Abstract: Techniques are disclosed relating to the protection of secrets within a software development lifecycle. Developers can use an encryption service to encrypt a secret to be used by an application within a package. The secret can be associated with the application, and then encrypted and included in a package that is signed and passed through a software automation pipeline to a data center that hosts the production server for the application. The application executing on the production server can request that the secret be decrypted by a decryption service after package verification. A developer can also specify, in a manifest file, a set of secrets needed for applications executing in the same data center. The manifest file may be passed from the software development environment to the data center, where the specified secrets are created and used by the applications without ever residing or being accessible outside the data center.

Abstract: Methods, systems, and devices for data processing are described. A server host may receive a request to access a web domain associated with a tenant of a multi-tenant cloud platform. The server host may retrieve a digital certificate and an encrypted private key associated with the tenant, where the digital certificate includes a public key associated with the tenant. The server host may obtain a symmetric key that is wrapped using an asymmetric public key associated with the server host. The wrapped symmetric key may be provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted private key and the wrapped symmetric key. The server host may receive a response that includes a cryptographic signature associated with the private key of the tenant. The server host may provide the digital certificate and the cryptographic signature to a client device associated with the request.

Abstract: A method of data processing is described. The method includes receiving, at a server host, a login request that includes a clear text password for an account. The method further includes retrieving, from a database, a payload stored in association with the account. The payload may indicate a hash value of a user configured password for the account, a hashing algorithm used for generation of the hash value, an initialization vector, and a key agreement public key associated with the account. The payload may be encrypted using a secret key derived from the key agreement public key and a private key provisioned to a key protection component of the server host. The method further includes transmitting a request that includes the payload and the clear text password. The method further includes receiving a response that indicates whether the clear text password corresponds to the user configured password.

Abstract: Methods, systems, and devices for data processing are described. A server host may receive a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform. The server host may retrieve an encrypted payload associated with the account. The encrypted payload may include a hash value of a user-configured password for the account and an indication of a hashing algorithm used to transform the user-configured password into the hash value. The server host may obtain a wrapped symmetric key provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted payload, the clear text password, and the wrapped symmetric key. The server host may receive a response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password.

Abstract: A method of data processing is described. The method includes receiving, at a server host, a request to access a web domain associated with a tenant of a multi-tenant cloud platform; retrieving, from a database, a tenant private key and a certificate associated with the tenant, where the tenant private key is encrypted with a secret key derived from a key agreement public key associated with the tenant and a private key provisioned to a key protection component of the server host; providing, to the key protection component, the encrypted tenant private key and the key agreement public key; receiving, from the key protection component, an API response including a signature associated with the tenant private key; and providing, to a client device associated with the request to access the web domain of the tenant, the certificate and the signature, where the certificate is used to verify the signature.

Abstract: Techniques are disclosed relating to the protection of secrets within a software development lifecycle. Developers can use an encryption service to encrypt a secret to be used by an application within a package. The secret can be associated with the application, and then encrypted and included in a package that is signed and passed through a software automation pipeline to a data center that hosts the production server for the application. The application executing on the production server can request that the secret be decrypted by a decryption service after package verification. A developer can also specify, in a manifest file, a set of secrets needed for applications executing in the same data center. The manifest file may be passed from the software development environment to the data center, where the specified secrets are created and used by the applications without ever residing or being accessible outside the data center.

Abstract: Techniques are disclosed relating to secure data migration between different data zones via a message broker system for asynchronous communication. A migration policy engine is used to determine allowable data migrations. If a data migration is permitted, a set of data in the source data zone is encrypted using a symmetric key that is generated using a key agreement protocol that utilizes a public key of a data zone key pair of a destination data zone and a private key of a migration key pair. The source data zone writes the encrypted data and a public key of the migration key pair to the message broker system. The destination data zone then reads this data from the message broker system, and decrypts the data by deriving the symmetric key using the public key of the migration key pair and a private key of the data zone key pair.

