Selectively providing mutual transport layer security using alternative server names

Patent metadata

Field	Value
Publication number	US-2019356693-A1
Application number	US-201815984423-A
Country	US
Kind code	A1
Filing date	May 21, 2018
Priority date	May 21, 2018
Publication date	Nov 21, 2019
Grant date	—

Abstract

Examples of techniques for selectively providing mTLS using alternative server names are described herein. An example system includes a processor to generate an alternative server name in response to detecting a legacy indicator. The processor is to also associate the alternative server name with an address of a pod. The processor is to further configure a proxy associated with the pod to selectively provide mutual transport layer security (mTLS) based on the alternative server name.

First claim

What is claimed is:

1 . A system, comprising a processor to:
generate an alternative server name in response to detecting a legacy indicator and associate the alternative server name with an address of a pod; and configure a proxy associated with the pod to selectively provide mutual transport layer security (mTLS) based on the alternative server name.

2 . The system of claim 1 , wherein the system comprises an admission controller to inspect and modify a manifest before the pod is generated.

3 . The system of claim 1 , wherein the system comprises an extension application programming interface (API) server to receive a workload, call an extension point with the received workload, and receive a modified deployment descriptor comprising at least one uniform resource locator (URL) using the alternative server name.

4 . The system of claim 1 , wherein the system comprises a control loop to subscribe to change notifications and, in response to detecting a new workload, modifying a deployment descriptor of the new workload to match a desired state of using the alternative server name.

5 . The system of claim 1 , wherein the legacy indicator comprises a specific attribute in a manifest, pod-specific metadata, a specific URL pattern generated by running an image of a deployment, or a legacy microservice in an application programming interface (API) specification.

6 . The system of claim 1 , wherein a legacy client associated with the detected legacy client access comprises an agent that uses transport layer security (TLS) to perform a health check.

7 . The system of claim 1 , wherein the processor is to provide services for an application instance in the pod using the configured proxy.

8 . A computer-implemented method, comprising:
detecting, via a processor, a legacy indicator; modifying, via the processor, a uniform resource location (URL) of a pod to use an alternative server name; and configuring a proxy associated with the pod to disable mutual transport layer security (mTLS) in response to receiving the alternative server name.

9 . The computer-implemented method of claim 8 , wherein detecting the legacy indicator comprises receiving a manifest and sending the manifest to a webhook for inspection.

10 . The computer-implemented method of claim 8 , wherein detecting the legacy indicator comprises subscribing to change notifications detecting a new workload comprising the legacy indicator.

11 . The computer-implemented method of claim 8 , wherein detecting the legacy indicator comprises running an image of a deployment in a sandbox environment and testing for existence of a specific URL pattern comprising the legacy indicator.

12 . The computer-implemented method of claim 8 , wherein modifying the URL comprises rewriting a manifest via a webhook.

13 . The computer-implemented method of claim 8 , comprising exposing the alternative name as an attribute to configure other systems to use the alternative name.

14 . The computer-implemented method of claim 8 , comprising reconfiguring another system component automatically using the alternative name.

15 . A computer program product for selectively providing mutual transport layer security (mTLS), the computer program product comprising a computer-readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program code executable by a processor to cause the processor to:
monitor a plurality of manifests for a plurality of legacy indicators; detect a legacy indicator associated with at least one legacy client in at least one of the plurality of manifests; generate an alternative server name in response to detecting the legacy indicator; associate the alternative server name with an address of a pod; and configure a proxy associated with the pod to disable a service in response to receiving a server name indicator comprising the alternative server name from a legacy client.

16 . The computer program product of claim 15 , further comprising program code executable by the processor to inspect and modify a manifest before the pod is generated.

17 . The computer program product of claim 15 , further comprising program code executable by the processor to detect the legacy indicator during a deployment of an application.

18 . The computer program product of claim 15 , further comprising program code executable by the processor to store a mapping of the alternative server name to the pod in a service registry.

19 . The computer program product of claim 15 , further comprising program code executable by the processor to configure the proxy to provide transport layer security (TLS) in response to receiving the server name indicator comprising the alternative server name from the legacy client.

20 . The computer program product of claim 15 , further comprising program code executable by the processor to configure the proxy to disable a mutual transport layer security (mTLS) in response to receiving the server name indicator comprising the alternative server name.

Assignees

• IBM

Inventors

• Cahana Zvi
• Lev-Ran Etai
• Zach Idan
• Rajagopalan Shriram

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/166 Primary

  at the transport layer · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title