Distribution of security authorization certificates

Abstract

System (100) for distributing a security credential, wherein the system (100) comprises: a main memory (116, 1216) storing computer-executable components; a processor (120, 1214) operably connected to the main memory (116, 1216) and executing the computer-executable components stored in the main memory (116, 1216), wherein the computer-executable components comprise: a trusted platform module component (202) executable to generate (802, 904) a digital identity token (300) bound to a computer application process (600), wherein the generation (802, 904) is based on one or more metrics describing one or more workloads of the computer application process (600);and an authentication component that is executable to parse the digital identity token (300) to retrieve a security credential, wherein the authentication component includes a key authentication component (402) to compare the digital identity token (300) with a security key (804, 906) to retrieve a security credential based on the comparison (804, 906); and wherein the authentication component includes a policy authentication component (502) that is executable to perform a comparison (806, 908) of the digital identity token (300) with a defined policy that controls the computer application process (600), wherein retrieving the security credential is further based on the comparison (806, 908).

Description

Technical FieldThe present disclosure relates to distribution of data security credentials and, more particularly, to one or more data security processes that may restrict access to security credentials to service provider administrators via a credential release system based on credential from one or more computer application workloads.BACKGROUNDSome cloud computing customers require a cloud in which the service provider cannot access the customer data. Conventional technologies practiced to accomplish this goal may include secure key transfer protocols, trusted platform modules, and / or host origin and integrity. However, traditional technologies may be compromised by malicious and / or malicious administrators and / or entities issuing as administrators.Accordingly, there is a need in the art to address the above problem.US 2014 / 0 208 409 A1 describes a system comprising: a server arranged in a local environment, wherein the server stores an access policy comprising a first set of access rights defining access to data stored in encrypted form in a cloud environment by a requesting application and a first user, wherein the local environment is under the control of a second user, wherein the cloud environment is not under the control of the second user, and wherein the server is configured to: receive a request, which is connected to the requesting application and the first user, to access the data stored in the cloud environment from a rights application; transmitting the first set of access rights and a decryption key for the data to the rights application in response to the first user having the rights required for the requesting application to access the data according to the access policy, wherein the rights application is configured to decrypt the data, to forward the decrypted data to the requesting application, and to allow it to access the decrypted data in accordance with the first set of access rights.The encyclopedia article "Hardware security module", in: Wikipedia, the free encyclopedia, State of Work: 04.06.2019, URL: https: / / en.wikipedia.org / w / index.php?tile=Hardware security module&old=9002 29769, describes a hardware security module (HSM) as a physical computing device that protects and manages secrets (primarily digital keys), performs digital signature encryption and decryption functions, strong authentication, and other cryptographic functions. These modules are traditionally available as a circuit card or external device that is directly connected to a computer or network server. A hardware security module may delete one or more secure cryptoprocessor chips. HSMs may have functions that enable tamper evidence, such as visual indicia of tampering or logging and alert, or tamper resistance that hinders tampering without rendering the HSM inoperative, or tampering response, such as clearing keys upon detection of tampering. The vast majority of HSMs present are designed mainly for the management of secret keys. Many HSM systems have means for secure protection of the keys they manage outside the HSM. The keys may be secured in packaged form and stored on a computer hard disk or other medium or externally on a secure portable device such as a smart card or other security token. HSMs are used for real-time authorization and authentication in critical infrastructures and are therefore generally designed to support standard high availability models such as clustering, automatic failover and redundant, field replaceable components. Possible functions of an HSM include: integrated generation of secure cryptographic keys; integrated storage of secure cryptographic keys, at least for the top level and most sensitive keys, often referred to as master keys; key management; use of cryptographic and sensitive data, e.g., to perform decryption or digital signature functions; integrated secure deletion of cryptographic and other sensitive data managed by it. HSMs are also used to manage transparent data encryption keys for databases and keys for storage devices such as hard disks or tapes.The encyclopedia article "Public-key cryptography", in: Wikipedia, the free encyclopedia, State of Work: 11.06.2019, URL: https: / / en.wikipedia.org / w / index.php?tile=Publi-key cryptography&oldid=901437054, describes public key cryptography or asymmetric cryptography as a range of cryptographic systems using pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated using cryptographic algorithms based on mathematical problems called one-way functions. The security of public key cryptography depends on keeping the private key secret; the public key can be distributed openly without compromising security. In a public key system, the public keys can be made widely and openly accessible, and only the corresponding private keys need to be kept secret by their owner. Two of the most common applications of public key cryptography are: public key encryption in which a message is encrypted with the public key of the intended recipient, and digital signatures in which a message is signed with the sender's private key and can be verified by anyone who has access to the sender's public key. One possible application of a public key encryption system is to encrypt communication to ensure confidentiality - a message that encrypts a sender with the recipient's public key that can only be decrypted with the recipient's associated private key. Another application of public key cryptography is digital signature. Digital signature schemes can be used for sender authentication. Non-excitability systems use digital signatures to ensure that a party cannot successfully excitate the copyright of a document or message. Other applications that build based on this are: digital cash, password authenticated key agreement, timestamp services, and non-provokingability protocols.SUMMARYViewed from a first aspect, the present invention provides a system for distributing a security credential, the system comprising: a main memory storing computer executable components; a processor operatively connected to the main memory and executing the computer executable components stored in the main memory; the computer executable components comprising: a trusted platform module component executable to generate a digital identity token bound to a computer application process; and an authenticity component executable to analyze the digital identity token into a security key to retrieve a security credential.Viewed from another aspect, the present invention provides a computer-implemented method for distributing a security credential, the method comprising: generating, by a system operatively connected to a processor, a digital identity token associated with a computer application process; and analyzing, by the system, the digital identity token into a security key to retrieve a security credential.Viewed from another aspect, the present invention provides a system comprising: a main memory storing computer executable components; a processor operatively connected to the main memory and executing the computer executable components stored in the main memory, the computer executable components comprising: a trusted platform module component that generates a digital identity token bound to a computer application process; and a key authenticity component that compares the digital identity token with a security key to retrieve a security credential.Viewed from another aspect, the present invention provides a system comprising: a main memory storing computer executable components; a processor operatively connected to the main memory and executing the computer executable components stored in the main memory; the computer executable components comprising: a trusted platform module component that generates a digital identity token bound to a computer application process; and a policy authenticity component that compares the digital identity token to a defined policy that controls the computer application process to retrieve a security credential.Viewed from another aspect, the present invention provides a method performed by a computer, comprising: generating, by a system operatively connected to a processor, a digital identity token associated with a computer application process; and comparing, by the system, the digital identity token with a security key to retrieve a security credential.A computer-executed method comprising: generating, by a system operatively connected to a processor, a digital identity token associated with a computer application process; and comparing, by the system, the digital identity token to a defined policy that controls the computer application process to retrieve a security credential.Viewed from a further aspect, the present invention provides a computer program product for distributing a security credential, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to: generate, by a system operatively connected to the processor, a digital identity token associated with a computer application process; and compare, by the system, the digital identity token with a security key to retrieve a security credential.Viewed from a further aspect, the present invention provides a computer program product for distributing security credential, the computer program product comprising a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit to perform a method of performing the steps of the invention.Viewed from a further aspect, the present invention provides a computer program stored on a computer readable medium and loadable into internal main memory of a digital computer, the computer program comprising portions of software code when the program is run on a computer to perform the steps of the invention.A summary is presented below to provide a basic understanding of one or more embodiments of the invention. This summary is not intended to identify key or critical elements or to outline any scope of the respective embodiments or any scope of the claims. Its sole purpose is to present concepts in simplified form as a prelude to the more detailed description presented later. In one or more embodiments described herein, systems, methods executed by a computer, apparatus, and / or computer program products are described that can facilitate management of digital security