Abstract: A remote security controller (RSC) generates a private key for a client application on a different host computing device and splits the private key into a first fragment and a second fragment. The first fragment, but not the second fragment, is encrypted using a symmetric key. The split private key is returned to the different host computing device. A local security controller (LSC) on the different host computing device is able to derive the symmetric key using a key agreement protocol with the RSC. When the client application needs to digitally sign a data value with the split private key, the client application generates a first partial Multiparty Computation (MPC) signature using the second fragment. The LSC generates a second partial MPC signature with the first fragment, which has been decrypted using the symmetric key. The first and second partial MPC signatures are combinable to digitally sign the data value.

Abstract: A cloud infrastructure is configured and deployed for managing services executed on a cloud platform. The cloud infrastructure includes a control datacenter configured to communicate with one or more service datacenters. The service datacenter deploys one or more application programming interfaces (API's) associated with a service. The service datacenter also deploys an administration agent. The control datacenter hosts an engine that receives requests from users to perform administration operations by invoking the administration API's. In this manner, the control datacenter functions as a centralized control mechanism that effectively distributes administration operation requests as they are received from users to service datacenters that can service the requests. The cloud infrastructure provides an auditable, compliant and secure management system for administering services for distributed systems running in the cloud.

Abstract: Methods, systems, apparatuses, devices, and computer program products are described. A virtual machine may receive, from an application associated with a tenant, a request to perform a cryptographic operation for the application at the virtual machine. Based on receiving the request, the virtual machine may determine that the tenant is limited to using a designated set of cryptographic operations in accordance with a cryptographic operation validation policy associated with the tenant. In some examples, the virtual machine may identify a designated version of the cryptographic operation, from the designated set of cryptographic operations, that corresponds to the cryptographic operation indicated by the request in satisfaction of the cryptographic operation validation policy. The virtual machine may execute the designated version of the cryptographic operation and return a result of the execution to the application.

Abstract: Methods, systems, and devices supporting data processing are described. In some systems, a first service executing on a datacenter may receive a request to establish a secure connection and a certificate from a second service. The datacenter may be provisioned with an indication of certificates that have been revoked by a certificate authority (CA). The first service may validate a certificate chain for the certificate from the second service based on the certificates that have been revoked by the CA. If a certificate of the certificate chain has been revoked, the first service may not establish the connection with the second service. If the certificates of the certificate chain have not been revoked, the first service may establish a secure connection with the second service. The services may communicate in accordance with validating the certificate chain.

Abstract: A cloud infrastructure is configured and deployed for managing services executed on a cloud platform. The cloud infrastructure includes a control datacenter configured to communicate with one or more service datacenters. The service datacenter deploys one or more application programming interfaces (API's) associated with a service. The service datacenter also deploys an administration agent. The control datacenter hosts an engine that receives requests from users to perform administration operations by invoking the administration API's. In this manner, the control datacenter functions as a centralized control mechanism that effectively distributes administration operation requests as they are received from users to service datacenters that can service the requests. The cloud infrastructure provides an auditable, compliant and secure management system for administering services for distributed systems running in the cloud.

Abstract: Methods, systems, and devices for data processing are described. A server host may receive a request to access a web domain associated with a tenant of a multi-tenant cloud platform. The server host may retrieve a digital certificate and an encrypted private key associated with the tenant, where the digital certificate includes a public key associated with the tenant. The server host may obtain a symmetric key that is wrapped using an asymmetric public key associated with the server host. The wrapped symmetric key may be provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted private key and the wrapped symmetric key. The server host may receive a response that includes a cryptographic signature associated with the private key of the tenant. The server host may provide the digital certificate and the cryptographic signature to a client device associated with the request.

