International Business Machines Corporation

Marco Pavone

Angel Nunez Mencias

Karunakar Bojjireddy

Erlander Lo

Nataraj Nagaratnam

Christopher S Smith

Martin L Schmatz

Navaneeth Rameshan

Martin Smolny

Garry Joseph Sullivan

Clifford L Hansen

David N Nguyen

Blazej Pawlak

Leo Moesgaard

David Nguyen

Ross Martin Heninger

Isabel Arnold

Søren Peen

Troels Nørgaard

Jakub Karol Jelonek

A method for authenticating and authorizing a user identifier to access a service is disclosed. The service is activated by a service application programming interface which requires a two-factor authorization to initiate execution of the service for the requesting user identifier. The method receives, by the service API, a service request together with first and second data for a first and a second authentication method, confirming a correctness of the first data as a first identity pass key using the first authentication method, confirming a correctness of the second data as a second identity pass key using the second authentication method and the first identity pass key is input to the second authentication method, and the second authentication method differs from the first authentication method. Having received the confirmed correctness of both the first identity pass key and the second identity pass key, executing the service.

Authenticating and authorizing api calls with multiple factors

A method includes: federating, by a computer device, a proxy hardware security module from a physical hardware security module; storing, by the computer device, the proxy hardware security module; receiving, by the computer device, a first one of a plurality of periodic identifying communications from the physical hardware security module; and erasing, by the computer device, the proxy hardware security module as a result of the computer device not receiving a second one of the plurality of periodic identifying communications.

HSM self-destruction in a hybrid cloud KMS solution

An approach is provided for distributing a root key to a hardware security module (HSM) of an HSM cluster. A signed first command is transmitted to a source HSM to create a master key. A fingerprint of the master key is received in a response signed by the source HSM using a module signing key hardcoded into the source HSM at manufacturing time. A second command is transmitted to a first HSM to generate an importer key pair. A request is transmitted to the source HSM to create and export a wrapped master key. The master key wrapped with a transport key is received. The wrapped master key is transmitted to the first HSM. The master key is activated in the first HSM.

Securely transporting a root key using a privately/public key pair for user-controlled authentication of nodes in a hardware security module cluster

A system, method, and computer program product for implementing encryption key management is provided. The method includes connecting a hardware device to a keystore agent comprising a system configured to manage one or more keystores holding one or more cryptographic key instances. A key template is configured to define an attribute for generating cryptographic keys. The key template is modified such that the keystore component is added to the key template and instances of associated cryptographic keys are generated. Each instance is installed within the keystore component and associated attributes associated with data for consumption are generated. A key event log defining all events associated with a given key of the associated cryptographic keys with respect to a lifetime of the given key is generated and a repository comprising key templates and associated key data is maintained.

Encryption key hybrid deployment management

Certificate and key management is provided. A signed certificate corresponding to an enterprise is deployed to a plurality of cryptographic communication protocol endpoint proxies located in a heterogeneous distributed computing environment where a private key corresponding to the enterprise is not placed in any of the plurality of cryptographic communication protocol endpoint proxies. Offload of cryptographic communications from the plurality of cryptographic communication protocol endpoint proxies to the hardware security module is received by the hardware security module where the hardware security module verifies connection authenticity for the plurality of cryptographic communication protocol endpoint proxies across the heterogeneous distributed computing environment using the private key corresponding to the enterprise that remains within a security boundary of the hardware security module.

Data in transit protection with exclusive control of keys and certificates across heterogeneous distributed computing environments

A computer program product, the computer program product including a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer device to cause the computer device to: federate a proxy hardware security module from a physical hardware security module; store the proxy hardware security module; receive a first one of a plurality of periodic identifying communications from the physical hardware security module; and erase the proxy hardware security module as a result of the computer device not receiving a second one of the plurality of periodic identifying communications.

Growing community of inventors

Ehningen, Germany

Marco Pavone