credentials.According to one embodiment, a system is provided. The system may include main memory that may store computer-executable components. The system may also include a processor operatively connected to the main memory that is capable of executing the computer-executable components stored in the main memory. The computer-executable components may include a trusted platform module component that may generate a digital identity token that is bound to a computer application process. The computer executable components may also include a key authenticity component that may compare the digital identity token to a security key to retrieve a security credential.According to one embodiment, a system is provided. The system may include main memory that may store computer-executable components. The system may also include a processor operatively connected to the main memory that is capable of executing the computer-executable components stored in the main memory. The computer-executable components may include a trusted platform module component that may generate a digital identity token that is bound to a computer application process. The computer executable components may also include a policy authenticity component that may compare the digital identity token to a defined policy that controls the computer application process to retrieve a security credential.According to one embodiment, a method executed by a computer is provided. The method executed by a computer may include generating, by a system operatively connected to a processor, a digital identity token associated with a computer application process. The method performed by a computer may also include comparing, by the system, the digital identity token with a security key to retrieve a security credential.According to one embodiment, a method executed by a computer is provided. The method executed by a computer may include generating, by a system operatively connected to a processor, a digital identity token associated with a computer application process. The method performed by a computer may also include comparing, by the system, the digital identity token to a defined policy that controls the computer application process to retrieve a security credential.According to one embodiment, a computer program product for distributing a security credential is provided. The computer program product may include a computer readable storage medium having program instructions embodied therewith. The program instructions may be executable by a processor to cause the processor to generate, by a system operatively connected to a processor, a digital identity token that is bound to a computer application process. The program instructions may also be executable by a processor to compare the digital identity token by the system with a security key to retrieve the security credential.BRIEF DESCRIPTION OF THE DRAWINGSThe present invention will now be described, by way of example only, with reference to preferred embodiments illustrated in the following figures: FIG. 1 illustrates a block diagram of an example non-limiting system that may manage security credentials to execute one or more computer applications according to one or more embodiments described herein. FIG. 2 illustrates a block diagram of an example non-limiting system that may restrict access to one or more security credentials for service provider administrators via a credential release system based on credential from one or more computer application workloads, according to one or more embodiments described herein. FIG. 3 illustrates a diagram of an example non-limiting digital identity token that may facilitate management of security credentials in one or more data security systems according to one or more embodiments described herein. FIG. 4 illustrates a diagram of an example, non-limiting system that may perform one or more identity authenticity mechanisms based on a comparison of one or more digital identity tokens and publicly available digital keys, according to one or more embodiments described herein. FIG. 5 illustrates a diagram of an example, non-limiting system that may perform one or more identity authenticity mechanisms based on a comparison of one or more digital identity tokens and controlling policies according to one or more embodiments described herein. FIG. 6 illustrates a diagram of an example non-limiting computer application process that may be executed by one or more systems that may restrict access to one or more security credentials for service provider administrators via a credential release system based on credential from one or more computer application workloads, according to one or more embodiments described herein. FIG. 7 illustrates a block diagram of an example non-limiting system that may restrict access to one or more security credentials for service provider administrators via a credential release system based on credential from one or more computer application workloads, according to one or more embodiments described herein. FIG. 8 illustrates a flow diagram of an example non-limiting method that may facilitate restricting access to credentials for service provider administrators via a credential release system based on credential from one or more computer application workloads, according to one or more embodiments described herein. FIG. 9 illustrates a flow diagram of an example non-limiting method that may facilitate restricting access to credentials for service provider administrators via a credential release system based on credential from one or more computer application workloads, according to one or more embodiments described herein. FIG. 10 illustrates a cloud computing environment, in accordance with one or more embodiments described herein. FIG. 11 illustrates abstraction model layers according to one or more embodiments described herein. FIG. 12 illustrates a block diagram of an example, non-limiting operating environment in which one or more embodiments described herein may be simplified.DETAILED DESCRIPTIONThe following detailed description is merely illustrative and is not intended to limit embodiments and / or an application or uses of embodiments. Moreover, there is no intention to be bound by any explicit or silent information presented in the preceding sections "Background" or "Summary" or in the section "Detailed Description".One or more embodiments will now be described with reference to the drawings, in which like reference numerals are used to refer to like elements throughout. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the one or more embodiments. However, in various instances, it will be apparent that the one or more embodiments may be practiced without these specific details.Various embodiments of the present invention may be directed to computer processing systems, methods, apparatus, and / or computer program products that facilitate the efficient, effective, and autonomous (e.g., without direct guidance by a user) data security processes that may restrict access to credentials for service provider administrators via a credential release system based on credential from one or more computer application workloads. For example, one or more embodiments may include autonomous generation of one or more digital identity tokens, which may be bound to a computer application process and / or signed by a chain of trust, which may originate from one or more hardware devices. The one or more digital identity tokens may further be compared to one or more public keys and / or policies to facilitate authenticating the computer application process and retrieving a security credential for extracting the computer application process. For example, the one or more digital identity tokens may describe a present computing application and / or be used to obtain confidential data permissions based on one or more user-defined policies.The computer processing systems, methods, apparatus, and / or computer program products use hardware and / or software to solve problems that are highly technical in nature (e.g., restricting access to security credentials), are not abstract, and cannot be performed as a series of mental actions by a user. Various embodiments described herein achieve enhanced data security policies by limiting access to security credentials to one or more users, thereby reducing the possibility of a data security violation caused by a malicious or malicious user action.FIG. 1 illustrates a block diagram of an example non-limiting system 100 that may restrict access to one or more security credentials to service provider administrators based on credential from one or more computer application workloads. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. Aspects of systems (e.g., system 100 and the like), devices, or processes in various embodiments of the present invention may represent one or more machine-executable components embodied within one or more machines, e.g., embodied in one or more computer readable media associated with the one or more machines. These components, when executed by the one or more machines, e.g., computers, computing devices, virtual machines, etc., may cause the machines to perform the described operations.As shown in FIG. 1, the system 100 may include one or more servers 102, one or more networks 104, credential stores 106, and / or data storage devices 108. The server 102 may include a security component 110. The security component 110 may further include one or more transmission components 112 and / or application components 114. Also, the server 102 may include at least one main memory 116, or otherwise be associated with at least one main memory 116. The server 102 may further include a system bus 118 that may connect to various components such as, but not limited to, the security component 110 and associated components, the main memory 116, and / or a processor 120. While a server 102 is illustrated in FIG. 1 in FIG. 1, in further embodiments, multiple units of different types may be associated with or include the features shown in FIG. 1. Further, the server 102 may communicate with one or more cloud computing environments.The one or more networks 104 may include fixed and wireless networks, including, but not limited to, a cellular network, a wide area network (WAN) (e.g., the Internet), or a local area network (LAN). For example, the server 302 may communicate with the / or the one or more credential stores 106 and / or data storage devices 108 (and vice versa) using virtually any desired wired or wireless technology, including, for example, but not limited to, cellular, WAN, wireless fidelity (Wi-Fi), Wi-Max, WLAN, Bluetooth technology, a combination thereof, and / or the like. Further, although the security component 110 may be provided on the one or more servers 102 in the embodiment shown, it should be appreciated that the architecture of the system 100 is not so limited. For example, the security component 110 or one or more components of the security component 110 may be located in a further computer unit, such as a further server unit, a client unit, etc.The one or more credential stores 106 may store, access, and / or distribute one or more dynamic security credentials. In various embodiments, the dynamic security credentials stored by the one or more credential stores 106, accessed by the one or more credential stores 106, and / or distributed by the one or more credential stores 106 may be secret keys for one or more applications and / or computing systems. Example security credentials may include, but are not limited to, tokens, keywords, certificates, encryption keys, application program interface ("API) keys, secure shell ("SSH") credentials, secret