is stopped and removed from the system 100. In block 309, the new master key is set in the cryptography HSM 105 using the TKE and the master key roll service started in block 302 of the method 300 in the system 100 is stopped. In block 310, the cryptography worker daemon container 101 A is recreated and restarted in the system 100 so that during operation of the system 100, access to the cryptography HSM 105 by the other containers 101 B-N for encryption and decryption functions based on the new master key is performed via the cryptography worker daemon container 101 A.

[0026] Figure 3 The process flow diagram of FIG. 4 is not intended to indicate that the operations of the method 400 are to be executed in any particular order, or that all of the operations of the method 400 are to be included in every case. Additionally, the method 400 can include any

[0027] Figure 4 A process flow diagram of a method 400 for container-based cryptography HSM management according to one or more embodiments of the present application is shown. Figure 4 The method 400 of FIG. 4 can incorporate Figure 1The embodiments of system 100 are implemented, and discussed with reference to, FIG. 4. In block 401, a cryptography HSM diagnostic tool is run in cryptography worker daemon container 101 A. The HSM diagnostic tool can gather any suitable diagnostic information from cryptography HSM 105, including but not limited to basic card information and / or a history of master keys that have been used by cryptography HSM 105. The card information that can be gathered in block 401 can include the card's online status, the card's mode, and a hardware password count. The history of master keys that can be gathered in block 401 can include the current master key mode, any previous master key modes, and timestamps of when the master key was changed in cryptography HSM 105. In some embodiments of block 401, the diagnostic information can be gathered by using an application programming interface (API) that can interact with cryptography worker daemon container 101 A. In some embodiments of the present invention, the API can be invoked by an authorized user, or the diagnostic tool can be run periodically using a time-based scheduler tool such as cron. In block 402, shared storage container 101 D stores the diagnostic information output by the HSM diagnostic tool in a shared storage (e.g., a network file system) in system 100.

[0028] In block 403, a time-based scheduler in cryptography administrator container 101 B collects the diagnostic information stored in the shared storage, as well as any other useful diagnostic information. In block 404, an authorized user requests a dump of the collected diagnostic information. The authorized user can request the dump of the diagnostic information by interacting with FFDC container 101 E. The authorized user can be part of a support team that administers system 100. In block 405, the authorized user receives the dump of the diagnostic information from, for example, FFDC container 101 E. The diagnostic information can allow the authorized user to diagnose various problems in cryptography HSM 105, including but not limited to whether the master key is incorrect or whether the card is offline, without needing to directly access cryptography HSM 105.

[0029] Figure 4 The process flow diagram of FIG. 4 is not intended to indicate that the operations of method 400 are to be executed in any particular order, or that all of the operations of method 400 are to be included in every instance of method 400. Additionally, method 400 can include any suitable number of additional operations.

[0030] It should be appreciated that, although the present disclosure includes detailed descriptions of cloud computing, implementation of the teachings presented herein are not limited to cloud computing environments. Rather, embodiments of the present invention are capable of being implemented in conjunction with any other type of computing environment now known or later developed.

[0031] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage devices, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0032] The features are as follows:

[0033] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring manual interaction with the service provider.

[0034] Wide Area Network (WAN) Access: Capabilities are available on the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0035] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. Location independence has significance because consumers typically do not control or know the exact location of the provided resources, but can specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0036] Rapid Flexibility: In some cases, the ability to scale outwards and inwards quickly and flexibly can be provided. For consumers, the available capacity often appears unlimited and can be purchased in any quantity at any time.

[0037] Measurement services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both the providers and consumers of the services being utilized.

[0038] The service model is as follows:

[0039] Software as a Service (SaaS): The capability offered to consumers is the ability to use the provider's applications running on cloud infrastructure. Applications can be accessed from various client devices through a thin client interface such as a web browser (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage devices, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0040] Platform as a Service (PaaS): the capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

[0041] Infrastructure as a Service (IaaS): the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).

[0042] Deployment models are as follows:

[0043] Private cloud: the cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0044] Community cloud: the cloud infrastructure is shared by several organizations and supports mission-oriented business

[0045] Public cloud: the cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

[0046] Hybrid cloud: the cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together, giving customers the benefit of combined services.

[0047] A cloud computing environment is service-oriented, with a focus on statelessness, loose coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure comprising a network of interconnected nodes.

