公开(公告)号：US20250015988A1

公开(公告)日：2025-01-09

申请号：US18764594

申请日：2024-07-05

Applicant: Oracle International Corporation

Inventor： Apurv Awasthi ,  Frederick Anthonisamy Bosco ,  Bharat Shivram ,  Madhu Manjunath ,  Deepak Kumar ,  Raj Miglani ,  Akshay Mall ,  Mayank Bajpai ,  Jun Tong ,  Mukesh Shah ,  Mauruthi Geetha Mohan

IPC: H04L9/08 ,  H04L9/40

Abstract: A key management service (KMS) in a cloud computing environment has an internal vault for cryptographic operations by an internal cryptographic key within the cloud environment and a proxy key vault communicatively coupled to an external key manager (EKM) that stores an external cryptographic key. The KMS uses a provider-agnostic application program interface (API) that permits the cloud service customer to use the same interface request and format for cryptographic operation requests regardless of whether the request is for an operation directed to an internal vault or to an external vault and regardless of the particular vendor of the external key management service operating on the external hardware device.

公开(公告)号：US20250015977A1

公开(公告)日：2025-01-09

申请号：US18764683

申请日：2024-07-05

Applicant: Oracle International Corporation

Inventor： Apurv Awasthi ,  Frederick Anthonisamy Bosco ,  Bharat Shivram ,  Madhu Manjunath ,  Deepak Kumar ,  Raj Miglani ,  Akshay Mall ,  Mayank Bajpai ,  Jun Tong ,  Mukesh Shah ,  Mauruthi Geetha Mohan

IPC: H04L9/08

Abstract: An identity service in a cloud environment is communicatively coupled to a proxy key vault in the cloud environment and to an external key manager (EKM) located outside of the cloud environment. The identity service receives a token request for a communication credential from the proxy key vault and verifies the request based on a client credential associated with the proxy key vault. The identity service generates the client credential and signs the communication credential with a private key associated with the EKM. The identify service transmits the signed communication credential to the proxy key vault. The communication credential can be used to substantiate cryptographic operation requests to the EKM.