US 11,755,762 B2
Attribute-based encryption for microservices
Maik Guenter Seewald, Nuremberg (DE); Robert Edgar Barton, Richmond (CA); and Jerome Henry, Pittsboro, NC (US)
Assigned to Cisco Technology, Inc., San Jose, CA (US)
Filed by Cisco Technology, Inc., San Jose, CA (US)
Filed on Apr. 21, 2021, as Appl. No. 17/236,936.
Application 17/236,936 is a continuation of application No. 16/105,898, filed on Aug. 20, 2018.
Prior Publication US 2021/0264047 A1, Aug. 26, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/62 (2013.01); H04L 9/08 (2006.01); G06F 9/445 (2018.01); H04L 9/40 (2022.01)
CPC G06F 21/6218 (2013.01) [G06F 9/445 (2013.01); G06F 21/62 (2013.01); H04L 9/0861 (2013.01); H04L 63/08 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
instantiating a first application service associated with a first attribute label and a second application service associated with a second attribute label in a cloud environment;
generating a first key based on the first attribute label and a second key based on the second attribute label;
associating a first data store with the first application service by encrypting the first data store with the first key, wherein the first application service is configured to access first data stored in the first data store through the first key based on the first attribute label;
associating a second data store with the second application service by encrypting the second data store with the second key, wherein the second application service is configured to access second data stored in the second data store through the second key based on the second attribute label;
receiving from a client an application service request that calls for execution of the first and second application services, said application service request including access credentials for the first data store but lacking access credentials for the second data store; and
filling, based on the first attribute label, the application service request for the first application service from the client by providing the first application service access to the first data store through the first key and the second data store through the second key while refraining from providing the client access to the second data store.