keys, a combination thereof, and / or the like. In various embodiments, the one or more credential stores 106 may encrypt and / or store the one or more security credentials. Furthermore, the one or more security credentials may be ephemeral (e.g., programmatically generated when accessed and not present until read).The one or more data storage devices 108 may include one or more confidential information databases. In various embodiments, the one or more data storage devices 108 may be one or more database management systems that may facilitate the creation of and / or access to one(s) or more databases. Further, the one or more databases may be stored within the one or more cloud computing environments, where the one or more data storage devices 108 may manage access to the one or more databases. Further, the one or more databases may include data stored in one or more programming languages such as JavaScript Object Notation ("JSON") and / or Structured Query Language ("SQL"). Example storage devices 108 may include, but are not limited to, one or more databases, cloud object storage ("COS"), a combination thereof, and / or the like.The one or more transmission components 112 may share data received from the server 102 with one or more other components of the server (e.g., the one or more other components associated with the security component 110). Further, the one or more transmission components 112 may send one or more outputs of the security component 110 to the one or more credential stores 106 and / or data storage units 108. In one or more embodiments, the one or more transmission components 112 may transmit and / or receive data over a direct electrical connection and / or the one or more networks 104.The one or more application components 114 may execute one or more computer applications. For example, the one or more application components 114 may be one or more physical and / or virtual machines that execute one or more applications and / or programs. Further, one or more applications executing on the one or more application components 114 may consist of one or more containers, where the one or more application components 114 may use one or more container orchestration platforms. A present application may consist of a single container or multiple adjacent containers that are tightly connected and / or share resources. For example, containers may share resources and / or dependencies, communicate with each other, and / or coordinate when and / or how the containers are terminated. Further, the one or more containers may be encapsulated by one or more pods that may control how the one or more containers may be executed by the one or more application components 114.In various embodiments, the one or more application components 114 may create one or more sidecar containers with respect to the one or more applications. As used herein, the term "sidecar container" may refer to the one or more containers residing within a pod along with one or more applications, wherein the one or more sidecar containers may be connected to and share resources with the one or more applications. The one or more sidecar containers may analyze the one or more applications. In one or more embodiments, the one or more applications and sidecar containers may be encapsulated together within a pod to form a single manageable entity. Further, the one or more sidecar containers may analyze the one or more applications within the pod to detect one or more claims, which may be one or more measurements describing / describing one or more workloads of the one or more applications.FIG. 2 illustrates a block diagram of the example non-limiting system 100 further comprising one or more trusted platform module ("TPM") components 202, according to one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. The one or more TPM components 202 may include hardware that may generate one or more digital identity tokens. For example, the one or more digital identity tokens may represent the one or more claims in a uniform resource locator ("URL") encoded format, wherein the one or more claims may be digitally signed and / or encrypted. For example, the one or more digital identity tokens may be JSON Web ("JWT") tokens, wherein the one or more claims may be encoded as one or more JSON objects; thereby allowing the one or more claims to be digitally signed and / or encrypted.In various embodiments, the one or more TPM components 202 may generate one or more digital identity tokens based on the one or more claims captured by the one or more sidecar containers generated by the one or more application components 114. For example, the one or more TPM components 202 may use one or more private keys to generate the one or more digital identity tokens based on the one or more claims. Further, the one or more private keys may be confidentially handled by the one or more TPM components 202. For example, the private keys may remain owned by the one or more TPM components 202, inaccessible to the one or more applications, sidecar containers, administrators of the system 100, other components of the system 100, and / or other third party. In one or more embodiments, each application component 114 may be associated with a respective TPM component 202. Alternatively, one or more clusters of the application components 114 may be associated with the same TPM component 202.In one or more embodiments, the one or more private keys, and thereby the one or more digital identity tokens, may correlate with one or more public keys included in one or more public key libraries 122. As shown in FIG. 2, the one or more public key libraries 122 may be stored in the one or more main memories 116 and / or the one or more public key libraries 122 may be stored external to the server 102 (e.g., in a second server 102, an external main storage device, and / or a cloud computing environment). The one or more public keys may be read by one or more components and / or administrators of the system 100. However, management of the one or more public key libraries 122 may be reserved for administrators of the trusted system 100. As a result, various components of the system 100 and / or external parties of the system 100 may read the one or more public keys, but may not change the one or more public key libraries 122 (e.g., may not change a public key, remove a public key from the public key library 122, and / or add a public key to the public key library 122).The one or more TPM components 202 may use the data included in the claims to generate one or more digital identity tokens associated with an execution of the present application. Further, the one or more TPM components 202 may use the one or more private keys to form a trust chain designated by a signature included in the one or more digital identity tokens. Moreover, the one or more TPM components 202 may define an expiration date for the one or more digital identity tokens. For example, the one or more digital identity tokens may elapse after a defined time period (e.g., fractions of one second, seconds, minutes, hours, days, and / or the like).FIG. 3 illustrates a diagram of an example non-limiting structure 300 of one or more digital identity tokens that may be generated by the one or more TPM components 202 according to one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. As shown in FIG. 3, the one or more digital identity tokens may include a header, payload, and signature.The header may have a reference title for the present digital identity token and / or describe one or more encryption operations. In an example where the one or more digital identity tokens are JWTs, the header may be a JSON Web Signature ("JWS") header or a JSON Web Encryption ("JWE") header. The payload data may include the data included in the one or more claims. Example data included in the one or more claims, and / or thereby the payload of the one or more digital identity tokens, may include, but is not limited to: a geographic region associated with one or more application components 114 executing the present application (e.g., represented by "cluster region" in FIG. 3 ), a reference name associated with one or more application components 114 executing the present application (e.g., represented by "cluster name" in FIG. 3 with respect to a cluster of application components 114 and / or "machineid" with respect to a particular application component 114 within the cluster), a reference name associated with a pod, which encapsulates the present containers of the application (e.g. represented by "pod" in FIG. 3 ), a workload of the one or more containers (e.g. represented by "images" in FIG. 3 ), an expiration date for the digital identity token (e.g. represented by "exp" in FIG. 3, a initiation date for the digital identity token (e.g. represented by "iat" in FIG. 3 ), an issuer of the present application (e.g. represented by "iss" in FIG. 3 ), a name area (e.g. represented by "namespace" in FIG. 3 ), results of a compliance check, a security gap, certain version information, current network configurations and / or information, This may include open ports, a combination thereof, and / or the like. Further, the signature may include a signature from the one or more TPM components 202 that generated the digital identity token using the one or more private keys.FIG. 4 illustrates a diagram of the example non-limiting system 100 further including a key authenticity component 402, in accordance with one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. As shown in FIG. 4, the one or more key authenticity components 402 may be included in the one or more credential stores 106.In various embodiments, credential storage 106 may determine whether the one or more applications executing on the one or more application components 114 are authorized to receive one or more security credentials based on the one or more digital identity tokens. For example, the key authenticity component 402 may use the one or more digital identity tokens to authenticate the one or more applications. In one or more embodiments, the key authenticity component 402 may compare the digital identity token to the one or more public keys included in the one or more public key libraries 122. In one or more embodiments, the key authenticity component 402 may compare the digital identity token to a certification chain and / or an intermediate certification authority. In response to the one or more digital identity tokens being / are compared to one or more public keys, the key authenticity component 402 may determine that the present application is authorized to receive one or more security credentials.FIG. 5 illustrates a diagram of the example non-limiting system 100 further comprising a policy authenticity component 502 and / or a policy library 504, according to one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. As shown in FIG. 5, the one or more policy authenticity components 502 and / or policy libraries 504 may be included in the one or more credential stores 106.In various embodiments, credential storage 106 may further determine which security credentials to associate with the one or more applications based on one or more controlling policies and / or the digital identity token. For example, the policy authenticity component 502 may compare the data included in the payload of the one or more digital identity tokens with one or more controlling policies included in one or more policy libraries 504. The one or more controlling policies may outline which data managed by the one or more data storage devices 108 can be accessed, the amount of data that can be accessed, and / or the circumstances in which the data can be