Runtime Container Secrets Handling for Encrypted Integration Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is no widely implemented protocol or API for securely connecting to secrets managers in integration platforms, leading to custom-built solutions that lack standardization and centralized management of secrets across different organizations.
Innovation Solution
A method for secure secrets management in an integration platform using a runtime container to retrieve and store secrets from a secrets manager, encrypting them with container-level keys, and maintaining an environment extension for secure access and deletion, ensuring secrets are never decrypted unnecessarily.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If custom-built solutions are used to integrate secrets managers, then organization-specific security needs can be met, but standardization and centralized management across the integration platform are lost
Solution Approach 1:
The patent implements a universal secrets management system that works across multiple integration processes and secrets managers through standardized interfaces. The runtime container provides a common framework that can integrate with different secrets managers (e.g., HashiCorp Vault, Azure Key Vault, AWS Secrets Manager) using standardized protocols, eliminating the need for custom-built solutions for each organization while maintaining security flexibility.
Solution Approach 2:
The runtime container acts as an intermediary layer between integration processes and secrets managers. It provides standardized interfaces and protocols that mediate communication, allowing secure secret retrieval and storage without requiring direct integration between each integration process and specific secrets managers. This intermediary enables standardization while maintaining organization-specific security configurations.
2Ease of operation
If secrets are stored in plaintext in the environment extension, then access is fast and simple, but security and data integrity are compromised
Solution Approach 1:
The system performs preliminary encryption of secrets before storing them in the environment extension. Secrets are encrypted using container-level keys or customer-provided keys before being written to the environment extension, ensuring that even though access is fast and simple, the data remains secure. The decryption happens only when needed at the point of use.
Solution Approach 2:
The patent changes the state of secrets from plaintext to encrypted form when storing in the environment extension. The system maintains encryption parameters (such as container-level keys or customer-provided keys) that allow fast decryption when needed. This parameter change enables both security and ease of operation by using efficient encryption algorithms and key management.
3Productivity
If secrets are decrypted and stored in the environment extension, then subsequent access is faster, but the risk of exposure increases
Solution Approach 1:
The patent applies local quality by encrypting secrets with specific keys at specific locations (container-level or customer-provided keys) rather than using a single master key. Each secret or group of secrets can be encrypted with appropriate keys based on their sensitivity and access requirements. This localized encryption approach maintains access efficiency while reducing exposure risk by limiting the impact of key compromise to specific secrets rather than all secrets.
Solution Approach 2:
The system skips the decryption step when accessing secrets from the environment extension by retrieving encrypted secrets directly and only decrypting them at the point of use. This rushing through approach avoids unnecessary decryption operations that could expose secrets to malware or unauthorized access, while maintaining fast access efficiency through direct encrypted retrieval and selective decryption.
4Reliability
If a centralized secrets management system is implemented, then security and compliance are improved, but system complexity increases
Solution Approach 1:
The patent segments the secrets management system into distinct components: the runtime container, the environment extension, and the secrets manager interfaces. Each component has a specific function (runtime container manages keys, environment extension stores encrypted secrets, interfaces handle communication with secrets managers). This segmentation reduces overall system complexity by making each component independent and manageable, while still providing centralized security and compliance control.
Solution Approach 2:
The system uses copying by storing encrypted copies of secrets in the environment extension rather than maintaining original plaintext secrets centrally. The encrypted copies are created by copying the secret data and applying encryption transformations. This copying approach reduces complexity by eliminating the need for complex centralized storage and access control mechanisms, while maintaining security and compliance through the encrypted copies.
Data Source
AI summary
Conventionally, a custom solution must be built for the integration of secrets stored in a secrets manager. Embodiments integrate secrets using an integration process that retrieves a secret from the secrets manager, marks the secret so that it can be appropriately handled, and stores the secret within a container-level environment extension, such that the secret can be utilized by other integration processes within the same runtime container. For enhanced security, the secret is always encrypted within communications and when at rest (e.g., within the environment extension).