[0048] Reference is now made to Figure 5, an illustrative cloud computing environment 50 is depicted. As shown, cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as, for example, personal digital assistant (PDA) or cellular telephone 54A, desktop computer 54B, laptop computer 54C, and / or automobile computer system 54N can communicate. Nodes 10 can communicate with one another. They can be grouped (not shown) physically or virtually, in one or more networks, such as Private, Community, Public, or Hybrid clouds as described hereinabove, or a combination thereof. This allows cloud computing environment 50 to offer infrastructure, platforms and / or software as services with Figure 5 The types of computing devices 54A-N shown in FIG. 10 are intended to be illustrative only and computing nodes 10 and cloud computing environment 50 can communicate with any type of computing device over any type of network and / or network addressable connection (e.g., using a web browser).

[0049] Referring now to FIG. 11, Figure 6 a set of functional abstraction layers are provided by cloud computing environment 50 Figure 5 It should be previously understood that any components, layers and functions shown in FIG. 11 are merely for illustration and embodiments of the present application are not limited thereto. As depicted, the following layers and corresponding functions are provided: Figure 6 Hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframes 61; RISC (Reduced Instruction Set Computer) architecture based servers 62; servers 63; blade servers 64; storage devices 65; and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0050] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71; virtual storage 72; virtual networks 73, including virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0051]

[0052] ​In one example, management layer 80 can provide the functionality described herein. Resource provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking when utilizing resources in the cloud computing environment, as well as billing or invoicing for consuming these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-scheduling and procurement of cloud resources, where future needs are anticipated according to the SLA.

[0053] Workload layer 90 provides examples of functionalities that can leverage a cloud computing environment. Examples of workloads and functionalities that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis and processing 94; transaction processing 95; and cryptographic HSM management 96. Hardware 60 may include the cryptographic HSM in embodiments of the present invention, and cryptographic HSM management 96 may be implemented by implementing the above-mentioned... Figures 1-4 The discussion focuses on any functionality to manage access to the cryptographic HSM.

[0054] Turn now Figure 7 A computer system 700 according to an embodiment is generally illustrated. The computer system 700 can be an electronic computer architecture including and / or employing any number of computing devices and networks and combinations thereof, which utilize various communication technologies as described herein. The computer system 700 can be easily scalable, extensible, and modular, with the ability to change to different services or reconfigure some features independently of others. The computer system 700 can be, for example, a server, desktop computer, laptop computer, tablet computer, or smartphone. In some examples, the computer system 700 can be a cloud computing node. The computer system 700 can be described in the general context of computer system executable instructions, such as program modules executed by the computer system. Typically, program modules can include routines, programs, objects, components, logic, data structures, etc., that perform a specific task or implement a specific abstract data type. The computer system 700 can be practiced in a distributed cloud computing environment, where tasks are performed by remote processing devices linked via a communication network. In a distributed cloud computing environment, program modules can reside in local and remote computer system storage media, including memory storage devices.

[0055] like Figure 7As shown, computer system 700 has one or more central processing units (CPU) 701a, 701b, 701c, etc. (collectively referred to as processor 701). Processor 701 can be a single core processor, multi-core processor, computing cluster, or any number of other configurations. Processor 701, also referred to as processing circuitry, is coupled with system memory 703 and various other components via system bus 702. System memory 703 can include read only memory (ROM) 704 and random access memory (RAM) 705. ROM 704 is coupled to system bus 702 and can include a basic input / output system (BIOS) that controls certain basic functions of computer system 700. RAM is read / write memory coupled to system bus 702 for use by processor 701. System memory 703 provides temporary storage for the operation of said instructions during operation. System memory 703 can include random access memory (RAM), read only memory, flash memory, or any other suitable memory system.

[0056] Computer system 700 includes input / output (I / O) adapter 706 and communications adapter 707 coupled to system bus 702. I / O adapter 706 can be a small computer system interface (SCSI) adapter that communicates with a hard disk 708 and / or any other similar component. I / O adapter 706 and hard disk 708 are collectively referred to herein as mass storage 710.