accessed. For example, the one or more controlling policies may provide different applications with different levels of access to the data managed by the one or more data storage devices 108. In another example, depending on the context of execution of the application (e.g., which application components 114 execute the application and / or how application components 114 execute the application), the one or more controlling policies of the same application may provide different levels of access to the data managed by the one or more storage devices 108. In one or more embodiments, the one or more controlling policies may be defined by one or more owners of the data managed by the one or more data storage units 108.Based on the comparison between the one or more digital identity tokens and the controlling policies, the policy authenticity component 502 may determine which constraints, if any, apply to the present execution of the one or more applications. Thus, the key authenticity component 402 may determine whether the present application is permitted to access data managed by the one or more data storage devices 108, and / or the policy authenticity component 502 may determine whether any data access constraints apply to the present execution of the application. In one or more embodiments, credential storage 106 may associate one or more security credentials with an authorized application based on the detections of key authenticity component 402 and policy authenticity component 502. In some embodiments, credential storage 106 may associate one or more security credentials with an authorized application based on the determinations of key authenticity component 402 or policy authenticity component 502. The security credentials may enable the application to access data managed by the one or more data storage devices 108. Also, the one or more security credentials may restrict a scope and / or level of access based on the application and / or execution of the application according to one or more controlling policies (e.g., which may be defined by owners of the data).FIG. 6 illustrates a diagram of an example non-limiting computer application process 600 that may be executed by the system 100 according to one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. In various embodiments, the transmissions illustrated and / or described with reference to FIG. 6 may be simplified by the one or more networks 104. As shown in FIG. 6, one or more application components 114 (e.g., a cluster of two application components 114) may facilitate execution of an application during the computer application process 600. For example, the one or more application components 114 may create one or more sidecar containers as described herein.At 602, the one or more sidecar containers may grasp one or more claims related to the application and send the claims to the one or more TPM components 202. For example, the claims may describe one or more workloads of the application. At 604, the one or more TPM components 202 may generate one or more digital identity tokens based on the claims and one or more private keys confidentially handled by the one or more TPM components 202. Further, the one or more TPM components 202 may send the one or more digital identity tokens to the one or more sidecar containers. At 606, the one or more sidecar containers may share the one or more digital identity tokens with the one or more applications. In various embodiments, the application may remain inalignant of how the one or more digital identity tokens were formed and / or what the one or more digital identity tokens formed. Thus, the system 100 does not require the security component 110 to store one or more security credentials for authentication to the one or more credential stores; rather, the security component (e.g., via the application component 114 and / or the TPM component 202) may provide the one or more digital authentication identity tokens that may be dynamically generated (e.g., via the TPM component 202) based on one or more claims captured by the one or more sidecar containers (e.g., via the application component 114).At 608, the application may send the one or more digital identity tokens to the one or more credential stores 106 to request one or more security credentials. At 610, the key authenticity component 402 may compare the one or more digital identity tokens to one or more public keys included in one or more public key libraries 122. In various embodiments, the one or more public key libraries 122 may be managed by one or more administrators of the trusted system 100. In one or more embodiments, the one or more public key libraries 122 may be managed by one or more entities and / or systems defined by one or more owners of the confidential data stored in the one or more data storage devices 108. Trusted management of the one or more public key libraries 122 may enable identification of counterfeit digital identity tokens that attempt to obtain credential from the one or more credential stores 106. In response to the one or more digital identity tokens being / are matched to one or more public keys, the key authenticity component 402 may determine that the application is authorized to receive one or more security credentials. In contrast, the key authenticity component 402 may determine that the application is not authorized to receive one or more security credentials in response to the one or more digital identity tokens not being matched to one or more public keys.Further, where the key authenticity component 402 determines that the application is an authorized application, the policy authenticity component 502 may compare the one or more digital identity tokens to one or more policies included in one or more policy libraries 504. The one or more policies may outline one or more data access restrictions applicable to the application and / or the present execution of the application (e.g., as described herein). Based on the comparison at 612, the policy authenticity component 502 may determine which data access constraints, if any, apply to the present execution of the application. At 614, credential storage 106 may associate one or more security credentials with the application based on the determinations of key authenticity component 402 and / or policy authenticity component 502. For example, the one or more security credentials may be associated in response to the application being authorized to access data managed by the one or more data storage devices 108, and / or the security credentials may define the scope and / or level of data access granted to the application.At 616, the application may use the one or more associated security credentials to access the one or more data storage devices 108 and / or to retrieve stored data according to any data access constraints specified by the one or more security credentials. The application may then use the retrieved data to perform one or more tasks and / or complete the computer application process 600.FIG. 7 illustrates a diagram of the example non-limiting system 100 including multiple servers 102 that may facilitate execution of a multi-site application according to one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. For example, as shown in FIG. 7, the system 100 may include: a first server 702, a second server 704, a third server 706, and / or a fourth server 708. The first server 702, the second server 704, the third server 706, and / or the fourth server 708 may each include: one or more of the various components described herein with respect to the server 102, positioned at different locations, and / or communicate over one or more networks 104 (e.g., via a cloud computing environment). For example, the first server 702 may be located in London, the second server 704 may be located in Dallas, the third server 706 may be located in Berlin, and / or the fourth server 708 may be located in Washington, D.C.To exemplify one or more of the functions of the system 100, the following example scenario contemplates a multinational enterprise having locations in Dallas and Berlin. The enterprise may use the system 100 to execute one or more computer application processes 600 and / or to define the following controlling policies with respect to employee data stored in one or more data storage units 108. The first policy may outline that there are two levels of data access: an unrestricted data access that may include the following information regarding the enterprise employees: firstname, lastname, postname, posture, social security numbers, and / or telephone numbers; and / or a restricted data access that may include only the firstname, lastname, and position information. A second policy may skip that only applications that use requests from the enterprise server in Berlin and a particular trusted signed container may be granted unrestricted data access; otherwise, applications that use requests from the enterprise server in Berlin may be granted restricted data access. A third policy may outline that a test company residing in Washington, D.C., may temporarily request unrestricted data access to perform a control test. A fourth policy may outline that applications sending requests from the enterprise server in Dallas may be granted restricted data access. Also, a fifth policy may outline that applications sending requests from locations other than Dallas and / or Berlin are not eligible for access to employee data.The first server 702, the second server 704, the third server 706, and / or the fourth server 708 may each execute the same application via one or more computer application processes 600, but may receive different access to the one or more data storage devices 108. For example, the digital identity tokens generated on the different servers 102 may be different at least due to the differing locations of each server 102. Further, based on the differing content of the digital identity tokens and / or the policies defined above (e.g., stored in the one or more policy libraries 504), credential storage 106 may arrive at different determinations related to execution of the application on the plurality of servers 102.For example, credential storage 106 may determine that the application, when executed on first server 702, is not associated with a security credential (e.g., as outlined by the digital identity token generated by a TPM component 202 of first server 702) according to the fifth policy at least due to the security credential request originating from London. In another case, credential store 106 may determine that the application, when executed on second server 704, is associated with a security credential offering constrained data access (e.g., as outlined by the digital identity token generated by a TPM component 202 of second server 704) according to the fourth policy at least due to the security credential request originating from an authorized application in Dallas. In another case, credential storage 106 may determine that the application, when executed on third server 706, may be associated with a security credential that provides unrestricted data access when the specifications of the second policy are satisfied and / or a security credential that provides restricted data access when the specifications of the second policy are not satisfied (e.g., as outlined by the digital identity token generated by a TPM component 202 of third server 706), at least due to the security credential request originating from an authorized application in Berlin. In another case, credential store 106 may determine that the application, when executed on fourth server 708, is associated with a security credential that