Cloud Centric Application Trust Validation

• US 20140181517A1
• Filed: 12/10/2013
• Published: 06/26/2014
• Est. Priority Date: 12/12/2012
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Ahmed, Zahid N., Alaranta, Anssi, Muthukrishnan, Karthik, Beauford, Mike
• Granted Patent: US 9,253,185 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

In accordance with the exemplary embodiments of the invention there is at least a method and an apparatus to perform the method of sending towards a key management device associated with an application service provider for an application, a key request for the application being booted in the cloud network; and in response to the key request, receiving an application specific key for the application, where the key is based on multiple factors associated with the application server. Further, there is at least a method and an apparatus to perform the method of receiving a key request from an application server of a cloud network for the application being booted in the cloud network; in response to the key request, authenticating the request using multiple attributes associated with the application server; and sending an application specific key for the application towards the application server.

Claims

1. A method comprising:

sending, with an application server of a cloud network towards a key management device associated with an application service provider for an application, a key request for the application being booted in the cloud network; and

in response to the key request, receiving an application specific key for the application, where the key is based on multiple factors associated with the application server.

2. The method of claim 1, wherein sending the key request comprises accessing an application programming interface uniform resource locator associated with the key management device.

3. The method of claim 2, wherein the uniform resource locator is initiated in a start-up script of the application.

4. The method of claim 2, wherein the uniform resource locator is initiated without additional data.

5. The method of claim 1, wherein the key request comprises a 16 kb secret key hardcoded into the boot-up or the bootstrap code.

6. The method of claim 1, further comprising invoking a GetKMSClientCredential REST API deployed in the cloud with multi-factor attributes and the key.

7. The method of claim 1, wherein the multi-factor attributes comprise an identification of the application and an internet protocol address of the application server.

8. The method as in claim 1 performed with a non-transitory computer readable medium encoded with a computer program executed by a processor.

9. An apparatus comprising:

at least one processor; and

at least one memory including computer program code, where the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to at least;

send, with an application server of a cloud network towards a key management device associated with an application service provider for an application, a key request for the application being booted in the cloud network; and

in response to the key request, receive an application specific key for the application, where the key is based on multiple factors associated with the application server.

10. The apparatus of claim 9, wherein sending the key request comprises accessing an application programming interface uniform resource locator associated with the key management device.

11. The apparatus of claim 10, wherein the uniform resource locator is initiated in a start-up script of the application.

12. The apparatus of claim 10, wherein the uniform resource locator is initiated without additional data.

13. The apparatus of claim 9, wherein the key request comprises a 16 kb secret key hardcoded into the boot-up or the bootstrap code.

14. The apparatus of claim 9, wherein the at least one memory including the computer program coded is configured with the at least one processor to cause the apparatus to invoke a GetKMSClientCredential REST API deployed in the cloud with multi-factor attributes and the key.

15. The apparatus of claim 9, wherein the multi-factor attributes comprise an identification of the application and an internet protocol address of the application server.

16. (canceled)

17. (canceled)

18. (canceled)

19. (canceled)

20. A method comprising:

receiving, with a key management device associated with an application service provider for an application, a key request from an application server of a cloud network for the application being booted in the cloud network;

in response to the key request, authenticating the request using multiple attributes associated with the application server; and

sending an application specific key for the application towards the application server.

21. The method of claim 20, wherein the request comprises an application programming interface uniform resource locator initiated with the key management device.

22. The method of claim 21, wherein the uniform resource locator is initiated in a start-up script of the application.

23. The method of claim 21, wherein the uniform resource locator is without additional data.

24. The method of claim 20, wherein the key request comprises a 16 kb secret key originating from boot-up or bootstrap code associated with the application.

25. The method of claim 20, wherein the multi-factor attributes comprise an identification of the application and an internet protocol address of the application server.

26. The method as in claim 20 performed with a non-transitory computer readable medium encoded with a computer program executed by a processor.

27. An apparatus comprising:

at least one processor; and

at least one memory including computer program code, where the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to at least;

receive, with a key management device associated with an application service provider for an application, a key request from an application server of a cloud network for the application being booted in the cloud network;

in response to the key request, authenticate the request using multiple attributes associated with the application server; and

send an application specific key for the application towards the application server.

28. The apparatus of claim 27, wherein the request comprises an application programming interface uniform resource locator initiated with the key management device.

29. The apparatus of claim 28, wherein the uniform resource locator is initiated in a start-up script of the application.

30. The apparatus of claim 28, wherein the uniform resource locator is without additional data.

31. The apparatus of claim 27, wherein the key request comprises a 16 kb secret key originating from boot-up or bootstrap code associated with the application.

32. The apparatus of claim 27, wherein the multi-factor attributes comprise an identification of the application and an internet protocol address of the application server.

33. (canceled)

34. (canceled)

35. (canceled)

36. (canceled)