[0057] Software 711 for execution on computer system 700 can be stored in mass storage 710. Mass storage 710 is an example of a tangible storage medium for the storage of instructions which are read / executed by processor 701 to cause computer system 700 to operate as described herein with respect to the various figures. Examples of computer program products and execution of such instructions are discussed in greater detail herein. Communications adapter 707 interconnects system bus 702 with network 712 (which can be an external network) so that computer system 700 can communicate with other systems via network 712. In one embodiment, a portion of system memory 703 and mass storage 710 collectively store an operating system, which can be any suitable operating system, such as the z / OS or AIX operating systems from IBM Corporation, to coordinate the functions of various components shown in FIG. 1. Figure 7 the functions of the various components shown in FIG. 1.

[0058] Additional input / output devices are shown connected to system bus 702 via display adapter 715 and interface adapter 716. In one embodiment, adapters 706, 707, 715, and 716 may be connected to one or more I / O buses that are connected to system bus 702 via an intermediate bus bridge (not shown). Display 719 (e.g., a screen or display monitor) is connected to system bus 702 through display adapter 715, which may include a graphics controller and a video controller for improving the performance of graphics-intensive applications. Keyboard 721, mouse 722, speaker 723, etc. may be interconnected to system bus 702 via interface adapter 716, which may include, for example, a super I / O chip that integrates multiple device adapters into a single integrated circuit. Suitable I / O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols such as Peripheral Component Interconnect (PCI). Thus, as Figure 7 configured, computer system 700 includes processing capabilities in the form of processor 701, and storage capabilities including system memory 703 and mass storage device 710, input components such as keyboard 721 and mouse 722, and output capabilities including speaker 723 and display 719.

[0059] In some embodiments, communication adapter 707 may use any suitable interface or protocol to transmit data, such as Internet Small Computer System Interface, etc. Network 712 may be a cellular network, a radio network, a Wide Area Network (WAN), a Local Area Network (LAN), or the Internet, etc. An external computing device may be connected to computer system 700 through network 712. In some examples, the external computing device may be an external network server or a cloud computing node.

[0060] It should be understood that Figure 7 the block diagram is not intended to indicate that computer system 700 will include Figure 7 all the components shown in Figure 7 but that computer system 700 may include Figure 7 any suitable fewer or additional components not shown in

[0061] Various embodiments of the present application are described herein with reference to the accompanying drawings. Alternative embodiments of the application can be devised without departing from the scope of the present application. Various connections and positional relationships (e.g., over, below, adjacent, etc.) are set forth in the following description and drawings. These various connections and / or positional relationships, unless otherwise stated, can be direct or indirect, and the present application is not intended to be limiting in this respect. Thus, a coupling can be direct or indirect and the positioning of entities can be relative positioning in direct or indirect connection. In addition, various tasks and process steps described herein can be incorporated in more comprehensive programs, procedures, or processes having additional steps or functionality not described in detail herein.

[0062] One or more methods described herein can be implemented in any of the following technologies, or their combination, which are known in the art: a discrete logic circuit(s) having logic gates for implementing logic functions upon an application of data signals; an application specific integrated circuit (ASIC), a programmable gate array(s) (PGA), a field programmable gate array (FPGA), etc. that can be programmed in situ.

[0063] For the sake of brevity, conventional techniques related to making and using aspects of the application can or can not be described in detail herein. In particular, various aspects of computing systems and specific computer programs to implement the various technical features described herein are well known. Accordingly, in the interest of brevity, many conventional implementation details are only mentioned briefly herein or are omitted entirely without providing the well-known system and / or process details.

[0064] In some embodiments, various functions or acts can be performed in a given position and / or in connection with the operation of one or more apparatuses or systems. In some embodiments, a portion of a given function or act can be performed in a first device or location and the remainder of the function or act can be performed in one or more additional devices or locations.

[0065] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0066] Corresponding structure, material, acts, and equivalents of all means or step plus function elements are intended to include any structures, materials, or acts for performing the functions in combination with other claimed elements as specifically claimed. The present disclosure is presented to enable anyone skilled in the art to make and use like embodiments of the disclosure, and the best mode of carrying out the same is thus described in sufficient detail to enable others skilled in the art to practice the disclosure. The disclosure is not intended to be exhaustive or to show all available ways of making and using it. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments were chosen and described in order to best explain the principles of the disclosure and its practical application, and to thereby enable others skilled in the art to best utilize the disclosure with various modifications as are suited to the particular use contemplated.

[0067] The diagrams described herein are illustrative. There can be many variations to the diagrams or the steps (or operations) described therein without departing from the scope of the disclosure. For instance, the actions can be performed in a differing order or actions can be added, deleted, modified, or modified. Additionally, the term “coupled” describes having a signal pathway between two elements and does not imply a direct connection between elements with no intermediate elements / connection therebetween. All such variations are considered part of the disclosure.

