Multi-tenant cryptography implementation compliance
Methods, systems, apparatuses, devices, and computer program products are described. A virtual machine may receive, from an application associated with a tenant, a request to perform a cryptographic operation for the application at the virtual machine. Based on receiving the request, the virtual machine may determine that the tenant is limited to using a designated set of cryptographic operations in accordance with a cryptographic operation validation policy associated with the tenant. In some examples, the virtual machine may identify a designated version of the cryptographic operation, from the designated set of cryptographic operations, that corresponds to the cryptographic operation indicated by the request in satisfaction of the cryptographic operation validation policy. The virtual machine may execute the designated version of the cryptographic operation and return a result of the execution to the application.
1. A method for data processing, comprising:
receiving, from an application associated with a tenant and at a virtual machine, a request to perform a version of a cryptographic operation for the application at the virtual machine;
determining, based at least in part on receiving the request, that the tenant is limited to using a designated set of cryptographic operations in accordance with a cryptographic operation validation policy associated with the tenant, and wherein the designated set of cryptographic operations are validated in accordance with the cryptographic operation validation policy;
identifying a designated version of the cryptographic operation, from the designated set of cryptographic operations, that corresponds to the cryptographic operation indicated by the request and is different than the version of the cryptographic operation indicated by the request, the designated version of the cryptographic operation in satisfaction of the cryptographic operation validation policy associated with the tenant;
executing the designated version of the cryptographic operation at the virtual machine; and
returning, to the application, a result of executing the designated version of the cryptographic operation.
2. The method of claim 1 , further comprising:
querying a thread local variable based at least in part on receiving the request, wherein the thread local variable comprises a reference to a cryptographic provider; and
determining, based at least in part on querying the thread local variable, that the tenant is limited to using the designated set of cryptographic operations associated with the cryptographic provider in accordance with the cryptographic operation validation policy associated with the tenant.
3. The method of claim 2 , further comprising:
releasing a thread associated with the execution of the designated version of the cryptographic operation in response to returning the result, wherein releasing of the thread includes releasing the thread local variable.
4. The method of claim 1 , further comprising:
receiving, from the application, a second request to perform a second cryptographic operation;
determining, based at least in part on receiving the second request, that the tenant is limited to using the designated set of cryptographic operations;
determining that the second cryptographic operation is an invalid request according to the cryptographic operation validation policy; and
returning an error indicating that the requested second cryptographic operation fails to satisfy the cryptographic operation validation policy associated with the tenant.
5. The method of claim 1 , further comprising:
replacing the designated set of cryptographic operations with an updated designated set of cryptographic operations, an alternate designated set of cryptographic operations from a vendor, or any combination thereof.
6. The method of claim 5 , wherein the designated set of cryptographic operations is replaced at the virtual machine without modifying one or more code sets associated with the application.
7. The method of claim 1 , further comprising:
receiving, from a second application associated with a second tenant, a second request to perform a second cryptographic operation;
determining, based at least in part on receiving the second request, that the second tenant is not subject to the cryptographic operation validation policy; and
executing the second cryptographic operation at the virtual machine based at least in part on determining that the second tenant is not subject to the cryptographic operation validation policy.
8. The method of claim 1 , wherein the virtual machine operates according to a virtual machine configuration specifying that the virtual machine is configured to execute only cryptographic operations that are validated in accordance with the cryptographic operation validation policy, wherein the tenant is limited to using the designated set of cryptographic operations based at least in part on the virtual machine configuration.
9. The method of claim 1 , wherein the virtual machine is a Java virtual machine.
10. The method of claim 1 , wherein the cryptographic operation validation policy comprises a Federal Information Processing Standard Publication 140.
11. The method of claim 1 , wherein the version of the cryptographic operation comprises a first hashing function, a first algorithm, or both that is at least partially different from a second hashing function, a second algorithm, or both of the designated version of the cryptographic operation.
