Dynamically generating and injecting trusted root certificates

Patent metadata

Field	Value
Publication number	US-10762193-B2
Application number	US-201815974708-A
Country	US
Kind code	B2
Filing date	May 9, 2018
Priority date	May 9, 2018
Publication date	Sep 1, 2020
Grant date	Sep 1, 2020

Abstract

In an example computer-implemented method, a trusted root certificate for an application running in a container is dynamically generated. The generated trusted root certificate is injected at runtime. The generated certificate is dynamically added to a list of trusted root certificates. A proxy associated with the application instance is authenticated based on the generated root trust certificate.

First claim

What is claimed is:

1. A system, comprising:
a hardware processor to:
dynamically generate a trusted root certificate for an application instance running in a container in response to detecting a new workload;
intercept a request for a trusted certificate from the application instance;
inject, via the hardware processor, the generated trusted root certificate at runtime in response to detecting the request for the trusted certificate from the application instance;
provide the generated certificate to the application instance, wherein the application instance is to authenticate a proxy associated with the application instance based on the dynamically generated root trust certificate; and
dynamically add the generated certificate to an index file of trusted root certificates in response to detecting a request for the index file.

2. The system of claim 1 , comprising an overlay file system, wherein the processor is to intercept a file system call and inject the generated trusted root certificate into a directory comprising trusted certificates by combining files comprising the generated trusted root certificate into the directory using the overlay file system.

3. The system of claim 1 , comprising an admission controller to map the generated trusted root certificate into a directory of a file system associated with the container comprising root certificates.

4. The system of claim 1 , comprising a graph driver to expose a file system comprising the generated trusted root certificate to the container.

5. The system of claim 1 , comprising a file system driver to provide a callback for each file system operation of the container, wherein the processor is to dynamically provide a name of the generated trusted root certificate and requested bytes of the generated trusted root certificate, and provide a modified index file comprising additional appended bytes in response to detecting a request for an index file.

6. The system of claim 1 , comprising a kernel injector to intercept a system call comprising a first request for a root certificate, a second request to inject the generated trusted root certificate, and a third request to dynamically add the generated certificate to the list of trusted root certificates.

7. The system of claim 1 , wherein the generated trusted root certificate is used to authenticate a sidecar proxy with an application instance.

8. A computer-implemented method, comprising:
dynamically generating a trusted root certificate for an application instance running in a container in response to detecting a new workload;
intercepting a request for a trusted certificate from the application instance;
injecting, via a hardware processor, the generated trusted root certificate at runtime in response to detecting the request for the trusted certificate from the application instance;
providing the generated certificate to the application instance, wherein the application instance is to authenticate a proxy associated with the application instance based on the dynamically generated root trust certificate; and
dynamically adding the generated trusted root certificate to an index file of trusted certificates in response to detecting a request for the index file.

9. The computer-implemented method of claim 8 , wherein injecting the generated trusted root certificate comprises intercepting a file system call and injecting the generated trusted root certificate into a directory comprising trusted certificates.

10. The computer-implemented method of claim 8 , wherein injecting the generated trusted root certificate comprises mapping the generated trusted root certificate into a directory of a file system associated with the container containing trusted certificates.

11. The computer-implemented method of claim 8 , wherein injecting the generated trusted root certificate comprises exposing a file system comprising the generated trusted root certificate to the container.

12. The computer-implemented method of claim 8 , wherein injecting the generated trusted root certificate comprises dynamically providing a name of the generated trusted root certificate and requested bytes of the generated trusted root certificate in response to detecting a request for the name of the generated trusted root certificate and the requested bytes of the generated trusted root certificate, and wherein dynamically adding the generated trusted root certificate to the list of trusted certificates comprises providing a modified index file comprising an index file with additional bytes corresponding to the generated trusted root certificate appended in response to detecting a request for the index file.

13. The computer-implemented method of claim 8 , wherein injecting the generated trusted root certificate comprises intercepting, via a kernel injector, a system call comprising a request for a root certificate, and injecting, via the kernel injector, the generated trusted root certificate.

14. A computer program product, the computer program product comprising a computer-readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program code executable by a processor to cause the processor to:
dynamically generate a trusted root certificate for an application instance running in a container in response to detecting a new workload;
intercept a request for a trusted certificate from the application instance;
inject the generated trusted root certificate at runtime in response to detecting the request for the trusted certificate from the application instance;
providing the generated certificate to the application instance, wherein the application instance is to authenticate a proxy associated with the application instance based on the dynamically generated root trust certificate; and
dynamically add the generated certificate to an index file of trusted root certificates in response to detecting a request for the index file.

15. The computer program product of claim 14 , further comprising program code executable by the processor to intercept a file system call and inject the generated trusted root certificate into a directory comprising trusted certificates by combining files comprising the generated trusted root certificate into the directory using the overlay file system.

16. The computer program product of claim 14 , further comprising program code executable by the processor to map the generated trusted root certificate into a directory of a file system associated with the container containing trusted certificates.

17. The computer program product of claim 14 , further comprising program code executable by the processor to expose a file system comprising the generated trusted root certificate to the container.

18. The computer program product of claim 14 , further comprising program code executable by the processor to dynamically provide, via a file system driver, a name of the generated trusted root certificate and requested bytes of the generated trusted root certificate, and provide, via the file system driver, a modified index file comprising additional appended bytes in response to detecting a request for an index file.

19. The computer program product of claim 14 , further comprising program code executable by the processor to intercept a system call comprising a request for a root certificate and inject the generated trusted root certificate.

Assignees

• IBM

Inventors

• Lev-Ran Etai

Classifications

• G06F21/44

  Program or device authentication · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/105

  Arrangements for software license management or administration, e.g. for managing licenses at corporate level · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title