Object signing within a cloud-based architecture

Patent metadata

Field	Value
Publication number	US-2018183607-A1
Application number	US-201815897074-A
Country	US
Kind code	A1
Filing date	Feb 14, 2018
Priority date	Aug 16, 2012
Publication date	Jun 28, 2018
Grant date	—

Abstract

A system and method for digitally signing an object. An object signing agent sends a signing request for an object to a remote signing server, which, in response to receiving the request, generates a virtual machine executing code for signing the object. The object is signed within the virtual machine and returned to the object signing agent.

First claim

What is claimed is:

1 . A computer-implemented method for cloud-based object signing, the method comprising:
receiving, using a computing device, an object and a request to sign the object from an agent; creating, with the computing device, a dynamic virtual machine having a signing space and placing the object in the signing space in response to the request; obtaining, with the dynamic virtual machine, a signing key; digitally signing, with the dynamic virtual machine, the object contained in the signing space with the signing key; and after digitally signing the object, cleaning up and removing the dynamic virtual machine.

2 . The method of claim 1 , wherein the object comprises code.

3 . The method of claim 1 , wherein the object comprises a document.

4 . The method of claim 1 , wherein the object comprises an electronic data file.

5 . The method of claim 1 further comprising sending the signed object to the agent.

6 . The method of claim 1 further comprising taking a snapshot of the dynamic virtual machine prior to removing the dynamic virtual machine.

7 . The method of claim 6 further comprising:
obtaining the snapshot of the dynamic virtual machine; and
with the snapshot, restoring the dynamic virtual machine.

8 . The method of claim 7 further comprising performing an audit of the restored dynamic virtual machine.

9 . The method of claim 1 further comprising collecting and storing event data generated while digitally signing the object.

10 . The method of claim 1 further comprising collecting and storing event data generated between creation and removal of the dynamic virtual machine.

11 . The method of claim 10 , wherein the event data comprises event data selected from the group consisting of: timestamps, identification details, object checksums, and object samples.

12 . The method of claim 11 further comprising performing an audit of the dynamic virtual machine or the digitally signed object using the collected and stored event data.

13 . The method of claim 1 further comprising validating the request to sign the object before creating the dynamic virtual machine.

14 . The method of claim 1 further comprising:
validating the request to sign the object by vetting at least one of an identity and credentials of a user associated with the request to sign the object.

15 . The method of claim 1 further comprising:
validating the request to sign the object by verifying that a required number of actors are present for the signing.

16 . The method of claim 1 further comprising:
validating the request to sign the object by verifying the legitimacy of any credentials received in connection with the request to sign the object.

17 . The method of claim 1 further comprising determining whether the object complies with a set of predetermined properties.

18 . The method of claim 1 further comprising determining whether the object is properly formatted and free of malware.

19 . The method of claim 1 , wherein the signing space is encrypted.

20 . The method of claim 1 , wherein the signing key is transferred to a separate location before cleaning up and removing the dynamic virtual machine.

21 . The method claim 1 further comprising:
performing one or more compliance checks on the object to verify the integrity and sign-ability of the object, wherein the one or more compliance checks comprise one or more of:
running one or more security scans against the object;
running one or more vulnerability scans against the object;
running one or more Payment Card Industry/Sarbanes-Oxley (PCI/SOX) scans against the object;
verifying that the object is in a correct format; and
verifying that the object is free of malware.

22 . At least one non-transitory computer readable medium for cloud-based object signing, the at least one non-transitory computer readable medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of at least one computing device, cause the at least one computing device to perform the steps of:
receiving, from an agent, an object and a request to sign the object; creating, with computing equipment, a dynamic virtual machine having a signing space and placing the object in the signing space in response to the request, wherein creating the dynamic virtual machine comprises configuring the dynamic virtual machine to:
obtain a signing key; and
digitally sign the object contained in the signing space with the signing key; and
after the virtual machine digitally signs the object, cleaning up and removing the dynamic virtual machine.

Assignees

• Digicert Inc

Inventors

• Sabin Jason Allen

Classifications

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title