Patent SG-11201903338W-A (SG)
Title: Fault tolerant automatic secret rotation
Inventor: NESS ANDY
IPC: H04L9/08
Filed: 2017-10-23
Abstract: WO 18/08095 0 Al (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 03 May 2018 (03.05.2018) WIP0 I PCT onion °nolo omm mo im loollowom oimIE (10) International Publication Number WO 2018/080950 Al (51) International Patent Classification: H04L 29/06 (2006.01) HO4L 9/08 (2006.01) H04L 12/24 (2006.01) HO4L 29/08 (2006.01) (21) International Application Number: PCT/US2017/057785 (22) International Filing Date: 23 October 2017 (23.10.2017) (25) Filing Language: English (26) Publication Language: English (30) Priority Data: 62/414,542 28 October 2016 (28.10.2016) US 15/600,129 19 May 2017 (19.05.2017) US (71) Applicant: MICROSOFT TECHNOLOGY LI- CENSING, LLC [US/US]; One Microsoft Way, Redmond, Washington 98052-6399 (US). (72) Inventors: NESS, Andy; Microsoft Technology Licens- ing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). NG, Manson; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Wash- ington 98052-6399 (US). STEINBOK, Jeffrey E.; Mi- crosoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). MCDOWELL, Jeff; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). MOUL- HAUD, Patrick; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). (74) Agent: MINHAS, Sandip S. et al.; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washing- ton 98052-6399 (US). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, (54) Title: FAULT TOLERANT AUTOMATIC SECRET ROTATION (57) : The techniques discussed herein relate to providing fault tolerant automatic secret rotation for secrets maintained in a se- cret distribution infrastructure. In an implementation, an apparatus in- cludes one or more computer readable storage media and a secret rota- tion service including program instructions stored on the one or more computer readable storage media. The program instructions, when ex- 400 ecuted by one or more processing systems of a key master service (KMS) system, direct the one or more processing systems to rotate one YES or more secrets being served by the KMS system and provide other components of the secret distribution infrastructure with rotation in- formation identifying the one or more secrets. The instructions, when executed, further direct the one or more processing system to validate that the one or more secrets have been rotated at the other components of the secret distribution infrastructure and, once validated, publish the rotation information to a metadata storage service. FIGURE 4 [Continued on next page] MONITOR SECRET ROTATION SCI-EDULE 401 IDENTIFY SECRETS TO ROTATE 405 ROTATE SECRETS 407 I PROVIDE ROTATION INFORMATION TO OTHER COMPONENTS 1 VALIDATE ROTATED SECRETS 411 1. PUBLISH ROTATION INFORMATION TO METADATA STORAGE SERVICE 413 WO 2018/080950 Al MIDEDIMOMMIDIRENH 0 OIRMOIRIBINIMOVOIMIE EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: as to applicant's entitlement to apply for and be granted a patent (Rule 4.17(11)) as to the applicant's entitlement to claim the priority of the earlier application (Rule 4.1 7(iii)) Published: — with international search report (Art. 21(3))