Secure Credential Hub for Cloud Application Platforms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud application platforms face security vulnerabilities due to the storage of service credentials in centralized databases, which can expose them to unnecessary risks and unauthorized access.
Innovation Solution
Implementing a secure credential hub that stores service credentials separately from the centralized database, using a credential location identifier, and employing a service broker to manage secure communication through TLS protocol, ensuring only authorized applications can access the credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If service credentials are stored in a centralized database on the cloud application platform, then application access and management are simplified, but security vulnerabilities increase due to broader exposure and potential unauthorized access
Solution Approach 1:
The system segments credential storage by separating the centralized database (storing only credential location identifiers) from the secure credential hub (storing actual credentials). This segmentation limits the exposure scope of credentials while maintaining centralized management capabilities.
Solution Approach 2:
The service broker acts as an intermediary component that manages credential retrieval between the application and the secure credential hub. It receives bind requests, obtains credentials securely, and provides them to applications without exposing the credential storage mechanism.
2Object-affected harmful factors
If service credentials are stored separately in a secure credential hub, then security is improved by limiting exposure, but system complexity increases due to additional components and retrieval processes
Solution Approach 1:
The service broker performs multiple functions: managing service bindings, retrieving credentials from the secure credential hub, and providing credentials to applications. This multi-functionality consolidates complexity into a single component rather than distributing it across multiple specialized components.
Solution Approach 2:
The system uses credential location identifiers as references stored in the centralized database, which point to actual credentials in the secure credential hub. This copying mechanism allows the system to manage credentials securely without duplicating the actual credential data in multiple locations.
3Object-affected harmful factors
If service credentials are rotated securely, then security is maintained, but application workloads may be affected requiring rescheduling or reconfiguration
Solution Approach 1:
Applications retrieve credentials dynamically from the secure credential hub through the service broker during runtime rather than relying on pre-configured credentials. This self-service mechanism allows credential rotation without requiring application rescheduling or reconfiguration, as applications continuously obtain updated credentials automatically.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and computer programs encoded on computer storage media, for binding service credentials to an application. One example system receives a service bind request for an application in a cloud application platform. The service bind request includes a request to bind a service provided by a service host in the cloud application platform. The service bind request specifies (i) an identifier for the service and (ii) a unique identifier for the application. The system receives, from the service host, credentials for the application to access the service. The system provides the credentials to a secure credential hub installed on the cloud application platform. The secure credential hub stores the credentials in association with a credential location identifier. The system grants, to the unique identifier for the application, read access to the credential location identifier. The system stores the credential location identifier as application metadata for the application.