Abstract: A method of data processing is described. The method includes receiving, at a server host, a login request that includes a clear text password for an account. The method further includes retrieving, from a database, a payload stored in association with the account. The payload may indicate a hash value of a user configured password for the account, a hashing algorithm used for generation of the hash value, an initialization vector, and a key agreement public key associated with the account. The payload may be encrypted using a secret key derived from the key agreement public key and a private key provisioned to a key protection component of the server host. The method further includes transmitting a request that includes the payload and the clear text password. The method further includes receiving a response that indicates whether the clear text password corresponds to the user configured password.

Abstract: A method of data processing is described. The method includes receiving, at a server host, a request to access a web domain associated with a tenant of a multi-tenant cloud platform; retrieving, from a database, a tenant private key and a certificate associated with the tenant, where the tenant private key is encrypted with a secret key derived from a key agreement public key associated with the tenant and a private key provisioned to a key protection component of the server host; providing, to the key protection component, the encrypted tenant private key and the key agreement public key; receiving, from the key protection component, an API response including a signature associated with the tenant private key; and providing, to a client device associated with the request to access the web domain of the tenant, the certificate and the signature, where the certificate is used to verify the signature.

Abstract: Methods, systems, and devices for data processing are described. A server host may receive a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform. The server host may retrieve an encrypted payload associated with the account. The encrypted payload may include a hash value of a user-configured password for the account and an indication of a hashing algorithm used to transform the user-configured password into the hash value. The server host may obtain a wrapped symmetric key provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted payload, the clear text password, and the wrapped symmetric key. The server host may receive a response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password.

Abstract: A client application and a local security controller (LSC) executing on a host computing device use a Multiparty Computation (MPC) cryptographic key generation technique to create two fragments of a split private key, which are held by the client application and LSC, respectively. The client application generates a certificate signing request (CSR). The client application and LSC sign the CSR with the split private key using an MPC technique. The LSC then signs a token from the client application to indicate that the private key corresponding to the CSR is MPC-backed. A package with the CSR and the first and second signatures is then sent to a remote device acting as a certificate authority. The remote device verifies the two signatures and issues a certificate to the client application. The second signature is verified using information sent to the remote device from the LSC during a registration process.

Abstract: A cloud infrastructure is configured and deployed for managing services executed on a cloud platform. The cloud infrastructure includes a control datacenter configured to communicate with one or more service datacenters. The service datacenter deploys one or more application programming interfaces (API's) associated with a service. The service datacenter also deploys an administration agent. The control datacenter hosts an engine that receives requests from users to perform administration operations by invoking the administration API's. In this manner, the control datacenter functions as a centralized control mechanism that effectively distributes administration operation requests as they are received from users to service datacenters that can service the requests. The cloud infrastructure provides an auditable, compliant and secure management system for administering services for distributed systems running in the cloud.

Abstract: Techniques are disclosed relating to the protection of secrets within a software development lifecycle. Developers can use an encryption service to encrypt a secret to be used by an application within a package. The secret can be associated with the application, and then encrypted and included in a package that is signed and passed through a software automation pipeline to a data center that hosts the production server for the application. The application executing on the production server can request that the secret be decrypted by a decryption service after package verification. A developer can also specify, in a manifest file, a set of secrets needed for applications executing in the same data center. The manifest file may be passed from the software development environment to the data center, where the specified secrets are created and used by the applications without ever residing or being accessible outside the data center.

Abstract: A cloud infrastructure is configured and deployed for managing services executed on a cloud platform. The cloud infrastructure includes a control datacenter configured to communicate with one or more service datacenters. The service datacenter deploys one or more application programming interfaces (API's) associated with a service. The service datacenter also deploys an administration agent. The control datacenter hosts an engine that receives requests from users to perform administration operations by invoking the administration API's. In this manner, the control datacenter functions as a centralized control mechanism that effectively distributes administration operation requests as they are received from users to service datacenters that can service the requests. The cloud infrastructure provides an auditable, compliant and secure management system for administering services for distributed systems running in the cloud.