12. An apparatus for data processing, comprising:
a processor;
memory coupled with the processor; and
instructions stored in the memory and executable by the processor to cause the apparatus to:
receive, from an application associated with a tenant and at a virtual machine, a request to perform a version of a cryptographic operation for the application at the virtual machine;
determine, based at least in part on receiving the request, that the tenant is limited to using a designated set of cryptographic operations in accordance with a cryptographic operation validation policy associated with the tenant, and wherein the designated set of cryptographic operations are validated in accordance with the cryptographic operation validation policy;
identify a designated version of the cryptographic operation, from the designated set of cryptographic operations, that corresponds to the cryptographic operation indicated by the request and is different than the version of the cryptographic operation indicated by the request, the designated version of the cryptographic operation in satisfaction of the cryptographic operation validation policy associated with the tenant;
execute the designated version of the cryptographic operation at the virtual machine; and
return, to the application, a result of executing the designated version of the cryptographic operation.
13. The apparatus of claim 12 , wherein the instructions are further executable by the processor to cause the apparatus to:
query a thread local variable based at least in part on receiving the request, wherein the thread local variable comprises a reference to a cryptographic provider; and
determine, based at least in part on querying the thread local variable, that the tenant is limited to using the designated set of cryptographic operations associated with the cryptographic provider in accordance with the cryptographic operation validation policy associated with the tenant.
14. The apparatus of claim 13 , wherein the instructions are further executable by the processor to cause the apparatus to:
release a thread associated with the execution of the designated version of the cryptographic operation in response to returning the result, wherein releasing of the thread includes releasing the thread local variable.
15. The apparatus of claim 12 , wherein the instructions are further executable by the processor to cause the apparatus to:
receive, from the application, a second request to perform a second cryptographic operation;
determine, based at least in part on receiving the second request, that the tenant is limited to using the designated set of cryptographic operations;
determine that the second cryptographic operation is an invalid request according to the cryptographic operation validation policy; and
return an error indicating that the requested second cryptographic operation fails to satisfy the cryptographic operation validation policy associated with the tenant.
16. The apparatus of claim 12 , wherein the instructions are further executable by the processor to cause the apparatus to:
replace the designated set of cryptographic operations with an updated designated set of cryptographic operations, an alternate designated set of cryptographic operations from a vendor, or any combination thereof.
17. The apparatus of claim 16 , wherein the designated set of cryptographic operations is replaced at the virtual machine without modifying one or more code sets associated with the application.
18. The apparatus of claim 12 , wherein the instructions are further executable by the processor to cause the apparatus to:
receive, from a second application associated with a second tenant, a second request to perform a second cryptographic operation;
determine, based at least in part on receiving the second request, that the second tenant is not subject to the cryptographic operation validation policy; and
execute the second cryptographic operation at the virtual machine based at least in part on determining that the second tenant is not subject to the cryptographic operation validation policy.
19. The apparatus of claim 12 , wherein the virtual machine operates according to a virtual machine configuration specifying that the virtual machine is configured to execute only cryptographic operations that are validated in accordance with the cryptographic operation validation policy, wherein the tenant is limited to using the designated set of cryptographic operations based at least in part on the virtual machine configuration.
20. A non-transitory computer-readable medium storing code for data processing, the code comprising instructions executable by a processor to:
receive, from an application associated with a tenant and at a virtual machine, a request to perform a version of a cryptographic operation for the application at the virtual machine;
determine, based at least in part on receiving the request, that the tenant is limited to using a designated set of cryptographic operations in accordance with a cryptographic operation validation policy associated with the tenant, and wherein the designated set of cryptographic operations are validated in accordance with the cryptographic operation validation policy;
identify a designated version of the cryptographic operation, from the designated set of cryptographic operations, that corresponds to the cryptographic operation indicated by the request and is different than the version of the cryptographic operation indicated by the request, the designated version of the cryptographic operation in satisfaction of the cryptographic operation validation policy associated with the tenant;
execute the designated version of the cryptographic operation at the virtual machine; and
return, to the application, a result of executing the designated version of the cryptographic operation.