International Business Machines Corporation

Karunakar Bojjireddy

Erlander Lo

Angel Nunez Mencias

Nataraj Nagaratnam

Sreekanth Ramakrishna Iyer

Marco Pavone

Sudheesh S Kairali

Gal A Shachor

Vijay R Kalangumvathakkal

Carroll Eugene Fulkerson, Jr

Pratheek Karnati

Amber Roy Chowdhury

Jim Alain Laredo

Mark Duane Seaborn

Eduardo Rodriguez

Gregory J Rosensteel

A method includes: federating, by a computer device, a proxy hardware security module from a physical hardware security module; storing, by the computer device, the proxy hardware security module; receiving, by the computer device, a first one of a plurality of periodic identifying communications from the physical hardware security module; and erasing, by the computer device, the proxy hardware security module as a result of the computer device not receiving a second one of the plurality of periodic identifying communications.

HSM self-destruction in a hybrid cloud KMS solution

A key management service creates a key upon user request. The key management service receives a request for a first cryptographic operation. The key management service performs the first cryptographic operation. The key management service returns results of the first cryptographic operation to a dependent service. The key management service receives a notification of key rotation. The key management service receives a request for a second cryptographic operation. The key management service performs the second cryptographic operation. The key management service returns results of the second cryptographic operation to the dependent service. The key management service returns updated key metadata to the dependent service.

Automatic provisioning of key material rotation information to services

A computer program product, the computer program product including a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer device to cause the computer device to: federate a proxy hardware security module from a physical hardware security module; store the proxy hardware security module; receive a first one of a plurality of periodic identifying communications from the physical hardware security module; and erase the proxy hardware security module as a result of the computer device not receiving a second one of the plurality of periodic identifying communications.

Accessing shared sensitive information in a managed container environment is provided. Each worker node in a plurality of worker nodes has access to shared sensitive application data located in a secure enclave within the plurality of worker nodes using a data encryption key. Each worker node in the plurality of worker nodes protects the data encryption key of each respective worker node using a sealing key that is unique to the secure enclave on a respective worker node.

Cryptographic key orchestration between trusted containers in a multi-node cluster

A computer-implemented method for distributing digital certificates. A request for a digital certificate is received from a requesting system. A deployment challenge is sent to the trust agent running on the requesting system. A response to the deployment challenge is received from the trust agent running on the requesting system. The response to the deployment challenge is evaluated to determine whether the response is correct. The digital certificate is distributed to the requesting system in response to a determination that the response to the deployment challenge is correct.

Secure trust based distribution of digital certificates

A system and non-transitory computer program product for distributing digital certificates. A request for a digital certificate is received from a requesting system. A deployment challenge is sent to the trust agent running on the requesting system. A response to the deployment challenge is received from the trust agent running on the requesting system. The response to the deployment challenge is evaluated to determine whether the response is correct. The digital certificate is distributed to the requesting system in response to a determination that the response to the deployment challenge is correct.

Technologies for providing software code and data with in-memory protection through runtime memory encryption are described. A service comprising an integration component (an interface set) receives software program code and data that is to be protected in one or more protected areas of execution in memory. The integration component can integrate with a software development pipeline. The service (e.g. a wrapper engine component thereof) obtains the software program code and wraps the software program code and the data into a wrapped component. The service generates a secure counterpart program for executing in one or more protected areas of execution in memory (e.g., an enclave).

Facilitating build and deploy runtime memory encrypted cloud applications and containers

A method for managing a configuration of heterogeneous software artifacts uses a common central configuration representation. An artifact of an unknown type, from an initial software solution, is submitted to a solution configuration tool. The solution configuration tool sends a request to a solution architect for locations of configuration files within the artifact. For each artifact whose configuration file locations have been requested from the solution architect, the solution configuration tool determines if each corresponding configuration file is a property file or an Extensible Markup Language (XML) file. If the corresponding configuration file is an XML file, then the solution architect provides a first and second xPath for locating the names and values of the configuration parameters in the XML configuration file. The configuration file and configuration parameter locator information is then stored in a configuration locator file. Information in the configuration locator file is used to introspect configuration parameters from the artifacts and store these generically in a central configuration file. Solution-level parameters are then defined and mapped to artifact-level parameters for use in configuring subsequent software solutions instantiated from the initial software solution.

Generically managing the configuration of heterogeneous software artifacts

A method for managing a configuration of heterogeneous software artifacts through a common central configuration representation includes adding a plurality of software artifacts from an initial software solution to a heterogeneous configuration tool. Using this heterogeneous configuration tool, artifact-level configuration parameters are extracted out of selected software artifacts by the heterogeneous configuration tool. The extracted artifact-level configuration parameters are then presented in a single representation. A subset of the presented extracted artifact-level configuration parameters is mapped to a set of solution-level parameters, which are then exposed in a subsequent software solution. Thereafter, parameters for one or more of the solution-level parameters, which are used by the subsequent software solution, are exposed. These parameters for the subsequent software solution are then mapped back to the artifact-level configuration parameters of the subsequent software solution.

Growing community of inventors

Apex, NC, United States of America

Karunakar Bojjireddy