provides unrestricted data access (e.g., as outlined by the digital identity token generated by a TPM component 202 of fourth server 708) according to the third policy at least due to the security credential request originating from an authorized application in Washington, D.C.FIG. 8 illustrates a flow diagram of an example non-limiting method 800 that may facilitate restricting access to credentials for service provider administrators via a credential release system 100 based on credential from one or more computer application workloads, according to one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity.At 802, the method may include generating (e.g., via the TPM component 202), by a system operatively connected to one or more processors 120, one or more digital identity tokens that may be bound to a computer application process (e.g., according to the example computer application process 600). Further, in various embodiments, the one or more digital identity tokens may be signed by a chain of trust that may originate from hardware (e.g., the TPM component 202). For example, the one or more digital identity tokens may be generated based on one or more claims captured from a present application and / or one or more private keys as described herein. For example, one or more sidecar containers (e.g., created via application component 114) may analyze one or more present applications and / or collect one or more measurements describing one or more workloads of the applications. In various embodiments, the one or more digital identity tokens may be characterized by the example structure 300 described herein (e.g., the one or more digital identity tokens may be JWTs). Also, in one or more embodiments, the one or more digital identity tokens may be set (e.g., via the TPM component 202) to elapse after a defined period of time (e.g., fractions of a second, seconds, minutes, etc.).At 804, the method 800 may include comparing (e.g., via the key authenticity component 402), by the system 100, the one or more digital identity tokens with one or more security keys to retrieve (e.g., for execution of the computer application process) one or more security credentials. As described herein, the one or more security keys may be public keys included in the one or more public libraries 122 managed by one or more trusted administrators of the system 100. Furthermore, the one or more public keys may correlate with one or more private keys used to generate the one or more digital identity tokens, and / or may thereby facilitate authenticating the one or more digital identity tokens.For example, the comparison at 804 may include determining whether the one or more digital identity tokens match or otherwise correlate with one or more of the public keys. Based on the comparison at 804, the system 100 may determine (e.g., via the key authenticity component 402) whether the analyzed digital identity token is authentic (e.g., generated by the system 100) and / or whether the present computer application process is authorized to receive one or more security credentials. For example, a digital identity token comprising constructed data (e.g., fictitious payload) and / or altered data (e.g., altered payload) may be identified by the system 100 (e.g., via the key authenticity component 402) via the comparison at 804 (e.g., due to deviations between the digital identity tokens and the available public keys). In another example, one or more applications not eligible for receipt of security credentials may be identified by the comparison at 804 (e.g., due to differences between the digital identity tokens and the available public keys).At 806, the method 800 may further include comparing (e.g., via the policy authenticity component 502), by the system 100, the one or more digital identity tokens to one or more defined policies that may control the present computer application process (e.g., according to the example computer application process 600), wherein the retrieval of the one or more security credentials may further be based on the comparison at 806. As described herein, the one or more policies may be included in the one or more policy libraries 504 and / or defined by one or more owners of data managed via a distribution of the security credentials. The comparing at 806 may facilitate identifying any data access constraints applicable to the computer application process.For example, the comparing at 806 may determine whether the application's entitlement to access confidentially treated data is subject to one or more restrictions. For example, the one or more security credentials associated with the present computer application process may further be based on one or more workloads of the present application. As such, in various embodiments, the system 100 may associate one or more security credentials with a present application to facilitate execution of the computer application process based on: the credential status of the present application, the authenticity of the one or more digital identity tokens, and / or one or more data access restrictions defined by one or more controlling policies.FIG. 9 illustrates a flow diagram of an example non-limiting method 900 that may facilitate restricting access to credentials for service provider administrators via a credential release system 100 based on credential from one or more computer application workloads, according to one or more embodiments described herein. Repeated description of like elements used in other embodiments described herein is omitted for simplicity.At 902, method 900 may include generating (e.g., via application component 114), by a system operatively connected to one or more processors 120, one or more sidecar containers that may detect one or more claims related to an application. For example, the one or more sidecar containers may collect one or more measurements describing one or more workloads of the applications. In various embodiments, the one or more applications may consist of one or more containers encapsulated in one or more pods with the one or more sidecar containers.At 904, method 900 may include generating (e.g., via TPM component 202), by a system 100, one or more digital identity tokens that may be bound to a computer application process (e.g., according to example computer application process 600). Further, in various embodiments, the one or more digital identity tokens may be signed by a chain of trust that may originate from hardware (e.g., the TPM component 202). For example, the one or more digital identity tokens may be generated based on one or more claims captured by the one or more sidecar containers and / or one or more private keys as described herein. In various embodiments, the one or more digital identity tokens may be characterized by the example structure 300 described herein (e.g., the one or more digital identity tokens may be JWTs). Also, in one or more embodiments, the one or more digital identity tokens may be set (e.g., via the TPM component 202) to elapse after a defined period of time (e.g., fractions of a second, seconds, minutes, etc.).At 906, method 900 may include comparing (e.g., via key authenticity component 402), by system 100, the one or more digital identity tokens to one or more security keys to facilitate retrieving one or more security credentials (e.g., for executing the computer application process). As described herein, the one or more security keys may be public keys included in the one or more public key libraries 122 managed by one or more trusted administrators of the system 100. Furthermore, the one or more public keys may correspond to one or more private keys used to generate the one or more digital identity tokens, and / or may thereby facilitate authenticating the one or more digital identity tokens.For example, the comparison at 906 may include determining whether the one or more digital identity tokens match or otherwise correlate with one or more of the public keys. Based on the comparison at 906, the system 100 may determine (e.g., via the key authenticity component 402) whether the analyzed digital identity token is authentic (e.g., generated by the system 100) and / or whether the present computer application process is authorized to receive one or more security credentials. For example, a digital identity token comprising constructed data (e.g., fictitious payload) and / or altered data (e.g., altered payload) may be identified by the system 100 (e.g., via the key authenticity component 402) via the comparison at 906 (e.g., due to deviations between the digital identity tokens and the available public keys). In another example, one or more applications not eligible for receipt of security credentials may be identified by the comparison at 906 (e.g., due to differences between the digital identity tokens and the available public keys).At 908, the method 900 may further include comparing (e.g., via the policy authenticity component 502), by the system 100, the one or more digital identity tokens to one or more defined policies that may control the present computer application process (e.g., according to the example computer application process 600), wherein the retrieval of the one or more security credentials may further be based on the comparison at 806. As described herein, the one or more policies may be included in the one or more policy libraries 504 and / or defined by one or more owners of data managed via a distribution of the security credentials. The comparing at 908 may facilitate identifying any data access constraints applicable to the computer application process.For example, the comparing at 908 may determine whether the application's entitlement to access confidentially treated data is subject to one or more restrictions. For example, the one or more security credentials associated with the present computer application process may further be based on one or more workloads of the present application. As such, in various embodiments, the system 100 may associate one or more security credentials with a present application to facilitate execution of the computer application process based on: the credential status of the present application, the authenticity of the one or more digital identity tokens, and / or one or more data access restrictions defined by one or more controlling policies.At 910, method 900 may also include executing (e.g., via application component 114), by system 100, the computer application process by using the one or more security credentials to retrieve data from one or more databases (e.g., managed by one or more data storage devices 108). For example, the one or more present applications may retrieve data from one or more data storage devices 108 according to one or more access restrictions specified by the one or more security credentials.It should be understood from the outset that implementing the teachings provided herein is not limited to a cloud computing environment, although this disclosure includes a detailed description of cloud computing. Rather, embodiments of the present invention may be practiced in conjunction with any other type of now known or later invented computing environment.Cloud computing is a service provisioning model for facilitating smooth, demand-driven network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, main memories, memories, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model may include at least five properties, at least three service models, and at least four implementation models.The properties are as follows:On-demand self service: A cloud user can provide data processing functions such as server time and network storage automatically on a one-side