Granted Patent B2

US 12,423,448 · App. 18/485,738 · Granted Sep 23, 2025

Inventors: Eric Devolder (Vedrin, BE); Eric G. Alger (Louisiana, MO); Eric Trent Robins (Wentzville, MO)

Assignee: Mastercard International Incorporated

G06F21/602

Abstract

Claims (77)

1. An application server having a custodian application running thereon, the application server comprising:

one or more processors; and

a memory device, the memory device storing computer-executable instructions that when executed by the one or more processors, cause the one or more processors to:

receive, from a continuous integration and continuous delivery (CI/CD) pipeline, a command to instantiate a cryptographic microservice application on the application server;

in response to the command, instantiate the cryptographic microservice application on the application server;

build, via the cryptographic microservice application, a secure enclave on the application server;

build, within the secure enclave via the cryptographic microservice application, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application;

transmit the cryptogram to an authentication computing system;

receive, from the authentication computing system, a digitally signed certificate;

receive, from the custodian application, a data encryption key encrypted with a master tenant key associated with the custodian application;

transmit, via the cryptographic microservice application, a request to the authentication computing system, the request including the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key; and

based on validation of the digitally signed certificate, receive the decrypted data encryption key from the authentication computing system.

2. The application server in accordance with claim 1 ,

the computer-executable instructions causing the one or more processors to generate a public/private key pair inside the secure enclave.

3. The application server in accordance with claim 2 ,

the computer-executable instructions causing the one or more processors to:

generate, via the cryptographic microservice application, a certificate signing request; and

sign the certificate signing request with a private key of the public/private key pair.

4. The application server in accordance with claim 3 , wherein transmitting the cryptogram to the authentication computing system comprises transmitting the certificate signing request to the authentication computing system.

5. The application server in accordance with claim 3 ,

wherein the public/private key pair comprises a private key and a corresponding public key,

wherein the private key is securely stored within the secure enclave,

wherein the public key is shared with the authentication computing system.

6. The application server in accordance with claim 5 ,

wherein the cryptographic microservice application having a unique identifier,

wherein the digitally signed certificate operates to bind the private key of the cryptographic microservice application to the unique identifier of the cryptographic microservice application.

7. The application server in accordance with claim 1 ,

the computer-executable instructions causing the one or more processors to negotiate a secure communication channel between the cryptographic microservice application and the authentication computing system,

wherein receiving the decrypted data encryption key from the authentication computing system comprises receiving the decrypted data encryption key over the secure communication channel.

8. A method performed by an application server having a custodian application running thereon, the method comprising:

receiving, from a continuous integration and continuous delivery (CI/CD) pipeline, a command to instantiate a cryptographic microservice application;

in response to the command, instantiating the cryptographic microservice application;

building, via the cryptographic microservice application, a secure enclave on the application server;

building, within the secure enclave via the cryptographic microservice application, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application;

transmitting the cryptogram to an authentication computing system;

receiving, from the authentication computing system, a digitally signed certificate;

receiving, from the custodian application, a data encryption key encrypted with a master tenant key associated with the custodian application;

transmitting, via the cryptographic microservice application, a request to the authentication computing system, the request including the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key; and

based on validation of the digitally signed certificate, receiving the decrypted data encryption key from the authentication computing system.

9. The method in accordance with claim 8 , further comprising generating, by the cryptographic microservice application, a public/private key pair inside the secure enclave.

10. The method in accordance with claim 9 , further comprising:

generating, via the cryptographic microservice application, a certificate signing request; and

signing the certificate signing request with a private key of the public/private key pair.

11. The method in accordance with claim 10 , wherein transmitting the cryptogram to the authentication computing system comprises transmitting the certificate signing request to the authentication computing system.

12. The method in accordance with claim 10 ,

wherein the public/private key pair comprises a private key and a corresponding public key,

wherein the private key is securely stored within the secure enclave,

wherein the public key is shared with the authentication computing system.

13. The method in accordance with claim 12 ,

wherein the cryptographic microservice application having a unique identifier,

wherein the digitally signed certificate operates to bind the private key of the cryptographic microservice application to the unique identifier of the cryptographic microservice application.

14. The method in accordance with claim 8 , further comprising negotiating a secure communication channel between the cryptographic microservice application and the authentication computing system,

wherein receiving the decrypted data encryption key from the authentication computing system comprises receiving the decrypted data encryption key over the secure communication channel.

15. A non-transitory computer-readable storage medium having computer-executable instructions stored thereon, the computer-executable instructions, when executed by one or more processors, causing the one or more processors to:

receive, from a continuous integration and continuous delivery (CI/CD) pipeline, a command to instantiate a cryptographic microservice application;

in response to the command, instantiate the cryptographic microservice application;

build, via the cryptographic microservice application, a secure enclave;

build, within the secure enclave via the cryptographic microservice application, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application;

transmit the cryptogram to an authentication computing system;

receive, from the authentication computing system, a digitally signed certificate;

receive, from a custodian application, a data encryption key encrypted with a master tenant key associated with the custodian application;

transmit, via the cryptographic microservice application, a request to the authentication computing system, the request including the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key; and

based on validation of the digitally signed certificate, receive the decrypted data encryption key from the authentication computing system.

16. The non-transitory computer-readable storage medium in accordance with claim 15 ,

the computer-executable instructions causing the one or more processors to generate a public/private key pair inside the secure enclave.

17. The non-transitory computer-readable storage medium in accordance with claim 16 ,

the computer-executable instructions causing the one or more processors to:

generate, via the cryptographic microservice application, a certificate signing request; and

sign the certificate signing request with a private key of the public/private key pair.

18. The non-transitory computer-readable storage medium in accordance with claim 17 , wherein transmitting the cryptogram to the authentication computing system comprises transmitting the certificate signing request to the authentication computing system.

19. The non-transitory computer-readable storage medium in accordance with claim 17 ,

wherein the public/private key pair comprises a private key and a corresponding public key,

wherein the private key is securely stored within the secure enclave,

wherein the public key is shared with the authentication computing system.

20. The non-transitory computer-readable storage medium in accordance with claim 15 ,

the computer-executable instructions causing the one or more processors to negotiate a secure communication channel between the cryptographic microservice application and the authentication computing system,

wherein receiving the decrypted data encryption key from the authentication computing system comprises receiving the decrypted data encryption key over the secure communication channel.

Assignments (1)

Continuity (1)

References Cited (15)