Cloud Credential Management via API Gateway Interception

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud computing environments face challenges in securely managing resource credentials, as compromised applications can expose credentials to attackers, and credential rotation adds significant overhead and does not fully address the security issue.

Innovation Solution

A cloud resource credential management system is provisioned as part of virtual machine deployment, which intercepts and validates cloud resource calls, extending them with credentials only if they comply with policies, thereby maintaining security and reducing overhead.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If credentials are locally stored in application configuration files, then applications can access cloud resources, but security is compromised when applications are breached

Engineering Contradiction:

ImprovesecurityVSAvoidcredential management system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts credentials from the application environment and stores them in a separate, secure credential store. The application no longer directly accesses or stores credentials locally, but instead receives temporary credentials through an API gateway. This separation removes the security vulnerability of local credential storage while maintaining application functionality.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces an API gateway as an intermediary component between the application and the credential store. The gateway manages credential distribution, validation, and rotation without requiring the application to directly interact with the credential store. This intermediary layer simplifies the overall system architecture by centralizing credential management logic.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If credential rotation is implemented to enhance security, then security is improved, but significant overhead is introduced requiring thousands of platform restarts

Engineering Contradiction:

ImprovesecurityVSAvoidservice provisioner overhead

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent implements preliminary credential binding where credentials are pre-associated with specific applications and environments in the credential store. When credential rotation is needed, only the specific credential entries need to be updated rather than restarting entire platforms. This preliminary organization enables targeted, efficient credential rotation with minimal disruption to service operations.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements automated credential management where the credential store and API gateway handle credential rotation automatically without requiring manual intervention or platform restarts. The application simply requests credentials through the gateway, which retrieves or generates appropriate credentials based on pre-configured policies, enabling seamless credential rotation.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If applications directly access cloud resources with embedded credentials, then ease of operation is maintained, but security vulnerabilities increase

Engineering Contradiction:

Improveapplication operationVSAvoidcredential exposure to attackers

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent extracts credentials from application code and configuration files, eliminating the direct connection between applications and credential storage. Applications operate with temporary credentials provided by the API gateway, which are automatically managed and rotated. This extraction maintains ease of operation while removing the security vulnerability of embedded credentials.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The API gateway serves as an intermediary that manages all credential-related operations. Applications interact with the gateway using standard API calls, maintaining ease of operation, while the gateway handles secure credential retrieval, validation, and rotation from the protected credential store, preventing direct credential exposure.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11048544B2Cloud resource credential provisioning for services running in virtual machines and containers

Publication Date: 2021.06.29 SAP SE

AI summary

Some embodiments may be associated with a cloud computing environment. A cloud resource credential management system may be provisioned as part of a virtual machine deployment, access information associated with an application or a service configuration file and establish a cloud resource credential provisioning system external to an application to be executed in connection with the virtual machine. The cloud resource credential provisioning system may, for example, map a cloud resource policy and a cloud resource credential. The cloud resource credential provisioning system may then intercept a cloud resource call from the application to a cloud resource provider and validate that the cloud call request complies with the cloud resource policy. If the cloud resource call complies with the cloud resource policy, the cloud resource credential provisioning system may extend the cloud resource call with the cloud resource credential and forward the extended cloud resource call to the cloud resource provider.