[0068] The following definitions and abbreviations are used in the claims and specification. As used herein, the terms “comprises,” “comprising,” “includes,” “including,” “has,” “having,” or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a composition, a mixture, a process, a method, an article, or an apparatus that comprises a list of elements is not necessarily limited to only those elements but can include other elements not expressly listed or inherent to such composition, mixture, process, method, article, or apparatus.

[0069] In addition, the term “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any embodiment or design described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms “at least one” and “one or more” are understood to include any integer greater than or equal to one, i.e. one, two, three, four, etc. The term “plurality” is understood to include any integer greater than or equal to two, i.e. two, three, four, five, etc. The term “connected” can include both an indirect “connection” and a direct “connection.”

[0070] The terms “about,” “substantially,” “approximately,” and variations thereof, are intended to encompass a degree of error acceptable by the art for the particular quantification measured. For example, “about” can include a range of ± 8% or 5%, or 2% of a given value.

[0071] The present application can be a system, a method, and / or a computer program product at any possible technical detail level of integration. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present application.

[0072] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted via a wire cable. Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage and / or execution. Computer readable program instructions for carrying out aspects of the present application can be any desirable set of instructions to be executed on a computer or processing device. The computer readable program instructions may

[0073] The computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage and / or execution. Computer readable program instructions for carrying out aspects of the present application can be any desirable set of instructions to be executed on a computer or processing device. The computer readable program instructions may

[0074] Computer readable program instructions for carrying out operations of the present application can be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for an integrated circuit, or source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and a procedural programming language such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present application.

[0075] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0076] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including

[0077] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0078] The computer program product of the present application can be a computer program product which implements the methods of the present application. The computer program product can comprise a computer-readable storage medium having stored thereon a computer program of the present application. A computer program can also be presented over a network as a sequence of instructions to be executed by a programmable processing system. The computer program can be downloaded to a volatile memory or to a non-volatile memory from the network or to a storage medium (e.g., a solid state memory, a magnetic or optical disk) as a computer-readable data signal. The computer-readable data signal can be a data signal that has been modulated to have one or more instructions executable by the programmable processing system to perform a method of the present application. The computer-readable data signal can be transmitted using any apparatus designed for transmitting information.

[0079] The description of the various embodiments of the application has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the described embodiments. The terminology used is chosen for the best explanation of the principles of the embodiments, the actual application, or to enable others skilled in the art to practice the embodiments as described herein.

Claims

1. A computer-implemented method comprising: providing, by a processor, a cryptography worker daemon container in a computer system, wherein the cryptography worker daemon container in the computer system has privileged access to a cryptography hardware security module (HSM) of the computer system; receiving, by the cryptography worker daemon container, a request for a cryptography function of the cryptography HSM from one or more application containers in the computer system, wherein the one or more application containers access the cryptography HSM through requests to the cryptography worker daemon container and only a single one of the application containers is permitted to access the cryptography HSM at a given time; causing, by the cryptography worker daemon container, the cryptography HSM to perform the cryptography function based on receiving the request; and performing, in the cryptography HSM, a master key rollover, wherein performing the master key rollover comprises: based on a new master key being committed: sending, from a cryptography administrator container to the cryptography worker daemon container, a re-encryption request; based on receiving the re-encryption request, running, by the cryptography worker daemon container, a migration tool, wherein the migration tool re-encrypts token objects using the new master key; and storing the re-encrypted token objects in shared storage in the computer system.

2. The method of claim 1, wherein the request comprises a decryption request; wherein causing the cryptography HSM to perform the cryptography function comprises causing the cryptography HSM to decrypt data belonging to the application container; and wherein the method further comprises providing, from the cryptography worker daemon container, the decrypted data to the application container.

3. The method of claim 2, wherein the application container sends the request based on a launch of the application container, and wherein the application container uses the decrypted data to perform an operation.

4. The method of claim 1, wherein the re-encryption request is sent by a security administrator of the computer system.

5. The method of claim 1, further comprising: running, by the cryptography worker daemon container, an HSM diagnostic tool that gathers diagnostic information from the cryptography HSM; storing the diagnostic information in shared storage in the computer system; gathering, by a cryptography administrator container, the diagnostic information from the shared storage; and providing the gathered diagnostic information to a user. providing the gathered diagnostic information to the user based on receiving a dump request from the user through a first fault data capture (FFDC) container.

