Method for obtaining vetted certificates by microservices in elastic cloud environments

Patent metadata

Field	Value
Publication number	US-10404680-B2
Application number	US-201615234180-A
Country	US
Kind code	B2
Filing date	Aug 11, 2016
Priority date	Aug 11, 2016
Publication date	Sep 3, 2019
Grant date	Sep 3, 2019

Abstract

A method and is provided for obtaining a vetted certificate for a microservice in an elastic cloud environment. The microservice receives a one-time authentication credential. The microservice utilizes the one-time authentication credential to obtain a client secret. The microservice obtains an access token and CSR (Certificate Signing Request) attributes using the client secret and constructs a CSR utilizing the CSR attributes. The microservice requests a vetted certificate from a Certificate Authority (CA) and includes the access token and the CSR in the request. If the access token and the CSR pass vetting at the CA, the CA sends a vetted certificate to the microservice.

First claim

We claim:

1. A method for obtaining a vetted certificate for a microservice in an elastic cloud environment, the method comprising:
receiving a one-time authentication credential at the microservice;
utilizing the one-time authentication credential to obtain a client secret;
obtaining an access token and CSR (Certificate Signing Request) attributes at the microservice using the client secret;
constructing a CSR at the microservice utilizing the CSR attributes;
requesting a vetted certificate from a Certificate Authority (CA), the request including the access token and the CSR; and
receiving a vetted certificate from the CA at the microservice.

2. The method of claim 1 , wherein the one-time authentication credential comprises a type of microservice.

3. The method of claim 1 , wherein the one-time authentication credential comprises a first piece of data and a second piece of data, wherein the first piece of data comprises a service type and the second piece of data comprises a service instance.

4. The method of claim 1 , wherein the client secret associates a type of service with a secret management service.

5. The method of claim 1 , wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token matches a stored access token at the CA.

6. The method of claim 1 , wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token maps to a stored access token at the CA.

7. The method of claim 1 , wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token is equivalent to a stored access token at the CA.

8. The method of claim 1 , wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token is associated with a stored access token at the CA.

9. The method of claim 1 , wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the CSR matches a stored CSR at the CA.

10. A microservice comprising:
a transceiver; and
a processor configured to:
receive a one-time authentication credential via the transceiver;
utilize the one-time authentication credential to obtain a client secret via the transceiver;
obtain an access token and CSR (Certificate Signing Request) attributes using the client secret via the transceiver;
construct a CSR utilizing the CSR attributes;
request a vetted certificate from a Certificate Authority (CA) via the transceiver, the request including the access token and the CSR; and
receive a vetted certificate from the CA via the transceiver if the access token and the CSR pass vetting.

11. The microservice of claim 10 , wherein the onetime authentication credential comprises a type of microservice.

12. The microservice of claim 10 , wherein the one-time authentication credential comprises a first piece of data and a second piece of data, wherein the first piece of data comprises a service type and the second piece of data comprises a service instance.

13. The microservice of claim 10 , wherein the client secret associates a type of service with a secret management service.

14. The microservice of claim 10 , wherein the processor is configured to receive a vetted certificate from the CA via the transceiver if the access token matches a stored access token at the CA.

15. The microservice of claim 10 , wherein the processor is configured to receive a vetted certificate from the CA via the transceiver if the CSR matches a stored CSR at the CA.

Assignees

• Motorola Solutions Inc

Inventors

• Lewis Adam C
• Metke Anthony R
• Thomas Shanthi E

Classifications

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F9/5077

  Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455) · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title