US 12,238,210 B2
Keystore service for encryption in a secure service enclave
Kranthi Kumar Bathula, Sammamish, WA (US); Nachiketh Rao Potlapally, McLean, VA (US); Rakesh Basanta Parida, Sammamish, WA (US); and Ricky Alan Mangus, Bellevue, WA (US)
Assigned to Oracle International Corporation, Redwood Shores, CA (US)
Filed by Oracle International Corporation, Redwood Shores, CA (US)
Filed on Mar. 4, 2022, as Appl. No. 17/686,757.
Prior Publication US 2023/0283465 A1, Sep. 7, 2023
Int. Cl. H04L 9/00 (2022.01); H04L 9/08 (2006.01); H04L 9/40 (2022.01)
CPC H04L 9/0894 (2013.01) [H04L 9/0822 (2013.01); H04L 63/126 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method, the method comprising:
receiving, by a computing device of a cloud computing system, a key identification, an encrypted key-encryption key, an identity of a client device, and a request from the client device to store the key identification and the encrypted key-encryption key, wherein the encrypted key-encryption key is generated by encrypting a key-encryption key;
verifying, by a control plane of the computing device, the request based at least in part on:
validating the identity of the client device, and
validating whether the client device is authorized to store the key identification and encrypted key-encryption key;
transmitting, by the control plane of the computing device and based at least in part on verifying the request, the key identification, the encrypted key-encryption key, and the request to store the key identification and the encrypted key-encryption key to a keystore,
wherein a logical sequence number is generated based on the request to store the key identification and the encrypted key-encryption key;
polling, by a data plane of the computing device, the keystore for the logical sequence number and the encrypted key-encryption key;
reading, by the data plane of the computing device and in response to detecting the logical sequence number, the key identification and the encrypted key-encryption key from the keystore;
storing, by the data plane of the computing device, the logical sequence number, the key identification, and the encrypted key-encryption key in a storage of the computing device; and
transmitting, by the data plane of the computing device, the stored logical sequence number to the keystore.