Abstract: The technology disclosed herein enables a method to receive an indication of a change to an operating mode of a device from a first operating mode to a second operating mode, and identify a cryptographic item stored at a memory of the device, wherein the cryptographic item corresponds to an identification of the device signed with a digital signature, and wherein the digital signature is based on a private key that is inaccessible to the device. On response to receiving the indication of the change to the operating mode of the device, the method can modify the cryptographic item stored at the memory, and operate the device in the second operating mode based on the modified cryptographic item. The indication of the change to the operating mode of the device can correspond to a detection of a change in a function of the device.

Abstract: Encrypted first data and encrypted second data may be received, where each data is from different client servers. A request to perform an operation with the first data and the second data may be received. Whether the operation is authorized to be performed with the first data and the second data at an enclave may be verified. In response to verifying that the operation is authorized to be performed with the first data and the second data at the enclave, the encrypted first data and the encrypted second data may be decrypted to the first data and the second data, respectively. Furthermore, the operation may be performed with the first data and the second data at the enclave.

Abstract: An encrypted search query may be received from a requesting client system at a secure enclave of a processing device. The encrypted search query may be decrypted to form a decrypted search query. One or more index entries of a metadata index that correspond to the decrypted search query may be identified, such that each identified index entry is associated with a content reference that identifies a content item located outside the secure enclave. The index entries that correspond to the decrypted search query may include one or more index entries having one or more associated index metadata items that correspond to the decrypted search query. One or more secure search results may be generated, such that each secure search result corresponds to one of the index entries and comprises the content reference associated with the corresponding index entry. The secure search results may be sent to the requesting client system.

Abstract: An application may perform operations within a first secure enclave of a processing device. The application may provide secure monitoring data, such as secure heartbeat information. The monitoring data and an application identity may be verified at a second secure enclave of the processing device using local attestation operations. A remote attestation signature may be generated at the second secure enclave based on the monitoring data, the application identity, and a node private key. A monitoring message signature may be generated at the first secure enclave based on an application private key and a message payload that includes the monitoring data, the application identity, and the remote attestation signature. A monitoring message that includes the payload and monitoring message signature may be sent from the first secure enclave to a monitoring system, which may verify the message to detect unauthorized changes to the monitoring data or the application identity.

Abstract: A method may include obtaining, by a processing device, a workflow object that includes a plurality of workflow entity objects and one or more data objects, and executing a workflow by identifying, from the application objects, an application object that corresponds to a first application, wherein the workflow associates the application with at least one of the data objects, determining, whether the first application has permission to access the data object according to a data policy associated with the data object, wherein the data policy specifies one or more data access criteria, wherein the first application has permission to access the data object in response to one or more of the workflow entity objects that are associated with the data object satisfying the data access criteria, and responsive to determining that the first application has permission to access the data object, executing the first application in a secure enclave.

Abstract: A request to perform an operation associated with a service instance may be received by a processing device. The service instance may have an associated service instance identifier. A proxy instance associated with the service instance may be identified. The proxy instance may perform operations within a secure enclave associated with the processing device. The proxy instance within the secure enclave associated with the processing device may be used to verify that the secure enclave associated with the processing device contains the service instance associated with the service instance identifier. When the verification is successful, the proxy instance within the secure enclave associated with the processing device may be used to send a request to the service instance to perform the operation.

Abstract: An encrypted file system key associated with a first secure enclave may be received. A request from a second secure enclave to access a file system associated with the encrypted file system key may be received. In response to receiving the request, the encrypted file system key may be decrypted with a cryptographic key associated with an enclave manager to obtain a file system key. The file system key may be encrypted based on another cryptographic key associated with the second secure enclave to generate a re-encrypted file system key. Furthermore, the re-encrypted file system key may be provided to the second secure enclave.

Abstract: A request may be received from an application for a performance of an operation associated with a cryptographic key that is stored at a secure enclave. A plugin of the secure enclave may be identified from the request for performance of the operation. The operation associated with the cryptographic key may be performed by using the plugin of the secure enclave to generate an output within the secure enclave. The output generated within the secure enclave and based on the plugin may be provided to the application.

Abstract: A request to provide an application at a secure enclave of a server may be received. A hash value of the application may be generated. Application data that is to be used with the application at the secure enclave of the server may be identified. Another hash value of the application data that is to be used with the application at the secure enclave of the server may be generated. The hash value of the application and the other hash value of the application data may be signed where the signed hash value and other hash are being used to execute the application with the application data at the secure enclave of the server.

Abstract: A request to perform an operation with a cryptographic item may be received. A request for approval to perform the requested operation with the cryptographic item may be transmitted to a set of entities based on a policy associated with the cryptographic item. Indications of approval to perform the requested operation may be received from corresponding entities of the set of entities. A determination as to whether a number of the received indications of approval to perform the requested operation with the cryptographic item satisfies a threshold number may be made. In response to determining that the number of the received indications of approval from the corresponding entities of the set of entities satisfies the threshold number, the requested operation may be performed with the cryptographic item.

Abstract: A network service may be identified. One or more attributes of the network service may be determined. An attribute manifest for the network service may be generated based on the determined one or more attributes of the network service. Furthermore, the attribute manifest may be transmitted based on the determined one or more attributes to the network service.

Abstract: A request to issue a digital certificate may be received. A hash value corresponding to an application that has provided the request for the digital certificate may be identified. A determination may be made as to whether the hash value corresponding to the application matches with a known hash value. In response to determining that the hash value corresponding to the application matches with the known hash value the digital certificate may be issued to the application.

Abstract: Authentication information at a first portion of encrypted data may be identified. A cryptographic key may be derived based on a combination of an identification of the first portion of the received encrypted data and a master key. Additional authentication information may be generated based on a combination of the derived cryptographic key and another portion of the received encrypted data. The encrypted data may be verified by comparing the authentication information at the first portion of the received encrypted data with the generated additional authentication information. In response to verifying the received encrypted data, a second cryptographic key may be derived based on a combination of an identification of the another portion of the encrypted data and the master key. The other portion of the received encrypted data may be decrypted by using the second cryptographic key.

Abstract: An indication of a change to an operating mode of a device may be received. A cryptographic item stored at a memory of the device may be identified. In response to receiving the indication of the change to the operating mode of the device, the cryptographic item stored at the memory may be modified. The device may operate in the changed operating mode based on the modified cryptographic item.

Abstract: An input data may be received. Memory pages may be identified where each of the memory pages includes one or more cache lines. A first index table that includes cache lines may be generated from the memory pages based on the input data. Subsequently, an output data may be provided based on a particular cache line from the cache lines of the first index table.

Abstract: A first connection between a first network server and a second network server may be established where the first connection is based on a connection key stored at a secure location of the first network server. A request for one or more cryptographic keys may be transmitted from the first network server to the second network server. The first network server may receive the one or more cryptographic keys from the second network server over the first connection. The one or more cryptographic keys from the second server may be stored at the secure location of the first network server that is storing the connection key used to establish the first connection.

Abstract: A cryptographic key may be received or generated at a self-encrypting key management service application where the cryptographic key is received from another application provided on a server associated with the self-encrypting key management service application. The cryptographic key may be stored at a secure enclave corresponding to the self-encrypting key management service application. A request for a performance of a cryptographic operation associated with the cryptographic key may be received from the other application provided on the server. The cryptographic key at the secure enclave corresponding to the self-encrypting key management service application may be retrieved. The cryptographic operation may be performed with the cryptographic key to generate an output that is provided to the other application.