Credential Management in Cloud Deployment via Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud-based application deployment technologies face security risks due to the storage of credentials in plain text within deployment manifests, leading to potential unauthorized access and inadvertent disclosure, and lack flexible access control and auditing mechanisms.
Innovation Solution
An application deployment system that includes a credential manager and a deployment director, which separates credential storage from the deployment manifest, using a secret database to securely manage credentials and provide them dynamically during deployment, ensuring that only the necessary credentials are exposed for resource access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If credentials are stored in plain text within deployment manifests, then deployment configuration is simple and straightforward, but security is compromised due to potential unauthorized access and inadvertent disclosure
Solution Approach 1:
The patent extracts credentials from the deployment manifest and stores them separately in a secure credential store. The deployment manifest contains only references to credentials rather than the actual credential values, thereby removing the security vulnerability while maintaining deployment simplicity.
Solution Approach 2:
The patent introduces a credential store as an intermediary component between the deployment manifest and the actual credentials. This intermediary securely manages credentials and provides them only when needed, preventing direct exposure in the deployment manifest while enabling straightforward deployment configuration.
2Ease of operation
If all credentials are exposed in deployment manifests, then resource access is straightforward, but access control flexibility is reduced and auditing becomes difficult
Solution Approach 1:
The patent enables different access control policies to be applied to different credentials. Each credential can have its own access permissions, scope, and auditing requirements defined in the credential store, allowing fine-grained control while maintaining simple access for applications that need them.
Solution Approach 2:
The patent implements auditing mechanisms that track and record credential access events. This feedback system monitors who accessed which credentials and when, enabling security auditing and accountability without complicating the actual resource access process for applications.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and computer program products for credential management. An application deployment system receives a deployment manifest for deploying an application in a cloud computing environment. A deployment director of the application deployment system determines a resource to be used by the application. The deployment director determines, from the deployment manifest, an identifier, e.g., a name, of credentials for accessing the resource. The deployment director requests the credentials from a credential manager of the application deployment system. Upon receiving the credentials, the deployment director modifies the deployment manifest by replacing the identifier with the received credentials. The application deployment system deploys the application using the modified deployment manifest and then deletes the modified deployment manifest.