basis as required without requiring human interaction with the provider of the services.Broad Network Access: Functions are available over a network that are accessed by standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).Resource Pooling: The provider's computing resources are merged to serve multiple users using a multi-tenant model, where different physical and virtual resources are dynamically allocated and re-allocated as needed. There is a felt location independence because the user generally has no control over the exact location of the resources provided, but may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center).Rapid Elasticity: Functions can be provided quickly and elastically for a fast horizontal scaling (scale out), in some cases also automatically, and enabled for a fast scale-in quickly. The functions available for providing often appear unlimited to the user and they can be purchased in any quantity at any time.Measured Service: Cloud systems automatically control and optimize the use of resources by utilizing a measurement function at a certain level of abstraction that is appropriate for the type of service (e.g., storage, processing, bandwidth, and active user accounts). The use of resources can be monitored, controlled and reported, thereby providing transparency to both the provider and the user of the service being used.The service models are as follows:Software as a Service (SaaS): The function provided to the user is to use the provider's applications running in a cloud infrastructure. The applications are accessible from various client devices via a thin client interface, such as a web browser (e.g., web-based email). The user does not manage or control the underlying cloud infrastructure, including the network, server, operating systems, storage or even individual application functions, with the possible exception of limited user-specific application configuration settings.Platform as a Service (PaaS): The function provided to the user is to deploy user-created applications created using provider-supported programming languages and tools in the cloud infrastructure. The user does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems or memories, but has control over the applications used and possibly over configurations of the application hosting environment.Infrastructure as a Service (laaS): The function provided to the user is to provide processing, storage, networks, and other basic computing resources, where the user is able to deploy and execute any software that may include operating systems and applications. The user does not manage or control the underlying cloud infrastructure, but has control over operating systems, memory, deployed applications, and possibly limited control over selected network components (e.g., host firewalls).The models of deployment are as follows:Private Cloud: The cloud infrastructure is operated solely for one organization.It may be managed by the organization or a third party, and may be located in the own rooms or in foreign rooms.Communication Cloud: The cloud infrastructure is shared among multiple organizations and supports a specific user community that has shared issues (e.g., mission, security requirements, policies, and policy compliance considerations). It may be managed by the organizations or a third party, and may be located in the own rooms or in foreign rooms.Public Cloud: The cloud infrastructure is provided to the general public or a large industry group and belongs to an organization selling cloud services.Hybrid Cloud: The cloud infrastructure is a composition of two or more clouds (private, user community, or public) that, while remaining individual entities, are interconnected by standardized or proprietary technology that enables data and application portability (e.g., cloud target group distribution for load balancing between clouds).A cloud computing environment is service-oriented with focus on state independence, low coupling, modularity, and semantic interoperability. Within the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.Referring to FIG. 10, an illustrative cloud computing environment 1000 is illustrated. As shown, cloud computing environment 1000 includes one or more cloud computing nodes 1002 with which local computing devices used by cloud users, such as a personal digital assistant (PDA) or cellular telephone 1004, desktop computer 1006, laptop computer 1008, and / or automobile computer system 1010, may communicate. The nodes 1002 may communicate with each other. They may be physically or virtually grouped into one or more networks such as private, user community, public, or hybrid clouds (not shown) as described above, or a combination thereof. This enables cloud computing environment 1000 to offer infrastructure, platforms, and / or software as a service for which a cloud user does not need to keep resources on a local computing device. It should be appreciated that the types of computing devices 1004-1010 shown in FIG. 10 are intended to be illustrative only, and that computing nodes 1002 and cloud computing environment 1000 may communicate with any type of computerized device over any type of network and / or over any type of network-callable connection (e.g., using a web browser).Referring to FIG. 11, a set of functional abstraction layers provided by the cloud computing environment 1000 (FIG. 10 ) is shown. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. It should be understood from the outset that the components, layers, and functions shown in FIG. 11 are intended to be illustrative only and embodiments of the invention are not limited thereto. As illustrated, the following layers and corresponding functions are provided:A hardware and software layer 1102 includes hardware and software components. Examples of hardware components include:Mainframe computer 1104; Reduced Instruction Set Computer (RISC) architecture based servers 1106; server 1108; blade server 1110;Storage devices 1112; and networks and network components 1114. In some embodiments, software components include network application server software 1116 and database software 1118.Virtualization layer 1120 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 1122; virtual storage 1124; virtual networks 1126, including virtual private networks; virtual applications and operating systems 1128, and virtual clients 1130.In one example, a management layer 1132 may provide the functions described below. Resource provision 1134 provides for the dynamic acquisition of computing resources as well as other resources used to perform tasks within the cloud computing environment. Measuring and pricing 1136 provide cost tracking when using resources within the cloud computing environment as well as accounting for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud users and tasks, as well as protection for data and other resources. A user portal 1138 provides users and system administrators with access to the cloud computing environment. Management of the service scope 1140 provides for the allocation and management of cloud computing resources so that the required service objectives are achieved. Planning and satisfying Service Level Agreement (SLA) 1142 provides the arrangement in advance and the acquisition of cloud computing resources for which a future request is anticipated according to an SLA.Workload layer 1144 provides examples of the functionality for which the cloud computing environment may be used. Examples of workloads and functions that may be provided by this layer include: mapping and navigation 1146; software development and lifecycle management 1148; virtual classroom training 1150; data analytics processing 1152; transaction processing 1154; and security credential management 1156. Various embodiments of the present invention may use the cloud computing environment described with reference to FIGS. 10 and 11 to facilitate the output of one or more security credentials to facilitate execution of one or more computer application processes.The present invention may be a system, method and / or computer program product at any level of technical detail integration. The computer program product may comprise a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention. The computer readable storage medium may be a physical device that can retain and store instructions for use by a system for executing instructions. The computer readable storage medium may be, for example, but is not limited to, an electronic storage unit, a magnetic storage unit, an optical storage unit, an electromagnetic storage unit, a semiconductor storage unit, or any suitable combination thereof. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a removable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions stored thereon, and any suitable combination thereof. A computer readable storage medium, as used herein, is not intended to be transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through a wire.Computer readable program instructions described herein may be downloaded from a computer readable storage medium to respective data processing / processing devices or via a network such as the Internet, a local area network, a wide area network, and / or a wireless network to an external computer or storage device. The network may include copper transmission cables, lightwave transmission conductors, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each data processing / processing unit receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the corresponding data processing / processing unit.Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, integrated circuit configuration data, or either source code or object code written in any combination of one or more programming languages, including object oriented programming languages such as Smalltalk, C++, or the like, and procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, via the Internet using an Internet Service Provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuits to perform aspects of the present invention.Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It is noted that each block of the flowcharts and / or the block diagrams, and combinations of blocks in the flowcharts and / or the block diagrams, may be executed by computer readable program instructions.These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions executed via the processor of the computer or other programmable data processing apparatus produce a means for implementing the functions / steps specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions may also be stored on a computer readable storage medium that can control a computer, programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored thereon comprises an article of manufacture including instructions that implement aspects of the function / step specified in the flowchart and / or block diagrams block or blocks.The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of process steps to be performed on the computer or other programmable apparatus or other device to produce a computer executed process, such that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / steps specified in the flowchart and / or block diagram block or blocks.The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions that includes one or more executable instructions for executing the particular logical function(s). In some alternative implementations, the functions specified in the block may occur in a different order than shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may sometimes be executed in the reverse order depending on the appropriate functionality. It is further noted that each block of the block diagrams and / or the flowcharts, as well as combinations of blocks in the block diagrams and / or the flowcharts, may be implemented by special purpose hardware-based systems that perform the specified functions or steps, or perform combinations of special purpose hardware and computer instructions.In order to provide context for the various aspects of the disclosed subject matter, FIG. 12 and the following discussion are intended to provide a general description of a suitable environment in which the various aspects of the disclosed subject matter may be practiced. FIG. 12 illustrates a block diagram of an example, non-limiting operating environment in which one or more embodiments described herein may be enabled. Repeated description of like elements used in other embodiments described herein is omitted for simplicity. Referring to FIG. 12, a suitable operating environment 1200 for carrying out various aspects of this disclosure may include a computer 1212. The computer 1212 may also include a processing unit 1214, a system memory 1216, and a system bus 1218. System bus 1218 may operatively connect system components including, but not limited to, system memory 1216 to processing unit 1214. Processing unit 1214 may be any of various available processors. Dual microprocessors and other multiprocessor architectures may also be used as the processing unit 1214. The system bus 1218 may be any bus structure of multiple types of bus structures, including, but not limited to, the memory bus or memory controller, a peripheral bus or external bus, and / or a local bus using any variety of available bus architectures including, but not limited to, Industrial Standard Architecture (ISA), Micro-Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Local Bus (VLB), Peripheral Component Interconnect (PCI), Card Bus, Universal Serial Bus (USB), Advanced Graphics Port (AGP), Firewire and Small Computer Systems Interface (SCSI). System memory 1216 may also include volatile memory 1220 and nonvolatile memory 1222. The basic input / output system (BIOS) containing the basic routines for transferring information between elements within the computer 1212, such as during startup, may be stored in the non-volatile memory 1222. By way of illustration and not limitation, the non-volatile memory 1222 may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, or non-volatile random access memory (RAM) (e.g., ferroelectric RAM (FeRAM)). The volatile memory 1220 may also include a random access memory (RAM) serving as an external cache. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), extended SDRAM (ESDRAM), synchronous DRAM (SLDRAM), direct rambus RAM (DRRAM), direct rambus dynamic RAM (DRDRAM), and rambus dynamic RAM.Computer 1212 may also include removable / non-removable, volatile / non-volatile computer storage media. For example, Fig. 12 illustrates a disk storage 1224. The disk storage 1224 may also include, but is not limited to, devices such as a magnetic disk drive, a floppy disk drive, a tape drive, a Jaz drive, a Zip drive, an LS-100 drive, a flash memory card, or a memory stick. The disk storage 1224 may also include storage media separately or in combination with other storage media, including, but not limited to, an optical disk drive such as a compact disk ROM unit (CD-ROM), a CD recordable drive (CD-R drive), a CD rewritable drive (CD-RW drive), or a digital versatile disk ROM drive (DVD-ROM). To facilitate connection of disk storage 1224 to system bus 1218, a removable or non-removable interface may be used, such as interface 1226. FIG. 12 also illustrates software that may serve as an intermediary between users and the basic computing resources described in the suitable operating environment 1200. Such software may also include, for example, an operating system 1228. The operating system 1228 which may be stored on the disk storage 1224 is used to control and allocate resources of the computer 1212. System applications 1230 may benefit from the management of resources by operating system 1228 through program modules 1232 and program data 1234 stored, for example, either in system memory 1216 or on disk storage 1224. It should be understood that this disclosure may be practiced with various operating systems or combinations of operating systems. A user inputs commands or information to the computer 1212 through one or more input devices 1236. Input units 1236 may include, but are not limited to, a pointing device such as a mouse, trackball, stylus, touchpad, keyboard, microphone, joystick, game controller, satellite dish, scanner, TV tuner card, digital camera, digital video camera, web camera, and the like. These and other input devices may be connected to the processing unit 1214 through the system bus 1218 via one or more interface ports 1238. The one or more interface ports 1238 may include, for example, a serial port, a parallel port, a game port, and a universal serial bus (USB). One or more output units 1240 may use some terminals of the same type as the input unit 1236. Thus, for example, a USB port may be used to provide input to the computer 1212 and to output information from the computer 1212 to an output unit 1240. An output adapter 1242 may be provided to illustrate that there are some output units 1240 such as monitors, speakers, and printers, among other output units 1240 that require special adapters. The output adapters 1242 may include, by way of illustration and not limitation, video and sound cards that provide a connection means between the output unit 1240 and the system bus 1218. It should be noted that other units and / or systems of units provide both input and output functions, such as one or more remote computers 1244.The computer 1212 may operate in a networked environment using logical connections to one or more remote computers, such as the remote computer 1244. Remote computer 1244 may be a computer, a server, a router, a network PC, a workstation, a microprocessor-based device, an peer unit or other common network node, and the like, and may also typically include many or all of the elements described with respect to computer 1212. For simplicity, only one main storage unit 1246 is illustrated with the remote computer 1244. Remote computer 1244 may be logically connected to computer 1212 through network interface 1248 and then physically connected via communication link 1250. Further, operation may be distributed across multiple (local and remote) systems. The network interface 1248 may include wired and / or wireless transmission networks such as local area networks (LANs), wide area networks (WANs), cellular networks, etc. LAN technologies include Fiber Distributed Data Interface (FDDI), Copper Distributed Data Interface (CDDI), Ethernet, Token Ring, and the like. WAN technologies include, but are not limited to, point-to-point connections, circuit switching networks such as integrated services digital networks (ISDN) and variants thereof, packet switching networks, and digital subscriber lines (DSL). One or more communication links 1250 refer to the hardware / software used to connect the network interface 1248 to the system bus 1218. Although the communications link 1250 is shown within the computer 1212 for illustrative clarity, it may be located outside the computer 1212. The hardware / software for connecting to the network interface 1248 may also include, for example purposes only, internal and external technologies such as modems, including regular telephone modems, cable modems and DSL modems, ISDN adapters, and Ethernet cards.Embodiments of the present invention may be a system, method, apparatus and / or computer program product at any level of technical detail integration. The computer program product may comprise a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention. The computer readable storage medium may be a tangible device that can retain and store instructions for use by a system for executing instructions. The computer readable storage medium may be, for example, but is not limited to, an electronic storage unit, a magnetic storage unit, an optical storage unit, an electromagnetic storage unit, a semiconductor storage unit, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium may also include the following: a removable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions stored thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not intended to be transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through a wire.Computer readable program instructions described herein may be downloaded from a computer readable storage medium to respective data processing / processing devices or via a network such as the Internet, a local area network, a wide area network, and / or a wireless network to an external computer or storage device. The network may include copper transmission cables, lightwave transmission conductors, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing unit receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the corresponding computing / processing unit. Computer readable program instructions for carrying out various aspects of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, integrated circuit configuration data, or either source code or object code written in any combination of one or more programming languages, including object oriented programming languages such as Smalltalk, C++, or the like, and procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, via the Internet using an Internet Service Provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuits to perform aspects of the present invention.Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It is noted that each block of the flowcharts and / or the block diagrams, and combinations of blocks in the flowcharts and / or the block diagrams, may be executed by computer readable program instructions. These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions executed via the processor of the computer or other programmable data processing apparatus produce a means for implementing the functions / steps specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions may also be stored on a computer readable storage medium that can control a computer, programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored thereon comprises an article of manufacture including instructions that implement aspects of the function / step specified in the flowchart and / or block diagrams block or blocks. The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of process operations to be performed on the computer or other programmable apparatus or other device to produce a computer executed process, such that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / steps specified in the flowchart and / or block diagram block or blocks.The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions that includes one or more executable instructions for executing the particular logical function(s). In some alternative implementations, the functions indicated in the blocks may occur in a different order than shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may sometimes be executed in the reverse order depending on the appropriate functionality. It is further noted that each block of the block diagrams and / or the flowcharts, as well as combinations of blocks in the block diagrams and / or the flowcharts, may be implemented by special purpose hardware-based systems that perform the specified functions or steps, or perform combinations of special purpose hardware and computer instructions.While the subject matter has been described above in the general context of computer executable