Mastercard International Incorporated

Eric Devolder

Eric Trent Robins

Eric Alger

An application server has a custodian application running thereon. The custodian application instantiates a cryptographic microservice. The custodian application transmits a request message to a centralized KMS requesting a data encryption key. In response, the centralized KMS returns the data encryption key. The custodian application transmits the authorization grant request to the centralized KMS and receives the authorization grant and encrypted data encryption key in return. The custodian application transmits the authorization grant and encrypted data encryption key to the cryptographic microservice application. The cryptographic microservice application transmits the authorization grant and encrypted data encryption key to the centralized KMS and receives the decrypted data encryption key in return.

Systems and methods for distributed cryptography as a service key loading

An application server has a custodian application running thereon. The server receives a command to instantiate a cryptographic microservice application on the application server. In response, the server instantiates the cryptographic microservice application. The cryptographic microservice application builds a secure enclave on the application server and, within the secure enclave, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application. The server transmits the cryptogram to an authentication computing system. The server receives a digitally signed certificate from the authentication computing system and a data encryption key encrypted with a master tenant key from the custodian application. The server transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The server then receives the decrypted data encryption key from the authentication computing system.

Systems and methods for initializing a distributed cryptography as a service application

An application server has a custodian application running thereon. The custodian application instantiates a cryptographic microservice. The custodian application transmits a first request message to a centralized KMS requesting a data encryption key. In response, the centralized KMS returns the data encryption key. The custodian application transmits a second request message to the cryptographic microservice application. The second request message includes a request for a wrapping certificate from the cryptographic microservice application. The custodian application receives the wrapping certificate. The custodian application transmits a third request message to the centralized KMS. The third request message includes the data encryption key encrypted via the master-level tenant key and the wrapping certificate. The custodian application also receives the data encryption key encrypted via the wrapping certificate and transmits it to the cryptographic microservice application. The cryptographic microservice application unwraps the wrapped key using the wrapping certificate.

An application server has a custodian application running thereon. The custodian application instantiates a cryptographic microservice. The cryptographic microservice application builds a white-box cryptographic enclave. The custodian application transmits a request for an authorization grant to an authentication computing system. In response, the authentication computing system returns the authorization grant. The custodian application transmits the authorization grant to the cryptographic microservice application. The cryptographic microservice application transmits the authorization grant to the authentication computing system and then receives a digitally signed certificate therefrom. The cryptographic microservice application receives a data encryption key from the custodian application. The cryptographic microservice application transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The cryptographic microservice application then receives the decrypted data encryption key from the authentication computing system.

Growing community of inventors

Vedrin, Belgium

Eric Devolder