7. A system comprising:

6. The method of claim 5, wherein, memory having computer-readable instructions; and one or more processors for executing the computer-readable instructions, the computer-readable instructions controlling the one or more processors to perform operations comprising: providing a cryptography worker daemon container in a computer system, wherein the cryptography worker daemon container in the computer system has privileged access to a cryptography hardware security module (HSM) of the computer system; ​ ​ ​ receiving, by the cryptography worker daemon container, a request for a cryptography function of the cryptography HSM from one or more application containers in the computer system, wherein the one or more application containers access the cryptography HSM through requests to the cryptography worker daemon container, and only a single one of the application containers is permitted to access the cryptography HSM at a given time; causing, by the cryptography worker daemon container, the cryptography HSM to perform the cryptography function based on receiving the request; and performing a master key rollover in the cryptography HSM, wherein performing the master key rollover comprises: based on a new master key being committed: sending a re-encryption request from a cryptography administrator container to the cryptography worker daemon container; based on receiving the re-encryption request, running, by the cryptography worker daemon container, a migration tool, wherein the migration tool re-encrypts token objects using the new master key; and storing the re-encrypted token objects in shared storage in the computer system.

8. The system of claim 7, wherein the request comprises a decryption request; wherein causing the cryptography HSM to perform the cryptography function comprises causing the cryptography HSM to decrypt data belonging to the application container; and wherein the operations further comprise providing the decrypted data from the cryptography worker daemon container to the application container.

9. The system of claim 8, wherein the application container sends the request based on a launch of the application container, and wherein the application container uses the decrypted data to perform an operation.

10. The system of claim 7, wherein the re-encryption request is sent by a security administrator of the computer system.

11. The system of claim 7, wherein the operations further comprise: running, by the cryptography worker daemon container, an HSM diagnostic tool that gathers diagnostic information from the cryptography HSM; storing the diagnostic information in shared storage in the computer system; gathering, by a cryptography administrator container, the diagnostic information from the shared storage; and providing the gathered diagnostic information to a user. providing the gathered diagnostic information to the user based on receiving a dump request from the user through a first fault data capture (FFDC) container.

12. The system of claim 11, wherein, 13. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising: providing a cryptography worker daemon container in a computer system, wherein the cryptography worker daemon container in the computer system has privileged access to a cryptography hardware security module (HSM) of the computer system; providing a cryptography worker daemon container in a computer system, wherein the cryptography worker daemon container in the computer system has privileged access to a cryptography hardware security module (HSM) of the computer system; receiving, by the cryptography worker daemon container, a request for a cryptography function of the cryptography HSM from one or more application containers in the computer system, wherein the one or more application containers access the cryptography HSM through requests to the cryptography worker daemon container, and only a single one of the application containers is allowed to access the cryptography HSM at a given time; causing, by the cryptography worker daemon container, the cryptography HSM to perform the cryptography function based on receiving the request; and performing a master key rollover in the cryptography HSM, wherein performing the master key rollover comprises: based on a new master key being committed: sending a re-encryption request from a cryptography administrator container to the cryptography worker daemon container; based on receiving the re-encryption request, running, by the cryptography worker daemon container, a migration tool, wherein the migration tool re-encrypts token objects using the new master key; and storing the re-encrypted token objects in shared storage in the computer system.

14. The computer program product of claim 13, wherein the request comprises a decryption request; wherein causing the cryptography HSM to perform the cryptography function comprises causing the cryptography HSM to decrypt data belonging to the application container; and wherein the operations further comprise providing the decrypted data from the cryptography worker daemon container to the application container.

15. The computer program product of claim 14, wherein the application container sends the request based on a launch of the application container, and wherein the application container uses the decrypted data to perform an operation.

16. The computer program product of claim 13, wherein the re-encryption request is sent by a security administrator of the computer system.

17. The computer program product of claim 13, wherein the operations further comprise: running, by the cryptography worker daemon container, an HSM diagnostic tool that gathers diagnostic information from the cryptography HSM; storing the diagnostic information in shared storage in the computer system; collecting, by a cryptography administrator container, the diagnostic information from the shared storage; and providing the collected diagnostic information to a user. ​

Images