Object signing within a cloud-based architecture
A system and method for digitally signing an object. An object signing agent sends a signing request for an object to a remote signing server, which, in response to receiving the request, generates a virtual machine executing code for signing the object. The object is signed within the virtual machine and returned to the object signing agent.
1. A computer-implemented method for cloud-based object signing, the method comprising:
receiving, at a computing device, an object and a request to sign the object from an agent;
in response to the request to sign the object, dynamically creating, with the computing device, a virtual machine having a signing space;
placing the object in the signing space, using the computing device, in response to the request to sign the object;
obtaining, with the virtual machine, a signing key;
digitally signing, using the virtual machine, the object contained in the signing space with the signing key; and
after digitally signing the object:
destroying the signing key,
cleaning up and removing the virtual machine, and
transmitting the digitally signed object to the agent.
2. The method of claim 1 , wherein the object comprises code.
3. The method of claim 1 , wherein the object comprises a document.
4. The method of claim 1 , wherein the object comprises an electronic data file.
5. The method of claim 1 further comprising taking a snapshot of the virtual machine prior to removing the virtual machine.
6. The method of claim 5 further comprising:
obtaining the snapshot of the virtual machine; and
with the snapshot, restoring the virtual machine.
7. The method of claim 6 further comprising performing an audit of the restored virtual machine.
8. The method of claim 1 further comprising collecting and storing event data generated while digitally signing the object.
9. The method of claim 1 further comprising collecting and storing event data generated between creation and removal of the virtual machine.
10. The method of claim 9 , wherein the event data comprises event data selected from a group consisting of: timestamps, identification details, object checksums, and object samples.
11. The method of claim 10 further comprising performing an audit of the virtual machine or the digitally signed object using the collected and stored event data.
12. The method of claim 1 further comprising validating the request to sign the object before dynamically creating the virtual machine.
13. The method of claim 1 further comprising:
validating the request to sign the object by vetting at least one of an identity and credentials of a user associated with the request to sign the object.
14. The method of claim 1 further comprising:
validating the request to sign the object by verifying that a required number of actors are present for the signing.
15. The method of claim 1 further comprising:
validating the request to sign the object by verifying legitimacy of any credentials received in connection with the request to sign the object.
16. The method of claim 1 further comprising determining whether the object complies with a set of predetermined properties.
17. The method of claim 1 further comprising determining whether the object is properly formatted and free of malware.
18. The method of claim 1 , wherein the signing space is encrypted.
19. The method of claim 1 , wherein the signing key is transferred to a separate location before cleaning up and removing the virtual machine.
20. The method of claim 1 , further comprising:
performing one or more compliance checks on the object to verify integrity and sign-ability of the object, wherein the one or more compliance checks comprise one or more of:
running one or more security scans against the object;
running one or more vulnerability scans against the object;
running one or more Payment Card Industry/Sarbanes-Oxley (PO/SOX) scans against the object;
verifying that the object is in a correct format; and
verifying that the object is free of malware.
21. At least one non-transitory computer readable medium for cloud-based object signing, the at least one non-transitory computer readable medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of at least one computing device, cause the at least one computing device to perform steps of:
receiving, from an agent, an object and a request to sign the object;
in response to the request to sign the object, dynamically creating, with computing equipment, a virtual machine having a signing space and placing the object in the signing space in response to the request to sign the object, wherein dynamically creating the virtual machine comprises configuring the virtual machine to:
obtain a signing key, and
digitally sign the object contained in the signing space with the signing key; and
after the virtual machine digitally signs the object:
destroying the signing key,
cleaning up and removing the virtual machine, and
transmitting the digitally signed object to the agent.