Selectively providing mutual transport layer security using alternative server names

Patent metadata

Field	Value
Publication number	US-10841336-B2
Application number	US-201815984423-A
Country	US
Kind code	B2
Filing date	May 21, 2018
Priority date	May 21, 2018
Publication date	Nov 17, 2020
Grant date	Nov 17, 2020

Abstract

Examples of techniques for selectively providing mTLS using alternative server names are described herein. An example system includes a processor to generate an alternative server name in response to detecting a legacy indicator. The processor is to also associate the alternative server name with an address of a pod. The processor is to further configure a proxy associated with the pod to selectively provide mutual transport layer security (mTLS) based on the alternative server name.

First claim

What is claimed is:

1. A system, comprising a hardware processor configured to:
generate an alternative server name in response to detecting a legacy indicator and associate the alternative server name with an address of a pod; and
configure a proxy associated with the pod to selectively provide mutual transport layer security (mTLS) based on the alternative server name,
wherein the system comprises an extension application programming interface (API) server to receive a workload, call an extension point with the received workload, and receive a modified deployment descriptor comprising at least one uniform resource locator (URL) using the alternative server name; and
wherein the legacy indicator is an indicator that a specific connection is not to use mTLS.

2. The system of claim 1 , wherein the system comprises an admission controller to inspect and modify a manifest before the pod is generated.

3. The system of claim 1 , wherein the system comprises a control loop to subscribe to change notifications and, in response to detecting a new workload, modifying a deployment descriptor of the new workload to match a desired state of using the alternative server name.

4. The system of claim 1 , wherein the legacy indicator comprises a specific attribute in a manifest, pod-specific metadata, a specific URL pattern generated by running an image of a deployment, or a legacy microservice in an application programming interface (API) specification.

5. The system of claim 1 , wherein a legacy client associated with a detected legacy client access comprises an agent that uses transport layer security (TLS) to perform a health check.

6. The system of claim 1 , wherein the hardware processor is to provide services for an application instance in the pod using the configured proxy.

7. A computer-implemented method, comprising:
detecting, via a processor, a legacy indicator;
modifying, via the processor, a uniform resource location (URL) of a pod to use an alternative server name;
generating the alternative server name in response to detecting the legacy indicator and associating the alternative server name with an address of the pod; and
configuring a proxy associated with the pod to disable mutual transport layer security (mTLS) in response to receiving the alternative server name,
wherein the legacy indicator is an indicator that a specific connection is not to use mTLS.

8. The computer-implemented method of claim 7 , wherein detecting the legacy indicator comprises receiving a manifest and sending the manifest to a webhook for inspection.

9. The computer-implemented method of claim 7 , wherein detecting the legacy indicator comprises subscribing to change notifications detecting a new workload comprising the legacy indicator.

10. The computer-implemented method of claim 7 , wherein detecting the legacy indicator comprises running an image of a deployment in a sandbox environment and testing for existence of a specific URL pattern comprising the legacy indicator.

11. The computer-implemented method of claim 7 , wherein modifying the URL comprises rewriting a manifest via a webhook.

12. The computer-implemented method of claim 7 , comprising exposing the alternative server name as an attribute to configure other systems to use the alternative server name.

13. The computer-implemented method of claim 7 , comprising reconfiguring another system component automatically using the alternative server name.

14. A computer program product for selectively providing mutual transport layer security (mTLS), the computer program product comprising a computer-readable storage medium having program code embodied therewith, wherein the computer-readable storage medium is not a transitory signal per se, the program code executable by a processor to cause the processor to:
monitor a plurality of manifests for a plurality of legacy indicators;
detect a legacy indicator associated with at least one legacy client in at least one of the plurality of manifests;
generate an alternative server name in response to detecting the legacy indicator;
associate the alternative server name with an address of a pod; and
configure a proxy associated with the pod to disable a service in response to receiving a server name indicator comprising the alternative server name from the at least one legacy client,
wherein the legacy indicator is an indicator that a specific connection is not to use mTLS.

15. The computer program product of claim 14 , further comprising program code executable by the processor to inspect and modify a manifest before the pod is generated.

16. The computer program product of claim 14 , further comprising program code executable by the processor to detect the legacy indicator during a deployment of an application.

17. The computer program product of claim 14 , further comprising program code executable by the processor to store a mapping of the alternative server name to the pod in a service registry.

18. The computer program product of claim 14 , further comprising program code executable by the processor to configure the proxy to provide transport layer security (TLS) in response to receiving the server name indicator comprising the alternative server name from the legacy client.

19. The computer program product of claim 14 , further comprising program code executable by the processor to configure the proxy to disable the mTLS in response to receiving the server name indicator comprising the alternative server name.

Assignees

• IBM

Inventors

• Cahana Zvi
• Lev-Ran Etai
• Zach Idan
• Rajagopalan Shriram

Classifications

• H04L67/1036

  Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/564

  Enhancement of application control based on intercepted application data · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L63/166 Primary

  at the transport layer · CPC title