instructions of a computer program product executing on a computer and / or computers, those skilled in the art will appreciate that this disclosure may also be practiced in combination with other program modules. Generally, program modules include routines, programs, components, data structures, etc., that perform certain tasks and / or execute certain abstract data types. Moreover, those skilled in the art will appreciate that the computer-implemented methods of the present invention may be practiced with other configurations of computer systems, including single processor or multiprocessor computer systems, mini-computing devices, mainframe computers, as well as computers, portable computing devices (e.g., PDA, telephone), microprocessor-based or programmable consumer or industrial electronics, and the like. The illustrated aspects may also be practiced in distributed computing environments where tasks are performed by remote processing units connected through a transmission network. However, some, if not all, aspects of this disclosure may be practiced on stand-alone computers. In a distributed computing environment, program modules may reside in both local and remote main memory units.As used in this application, the terms "component", "system", "platform", "interface", and the like may refer to and / or include a computer-related entity or entity related to an operable machine having one or more particular functionalities. The entities disclosed herein may be either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process executing on a processor, a processor, an object, an executable, a thread of execution, a program, and / or a computer. For illustrative purposes, both an application running on a server and the server can be a component. One or more components may be located within a process and / or execution thread, and a component may be located on a single computer and / or distributed between two or more computers. In another example, respective components may be executed from different computer readable media having different data structures stored thereon. The components may communicate via local and / or remote processes, such as according to a signal having one or more data packets (e.g., data from a component interacting with another component in a local system, a distributed system, and / or via a network such as the Internet with other systems via the signal). As another example, a component may be a device having certain functionality provided by mechanical parts, which are operated by electrical or electronic circuitry operated by a software or firmware application executed by a processor. In such a case, the processor may be located inside or outside the device and execute at least a portion of the software or firmware application. As yet another example, a component may be a device that provides some functionality through electronic components without mechanical parts, where the electronic components may include a processor or other means for executing software or firmware that at least partially assumes the functionality of the electronic components. In one aspect, a component may emulate an electronic component via a virtual machine, e.g., within a cloud processing system.Moreover, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or.". That is, unless otherwise indicated or indicated by context, "X uses A or B" is intended to mean any of the natural inclusive permutations. That is, when X uses A; X uses B; or X uses both A and B, "X uses A or B" is satisfied in any of the above cases. Moreover, the articles "a" and "an" as used in the present specification and the accompanying drawings should be construed broadly in the meaning of "one(s) or more" unless otherwise indicated or indicated by the context to be directed to a singular form. As used herein, the terms "example" and / or "exemplary" are used in the meaning of "serving as an example, case, or illustration.". To avoid misunderstanding, the subject matter disclosed herein is not limited by such examples. Moreover, any aspect or design described herein as an "example" and / or "exemplary" is not necessarily to be construed as preferred or more advantageous over other aspects or designs, nor is it intended to exclude equivalent exemplary structures and techniques known to those skilled in the art.As used in the present specification, the term "processor" may refer to as well as any processing unit including, but not limited to, single core processors, single processors with software multi-threaded execution function; multi-core processors; multi-core processors with software multi-threaded execution function; multi-core processors with hardware multi-threaded technology; parallel platforms; and parallel platforms with distributed shared memory. Further, a processor may refer to an integrated circuit, an application specific integrated circuit (ASIC), a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic controller (PLC), a complex programmable logic device (CPLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof configured to perform the functions described herein. Furthermore, processors may utilize nanoscale architectures such as, but not limited to, molecular and quantum dot transistors, switches, and gates to optimize memory occupancy or improve performance of user devices. A processor may also be embodied as a combination of data processing units. In this disclosure, terms such as "memory," "data storage," "database," and as well as any other information storage component relevant to the operation and functionality of a component are used to refer to "main storage components," "entities embodied in a "main storage," or components comprising main storage. It should be understood that main memory and / or main memory components described herein may be either volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. By way of illustration and not limitation, the non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, or non-volatile random access memory (RAM) (e.g., ferroelectric RAM (FeRAM)). Volatile memory may include RAM, which may serve as an external cache, for example. By way of illustration and not limitation, RAM is available in many forms, such as synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), extended SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), direct rambus RAM (DRRAM), direct rambus dynamic RAM (DRDRAM), and rambus dynamic RAM (RDRAM). Further, the disclosed main memory components of systems or computer-executed methods herein are intended to include, without limitation, these and any other suitable types of main memory.The above includes mere examples of systems, computer program products, and methods performed by a computer. It is, of course, not possible to describe any conceivable combination of components, products and / or computer-implemented methods for purposes of describing this disclosure, but those skilled in the art will appreciate that many other combinations and permutations of this disclosure are possible. Moreover, insofar as the terms "comprises", "has", "has" and the like are used in the detailed description, claims, appendices and drawings, these terms are intended to be inclusive in a manner similar to the term "comprising" since "comprising" when used is used as a transition word in a claim. The descriptions of the various embodiments have been provided for purposes of illustration, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application, or technical improvement over technologies found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

A system (100) for distributing security credential, the system (100) comprising: a main memory (116, 1216) storing computer-executable components; a processor (120, 1214) operatively connected to the main memory (116, 1216) and executing the computer-executable components stored in the main memory (116, 1216), the computer-executable components comprising: a trusted platform module component (202) executable to generate (802, 904) a digital identity token (300) bound to a computer application process (600), wherein the generating (802, 904) is based on one or more measurements describing one or more workloads of the computer application process (600); An authenticity component executable to analyze the digital identity token (300) to retrieve a security credential, wherein the authenticity component comprises a key authenticity component (402) to compare (804, 906) the digital identity token (300) to a security key to retrieve a security credential based on the comparison (804, 906); and wherein the authenticity component comprises a policy authenticity component (502) executable to perform a comparison (806, 908) of the digital identity token (300) to a defined policy controlling the computer application process (600), wherein retrieving the security credential is further based on the comparison (806, 908).The system (100) of any preceding claim, wherein the digital identity token (300) is signed by a trust chain originating in hardware.The system (100) of any preceding claim, further comprising: an application component (114) to use the security credential to execute (910) the computer application process (600) by retrieving data from a database.The system (100) of any preceding claim, wherein the digital identity token (300) is executable to run after a defined time period.A computer-executed method (800, 900, 1156) for distributing a security credential, the method (800, 900, 1156) comprising: generating (802, 904), by a system (100) operatively connected to a processor (120, 1214), a digital identity token (300) associated with a computer application process (600), wherein the generating (802, 904) is based on one or more measurements describing one or more workloads of the computer application process (600); An analyzing, by the system (100), the digital identity token (300) to retrieve a security credential, wherein analyzing comprises: comparing (804, 906) the digital identity token (300) to a security key to retrieve a security credential based on the comparing (804, 906); and comparing (806, 908) the digital identity token (300) to a defined policy that controls the computer application process (600), wherein the retrieval of the security credential is further based on comparing (806, 908) the digital identity token (300) to the defined policy.The computer-executed method (800, 900, 1156) of claim 5, wherein the security key comprises a public key, wherein retrieval of the security credential is further based on comparing the digital identity token (300) and the public key.The computer-executed method (800, 900, 1156) of any of claims 5 or 6, wherein the digital identity token (300) is signed by a trust chain originating from hardware.The computer-executed method (800, 900, 1156) of any of claims 5 to 7, further comprising: executing (910), by the system (100), the computer application process (600) using the security credential to retrieve data from a database.The computer-executed method (800, 900, 1156) of any of claims 5 to 8, wherein the digital identity token (300) expires after a defined time period.A computer program product for distributing security credential, the computer program product comprising: a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit to perform a method (800, 900, 1156) according to any one of claims 5 to 9.A computer program stored on a computer readable medium and loadable into the internal main memory (116, 1216) of a digital computer, the computer program comprising portions of software code when the program is executed on a computer (1212) to perform the method (800, 900, 1156) of any one of claims 5 to 9.

Images