Autonomous secrets management for a managed service identity

Patent metadata

Field	Value
Publication number	US-10819701-B2
Application number	US-201815920821-A
Country	US
Kind code	B2
Filing date	Mar 14, 2018
Priority date	Mar 14, 2018
Publication date	Oct 27, 2020
Grant date	Oct 27, 2020

Abstract

Various methods and systems are provided for autonomous management for a managed service identity. A first token request, for a secret, is generated at a managed service. The secret supports authenticating the managed service for performing operations in a distributed computing environment. The first token request includes an identity identifier of the managed service. The first token request is communicated to a credentials manager which is associated with a secrets management service (“SMS”) that can be utilized to store, renew and distribute secrets in the distributed computing environment. Based on communicating the first token request to credentials manager, the token is received, via the credentials manager, from the secret token service. The token is received based in part on the credentials manager generating a second token request for the token and communicating the second token request and a secret associated with the managed service to the secret token service.

First claim

What is claimed is:

1. A method for managing secrets, the method comprising:
generating, at a managed service, a first token request for a token, the token supports authenticating the managed service in a distributed computing environment, wherein the first token request comprises an identity identifier of the managed service, wherein the token is retrievable based on a secret that is associated with a secrets management service (“SMS”) for autonomous management of the secret;
communicating the first token request to a credentials manager; and
based on communicating the first token request to the credentials manager, receiving the token, from a secret token service, wherein the token is received based in part on the credentials manager generating a second token request for the token and communicating the second token request and the secret associated with the managed service to the secret token service.

2. The method of claim 1 , wherein generating the first token request obviates including a secret in the first token request, wherein the first token request is communicated as a local request to the credentials manager on a node running the managed service.

3. The method of claim 1 , wherein the first token request further comprises metadata that supports identifying secret token services that correspond to managed services, or a virtual machine running corresponding managed services, or a node running corresponding managed services.

4. The method of claim 1 , further comprising:
receiving, at the credentials manager, the first token request from the managed service;
based on the identity identifier, identifying the secret for the managed service, wherein the SMS operates to automatically renew the secret based on a rollover policy;
determining the secret token service associated with the identity identifier;
generating the second token request comprising the secret;
communicating, to the secret token service, the second token request;
receiving the token from the secret token service; and
communicating the token to the managed service.

5. The method of claim 1 , wherein the secret is pushed to a secret store, corresponding to the credentials manager, during initial deployment of the managed service to a computing fabric.

6. The method of claim 1 , further comprising periodically polling the SMS for an automatically renewed version of the secret by providing the SMS with metadata indicating a current version of the secret on a node running the managed service.

7. The method of claim 1 , wherein the SMS is configured to deliver the secret packaged in a secure blob, wherein the secure blob is an opaque byte array containing the secret.

8. One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:
receiving, from a managed service, a first token request for a token, wherein the token supports authenticating a managed service for performing operations in a distributed computing environment, wherein the first token request comprises an identity identifier of the managed service;
based on the identity identifier, identifying a secret for the managed service, wherein a secret management service (“SMS”) operates to automatically renew secrets;
determining a secret token service associated with the identity identifier;
communicating, to the secret token service, a second token request comprising a secret;
receiving the token from the secret token service; and
communicating the token to the managed service.

9. The media of claim 8 , wherein the first token request excludes the secret in the first token request.

10. The media of claim 8 , wherein the first token request further comprises metadata that supports identifying secret token services that correspond to managed services, or a virtual machine running corresponding managed services, or a node running corresponding managed services.

11. The media of claim 8 , the operations further comprising identifying the secret for the managed service based on a mapping between identity identifiers and secrets in a secrets store, wherein the identity identifiers and secrets further map to corresponding secret token services.

12. The media of claim 8 , wherein the secret is pushed to a secret store, corresponding to the credentials manager, during initial deployment of the managed service to a computing fabric.

13. The media of claim 8 , the operations further comprising periodically polling the SMS for an automatically renewed version of the secret by providing the SMS with metadata indicating a current version of the secret on a node running the managed service.

14. The media of claim 8 , wherein the secret is pushed to a secret store, corresponding to the credentials manager, during initial deployment of the managed service to a computing fabric.

15. The media of claim 8 , wherein the SMS is configured to deliver the secret packaged in a secure blob, wherein the secure blob is an opaque byte array containing the secret.

16. A computer system comprising:
one or more hardware processors and memory configured to provide computer program instructions to the one or more hardware processors;
a managed service configured to utilize the one or more hardware processors to:
generate a first token request for a token, the token supports authenticating the managed service in a distributed computing environment, and wherein the first token request comprises an identity identifier of the managed service, wherein the token is retrievable based on a secret that is associated with a secrets management service (“SMS”) for autonomous management of a secret;
communicate the first token request to a credentials manager; and
based on communicating the first token request to the credentials manager, receiving the token, from a secret token service, wherein the token is received based in part on the credentials manager generating a second token request for the token and communicating the second token request and the secret associated with the managed service to the secret token service.

17. The computer system of claim 16 , further comprising the credentials manager configured to utilize the one or more hardware processors to:
receive, at the credentials manager, the first token request from the managed service;
based on the identity identifier, identify the secret for the managed service, wherein the SMS operates to automatically renew the secret based on a rollover policy;
determine the secret token service associated with the identity identifier;
generate the second token request comprising the secret;
communicate, to the secret token service, the second token request;
receive the token from the secret token service; and
communicate the token to the managed service.

18. The computer system of claim 17 , wherein identifying the secret for the managed service is based on a mapping between identity identifiers and secrets in a secrets store, wherein the identity identifiers and secrets further map to corresponding secret token services.

19. The computer system of claim 16 , further comprising the SMS configured to utilize the one or more hardware processors to:
push the secret to a secret store, corresponding to the credentials manager, during initial deployment of the managed service to a computing fabric.

20. The computer system of claim 16 , further comprising periodically polling the SMS for an automatically renewed version of the

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Bose Abhinav
• Tevosyan Kahren
• Reddy Chandan R
• Chandrasekaran Ashok

Classifications

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title