System and method for multi-tenant session management of cryptographic devices

1 . A System for root of trust and dynamic session management of cryptographic devices servicing cryptographic requests from multi-tenant applications in a cryptographic computing environment, comprising:

one or more processors and memory operatively coupled to the one or more processors, wherein the memory includes computer instructions which when executed by the one or more processors causes the one or more processors to perform the operations of:

a Connection Manager to provide low-latency cryptographic operations on one or more Cryptographic Devices that are local or remote to the System; by

creating a block of multiple PKCS11 sessions for a client application logged into a PKCS11 session to use for crypto operations for a tenant that has established a root-of-trust in a tenant partition of the one or more Cryptographic Devices;

assigning these session blocks to the tenant partitions of said one or more Cryptographic Devices to service incoming requests from one or more of the client applications performing said crypto operations, thereby lowering a latency for handling the incoming requests compared to using a single session since multiple PKCS11 sessions in the block are available and ready to use for the tenant;

allocating incoming requests to PKCS11 sessions from pool of these session blocks for different clients for handling these crypto operations in real-time thereby providing low-latency and high-throughput for also handling crypto operations with a different client;

a Cache Store associated with said Connection Manager to support multi-tenancy on the one or more Cryptographic Devices by

tracking of individual tenant's partition mapping to their respective session blocks in the pool;

managing lifecycle of said individual tenant's connection along with its sessions to said one or more Cryptographic Devices;

a Session Scheduler to provide cryptographic services with a high throughput compared to that of a single session on said one or more Cryptographic Devices by

selecting session block from said Cache Store that is mapped to the tenant partition and available for use to ensure tenant isolation;

assigning an available PKCS11 session from said session block to service the crypto operations allocated to individual tenants of the Cryptographic Device(s);

and

a Session Health Monitor to provide resiliency by

evaluating health metrics of the Session Scheduler and a set of PKCS11 sessions in the pool of session blocks allocated to individual tenant's partition mapping;

reporting an assessment of overall session block health as a measurement for throughput of crypto operations across the session blocks; and

remediating and self-repairing session blocks in the event of session errors in the pool of session blocks.

2 . The system of claim 1 , wherein the Connection Manager in association with Session Health Monitor:

tracks a state of the PKCS11 sessions and revises session assignments of client applications depending on whether a PKCS11 session with the cryptographic device is in one or more error states; and

detects, classifies and remedies of the one or more error states occurring within the pool of session blocks in view of the health metrics,

thereby minimizing latency and maximizing availability of the cryptographic device services by way of the revised session assignments in view of the overall session block health.

3 . The system of claim 1 , wherein the Session Scheduler returns a PKCS11 session to an ‘available’ state in the session block once that PKCS11 session is done servicing crypto operation, and making that session re-useable for further crypto operations requests without closing it.

4 . The system of claim 3 , wherein the Session Scheduler in association with Session Health Monitor maintains individual PKCS11 sessions in an open state after tenant use for as long as possible to maintain the pool and so as to be available for use by an established client application.

5 . The system of claim 4 , wherein the Session Scheduler with Session Health Monitor tracks a range of errors during PKCS11 session usage and allocation, and repairs and remediates as necessary to ensure a healthy pool of PKCS11 sessions.

6 . The system of claim 1 , wherein the Connection Manager creates a PKCS11 session on demand, and at a certain point in time is assigned to a particular tenant on the cryptographic device for exclusive and permanent use with that tenant.

7 . The system of claim 1 , wherein the incoming requests comprise a payload such as an operand along with a connection specification, and a requested cryptographic operation such as an encrypt, decrypt, or signing.

8 . The system of claim 1 , wherein a Cryptographic Device is one or more of a Hardware Security Module (HSM), USB based cryptographic token and smart card.

9 . The system of claim 1 , wherein when the Connection Manager asks the Session Scheduler to allocate a PKCS11 session for a tenant, and execute the crypto operation on the Cryptographic Device, but, if the PKCS11 session is not available for the tenant, it will create a session block with open PKCS11 sessions exclusively for that tenant to use, and then used PKCS11 sessions will be returned to the pool for that session block for that tenant for later use, without closing or terminating the PKCS11 session.

10 . The system of claim 9 , wherein the Session Scheduler with the Cache Store and Session Health Monitor efficiently manages multiple PKCS11 sessions on behalf of multiple tenants or applications to service a volume of crypto requests at one or more partitions of said one or more Cryptographic Devices.

11 . The system of claim 10 , wherein the Connection Manager with the Cryptographic device's client dynamically establishes and maintains the life cycle of a secure communication channel with the Cryptographic Device for one or more tenants by way of adding a dedicated connection and removal, over Transport Layer Security (TLS), and then provides for PKCS11 Application Programming Interface (API) call support over said secure communication channel to service crypto requests for one or more tenants.

12 . The system of claim 11 , wherein the Session Scheduler runs in a loop whereby it

waits until an incoming request is present in the queue, then extracts it from the queue;

examines the amount of time the request was in the queue, wherein if the request was in the queue for a predetermined time, it is discarded, and thereafter;

finds a ‘free’ PKCS11 session in the session block, wherein if one is found, the request is assigned to the PKCS11 session and invokes the callback mechanism with details of the PKCS11 session, and thereafter; and

updates the health status of the block, examining the age of errors and resetting the one or more error states of the block when applicable.

13 . The system of claim 1 , wherein the Session Scheduler

processes and handles session allocation requests from a session allocation request queue, wherein said requests are dequeued sequentially by waiting for a session allocation request for a PKCS11 session, and then receiving the request,

upon dequeuing, performs a check operation to determine a length of time the request was in said queue, and

discards or drops said request if said request was in the queue for a time matching or exceeding said length of time.

14 . The system of claim 13 , wherein the Session Scheduler

before attempting to wait for and dequeue a further request, examines a session state of the session block, and, upon determining if the session state is ACTIVE,

waits for said further request, and if not, exits, otherwise, on dequeuing said further request and passing a queue time-residency check,

examines the pool of sessions to determine whether a compatible PKCS11 session is available, and, if no such compatible PKCS11 session is available within an allotted timeframe, an error is returned, and

if such a PKCS11 compatible session is available, assigns that session to said further request and sets a variable for the session indicating that it is in a USE session state.