Dynamic access control in service mesh with service broker

Patent metadata

Field	Value
Publication number	US-12034728-B2
Application number	US-202117383657-A
Country	US
Kind code	B2
Filing date	Jul 23, 2021
Priority date	Jul 23, 2021
Publication date	Jul 9, 2024
Grant date	Jul 9, 2024

Abstract

One example method includes performing dynamic access control in a computing network. A computing environment is configured such that an application can access a service without specifying secrets. The secrets needed to access the service are obtained and stored in a credential store. The secrets can be obtained using the service mesh in a manner that isolates the application from the secrets.

First claim

What is claimed is:

1. A method comprising:
provisioning a service in a computing environment that includes a service mesh;
storing credentials to access the service in a credential store;
binding the service to an application in the service mesh;
connecting a service broker and a service mesh controller to add policies to the service mesh, wherein the policies of the service mesh are defined and maintained by the service mesh controller;

deploying the application to the computing environment, wherein a first sidecar is associated to the application and a second side car is associated to the service;
sending a request to the service using the service mesh without including the credentials, wherein the request for the service is received by the first sidecar and transmitted to the second sidecar in accordance with the policies of the service mesh;
when an access token in not available, obtaining, by the service broker, the access token using the credentials stored in the credential store and providing the access token to the second sidecar; and
forwarding the request to the service by the second sidecar along with the access token.

2. The method of claim 1 , further comprising sending an token request to the service broker.

3. The method of claim 1 , further sending the request, from the application, by specifying a name of the service.

4. The method of claim 1 , wherein the application is isolated from the credential store and is not configured to directly access the service other than generate the request.

5. The method of claim 1 , wherein the second sidecar is configured differently from the first sidecar and is configured to obtain the access token, wherein the service broker is further configured as an endpoint for authentication.

6. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations of claim 1 .

Assignees

• Emc Ip Holding Co Llc

Inventors

• He Xuebin
• Fong Victor
• Durazzo Kenneth
• Robles Edgardo

Classifications

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title