Security credential deployment in cloud environment

• US 8,863,255 B2
• Filed: 09/14/2012
• Issued: 10/14/2014
• Est. Priority Date: 09/14/2012
• Status: Active Grant

• Current Assignee: Netflix, Inc.
• Original Assignee: Netflix, Inc.
• Inventors: Zarfoss, James R. III, Yuan, Yong
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US13/617,505
• Publication Number:
  US 20140082349A1
• Time in Patent Office: 760 Days
• Field of Search: None
• US Class Current: 726/6
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

Techniques are described for deploying a security credential for an application deployed in a cloud. An encrypted security credential is received from a remote system and is inserted into a virtual machine image associated with the application. Upon deploying the virtual machine image as a virtual machine instance, embodiments transmit a request to a cryptex server for a decrypted security credential, the request including the encrypted security credential and a virtual machine identifier for the virtual machine instance. The cryptex server is configured to retrieve metadata associated with the virtual machine identifier and to authenticate the virtual machine instance using the retrieved metadata. Embodiments receive, from the cryptex server, the decrypted security credential for use by the application.

Claims

1. A method of deploying a security credential for an application deployed in a cloud, comprising:

receiving an encrypted security credential from a remote system;

inserting, by operation of one or more computer processors, the encrypted security credential into a virtual machine image associated with the application;

upon deploying the virtual machine image as a virtual machine instance, transmitting a request to a cryptex server for a decrypted security credential, the request including the encrypted security credential and a virtual machine instance identifier for the deployed virtual machine image, wherein the cryptex server is configured to retrieve metadata associated with the virtual machine identifier and to authenticate and authorize the virtual machine instance using the retrieved metadata; and

receiving, from the cryptex server, the decrypted security credential for use by the application.

2. The method of claim 1, wherein the retrieved metadata includes a network address, and wherein the cryptex server is configured to authenticate the virtual machine instance by comparing the network address in the retrieved metadata to a second network address of a computing system from which the transmitted request was received.

3. The method of claim 1, wherein the retrieved metadata includes a virtual machine image label, and wherein the cryptex server is configured to authenticate the virtual machine instance by comparing the virtual machine image label in the retrieved metadata to a second virtual machine image label associated with a virtual machine from which the transmitted request was received.

4. The method of claim 1, wherein the cryptex server is configured to decrypt the encrypted security credential, upon authenticating the virtual machine instance.

5. The method of claim 1, wherein a plurality of virtual machine instances are deployed in the cloud, wherein each of the plurality of virtual machine instances cloud is assigned a respective unique identifier by a cloud management system, and wherein the virtual machine instance identifier is the unique identifier assigned to the deployed virtual machine instance.

6. The method of claim 1, wherein metadata associated with the encrypted security credential specifies a deployment system identifier corresponding to a system on which the encrypted security credential is intended to be deployed, and wherein the cryptex server is further configured to authenticate and authorize the virtual machine instance based on the deployment system identifier.

7. A non-transitory computer-readable medium containing a program that, when executed, performs an operation for deploying a security credential for an application deployed in a cloud, the operation comprising:

receiving an encrypted security credential from a remote system;

inserting the encrypted security credential into a virtual machine image associated with the application;

upon deploying the virtual machine image as a virtual machine instance, transmitting a request to a cryptex server for a decrypted security credential, the request including the encrypted security credential and a virtual machine instance identifier for the virtual machine instance, wherein the cryptex server is configured to retrieve metadata associated with the virtual machine identifier and to authenticate and authorize the virtual machine instance using the retrieved metadata; and

receiving, from the cryptex server, the decrypted security credential for use by the application.

8. The non-transitory computer-readable medium of claim 7, wherein the retrieved metadata includes a network address, and wherein the cryptex server is configured to authenticate the virtual machine instance by comparing the network address in the retrieved metadata to a second network address of a computing system from which the transmitted request was received.

9. The non-transitory computer-readable medium of claim 7, wherein the retrieved metadata includes a virtual machine image label, and wherein the cryptex server is configured to authenticate the virtual machine instance by comparing the virtual machine image label in the retrieved metadata to a second virtual machine image label associated with a virtual machine from which the transmitted request was received.

10. The non-transitory computer-readable medium of claim 7, wherein the cryptex server is configured to decrypt the encrypted security credential, upon authenticating the virtual machine instance.

11. The non-transitory computer-readable medium of claim 7, wherein a plurality of virtual machine instances are deployed in the cloud, wherein each of the plurality of virtual machine instances cloud is assigned a respective unique identifier by a cloud management system, and wherein the virtual machine instance identifier is the unique identifier assigned to the deployed virtual machine instance.

12. The non-transitory computer-readable medium of claim 7, wherein metadata associated with the encrypted security credential specifies a deployment system identifier corresponding to a system on which the encrypted security credential is intended to be deployed, and wherein the cryptex server is further configured to authenticate and authorize the deployed virtual machine instance based on the deployment system identifier.

13. A system, comprising:

a processor; and

a memory containing a program that, when executed on the processor, performs an operation for deploying a security credential for an application deployed in a cloud, the operation comprising;

receiving an encrypted security credential from a remote system;

inserting the encrypted security credential into a virtual machine image associated with the application;

upon deploying the virtual machine image as a virtual machine instance, transmitting a request to a cryptex server for a decrypted security credential, the request including the encrypted security credential and a virtual machine instance identifier for the virtual machine instance, wherein the cryptex server is configured to retrieve metadata associated with the virtual machine identifier and to authenticate and authorize the virtual machine instance using the retrieved metadata; and

receiving, from the cryptex server, the decrypted security credential for use by the application.

14. The system of claim 13, wherein the retrieved metadata includes a network address, and wherein the cryptex server is configured to authenticate the deployed virtual machine instance by comparing the network address in the retrieved metadata to a second network address of a computing system from which the transmitted request was received.

15. The system of claim 13, wherein the retrieved metadata includes a virtual machine image label, and wherein the cryptex server is configured to authenticate the virtual machine instance by comparing the virtual machine image label in the retrieved metadata to a second virtual machine image label associated with a virtual machine from which the transmitted request was received.

16. The system of claim 13, wherein the cryptex server is configured to decrypt the encrypted security credential, upon authenticating the virtual machine instance.

17. The system of claim 13, wherein a plurality of virtual machine instances are deployed in the cloud, wherein each of the plurality of virtual machine instances cloud is assigned a respective unique identifier by a cloud management system, and wherein the virtual machine instance identifier is the unique identifier assigned to the deployed virtual machine instance.

18. The system of claim 13, wherein metadata associated with the encrypted security credential specifies a deployment system identifier corresponding to a system on which the encrypted security credential is intended to be deployed, and wherein the cryptex server is further configured to authenticate and authorize the virtual machine instance based on the deployment system identifier.