Secure asset management infrastructure for enforcing access control policies
An application executing at a first platform receives, from a tester device, a first request to generate a secure data asset. Responsive to authenticating the client, the application sends, to a second platform, a second request to determine whether the client has access to the secure data asset. Responsive to receiving an indication, from the second platform, that the client has access to the secure data asset, the application performs one or more operations to generate the secure data asset. The application sends, to the tester device, the generated secure data asset.
1 . A method comprising:
receiving, by an application executing at a first platform, from a tester device in communication with the first platform and configured to program a secure data asset associated with testing a semiconductor device, a first request to generate the secure data asset for a client;
responsive to authenticating the client, sending, to a second platform, a second request to determine whether the client has access to the secure data asset;
responsive to receiving an indication, from the second platform, that the client has access to the secure data asset, performing one or more operations to generate the secure data asset; and
sending, to the tester device, the secure data asset for testing the semiconductor device.
2 . The method of claim 1 , wherein the second request comprises an access control policy.
3 . The method of claim 2 , wherein the access control policy comprises a set of records each including a particular use case for generating a particular secure data asset and an access state for the particular use case.
4 . The method of claim 2 , wherein the access control policy is encrypted.
5 . The method of claim 1 , wherein the first request comprises secure client identification data.
6 . The method of claim 1 , wherein the second platform comprises a hardware security module (HSM).
7 . The method of claim 1 , wherein the secure data asset comprises one or more of encrypted data, authenticated data, or a certificate.
8 . The method of claim 1 , further comprising:
responsive to receiving an indication that the client does not have access the secure data asset, denying the tester device access to the secure data asset.
9 . The method of claim 1 , further comprising:
responsive to failing to authenticate the client, denying the tester device access to the secure data asset.
10 . A method comprising:
receiving, by a first platform and from an application executing on a second platform, a request to determine whether a client has access to a secure data asset, wherein the request comprises an access control policy;
determining whether the client has access to the secure data asset based on the access control policy; and
responsive to determining that the client has access to the secure data asset, sending, to the second platform, an indication that a tester device is allowed to access the secure data asset, wherein the tester device is configured to program a secure data asset associated with testing a semiconductor device.
11 . The method of claim 10 , further comprising;
receiving, from the application, another request to generate the secure data asset;
generating the secure data asset; and
sending, to the second platform, the secure data asset.
12 . The method of claim 10 , further comprising:
decrypting the access control policy.
13 . The method of claim 10 , wherein the first platform comprises a hardware security module (HSM).
14 . The method of claim 10 , wherein the access control policy comprises a set of records each including a particular use case for generating a particular secure data asset and an access state for the particular use case.
15 . The method of claim 10 , wherein the secure data asset comprises one or more of encrypted data, authenticated data, or a certificate.
16 . The method of claim 10 , further comprising:
responsive to determining that the client does not have access to the secure data asset, sending, to the second platform, an indication that the tester device is not allowed to access the secure data asset.
17 . A cryptographic management system, comprising:
a memory device; and
a processing device, couple to the memory device, to:
receive, using an application executing at a first platform, from a tester device in communication with the first platform and configured to program a secure data asset associated with testing a semiconductor device, a first request to generate the secure data asset for a client;
responsive to authenticating the client, send, to a second platform, a second request to determine whether the client has access to the secure data asset;
responsive to receiving an indication, from the second platform, that the client has access to the secure data asset, perform one or more operations to generate the secure data asset; and
send, to the tester device, the secure data asset for testing the semiconductor device.
18 . The cryptographic management system of claim 17 , wherein:
the second request comprises an access control policy; and
wherein the access control policy comprises a set of records each including a particular use case for generating a particular secure data asset and an access state for the particular use case.
19 . The cryptographic management system of claim 17 , wherein the first request comprises secure client identification data.
20 . The cryptographic management system of claim 17 , wherein the processing device is further to:
responsive to receiving an indication that the client does not have access the secure data asset, deny the tester device access to the secure data asset.