Microsoft Technology Licensing, LLC

Vyom P Munshi

Kahren Tevosyan

Brian Scott Lounsberry

Mark Eugene Russinovich

Ashok Chandrasekaran

Chetan S Shankar

Chandan Rama Reddy

Chuang Wang

Pavel Zakharov

Abhishek Pratap Singh Chauhan

Sandeep Kalarickal

Pavan Gopal Bandla

Srinivas S Nidadavolu

Pawel Tomasz Lipiec

Various methods and systems are provided for autonomous orchestration of secrets renewal and distribution. A secrets management service ('SMS') can be utilized to store, renew and distribute secrets in a distributed computing environment. The secrets are initially deployed, after which, SMS can automatically renew the secrets according to a specified rollover policy, and polling agents can fetch updates from SMS. In various embodiments, SMS can autonomously rollover client certificates for authentication of users who access a security critical service, autonomously rollover storage account keys, track delivery of updated secrets to secrets recipients, deliver secrets using a secure blob, and/or facilitate autonomous rollover using secrets staging. In some embodiments, a service is pinned to the path where the service's secrets are stored. In this manner, secrets can be automatically renewed without any manual orchestration and/or the need to redeploy services.

Autonomous secrets renewal and distribution

Various methods and systems are provided for autonomous orchestration of secrets renewal and distribution across scope boundaries. A cross-scope secrets management service ('SMS') can be utilized to store, renew and distribute secrets across boundaries in a distributed computing environment such as regional boundaries. In some embodiments, locally scoped secrets management services subscribe to receive updates from the cross-scope secrets management service. As secrets are renewed, they are automatically propagated to a subscribing local scope and distributed by the local secrets management service. In various embodiments, SMS can autonomously rollover storage account keys, track delivery of updated secrets to secrets recipients, deliver secrets using a secure blob, and/or facilitate autonomous rollover using secrets staging. In some embodiments, a service is pinned to the path where the service's secrets are stored. In this manner, secrets can be automatically renewed without any manual orchestration and/or the need to redeploy services.

Autonomous cross-scope secrets management

Various methods and systems are provided for autonomous secrets management for a temporary shared access signature ('SAS') service. Input for a temporary access request for an account resource, is received from a client. The temporary access request is validated, based on communicating a validation request to the secrets management service ('SMS') that can be utilized to store, renew and distribute secrets in a distributed computing environment. Validating the temporary access request is based on determining a storage account location path for SAS keys that provide temporary access to account resources. An access policy associated with the temporary access request is accessed. An SAS key request, associated with temporary access request, is communicated to the SMS. The SAS key request includes at least a portion of the access policy. An SAS key is received from the SMS. The SAS key, for access to the account resource, is communicated to the client.

Autonomous secrets management for a temporary shared access signature service

Growing community of inventors

Redmond, WA, United States of America

Vyom P Munshi