Controlling exposure of sensitive data and operation using process bound security tokens in cloud computing environment

Abstract

Exposure of sensitive information to users and other servers is controlled by using a first security token which contains a user identity and one or more user credentials associated with a first user; a second security token which contains an identity of a token issuer and an identity of a first owning process; and at least a first trusted server which accesses a downstream computing service on behalf of the first user by substituting or combining the first security token and the second security token, while preventing the second security token from being exposed to the first user. This establishes a first security sensitivity level for the first user and a second security sensitivity level for the first trusted server, wherein the first security sensitivity level is a lower access level than the second security sensitivity level for the downstream service.