Method for obtaining vetted certificates by microservices in elastic cloud environments

• US 10,404,680 B2
• Filed: 08/11/2016
• Issued: 09/03/2019
• Est. Priority Date: 08/11/2016
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: Lewis, Adam C., Metke, Anthony R., Thomas, Shanthi E.
• Primary Examiner(s): Zaidi, Syed A
• Application Number:
  US15/234,180
• Publication Number:
  US 20180048638A1
• Time in Patent Office: 1,118 Days
• Field of Search: 713156
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method and is provided for obtaining a vetted certificate for a microservice in an elastic cloud environment. The microservice receives a one-time authentication credential. The microservice utilizes the one-time authentication credential to obtain a client secret. The microservice obtains an access token and CSR (Certificate Signing Request) attributes using the client secret and constructs a CSR utilizing the CSR attributes. The microservice requests a vetted certificate from a Certificate Authority (CA) and includes the access token and the CSR in the request. If the access token and the CSR pass vetting at the CA, the CA sends a vetted certificate to the microservice.

Claims

1. A method for obtaining a vetted certificate for a microservice in an elastic cloud environment, the method comprising:

receiving a one-time authentication credential at the microservice;

utilizing the one-time authentication credential to obtain a client secret;

obtaining an access token and CSR (Certificate Signing Request) attributes at the microservice using the client secret;

constructing a CSR at the microservice utilizing the CSR attributes;

requesting a vetted certificate from a Certificate Authority (CA), the request including the access token and the CSR; and

receiving a vetted certificate from the CA at the microservice.

2. The method of claim 1, wherein the one-time authentication credential comprises a type of microservice.

3. The method of claim 1, wherein the one-time authentication credential comprises a first piece of data and a second piece of data, wherein the first piece of data comprises a service type and the second piece of data comprises a service instance.

4. The method of claim 1, wherein the client secret associates a type of service with a secret management service.

5. The method of claim 1, wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token matches a stored access token at the CA.

6. The method of claim 1, wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token maps to a stored access token at the CA.

7. The method of claim 1, wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token is equivalent to a stored access token at the CA.

8. The method of claim 1, wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the access token is associated with a stored access token at the CA.

9. The method of claim 1, wherein the step of receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice when the CSR matches a stored CSR at the CA.

10. A microservice comprising:

a transceiver; and

a processor configured to;

receive a one-time authentication credential via the transceiver;

utilize the one-time authentication credential to obtain a client secret via the transceiver;

obtain an access token and CSR (Certificate Signing Request) attributes using the client secret via the transceiver;

construct a CSR utilizing the CSR attributes;

request a vetted certificate from a Certificate Authority (CA) via the transceiver, the request including the access token and the CSR; and

receive a vetted certificate from the CA via the transceiver if the access token and the CSR pass vetting.

11. The microservice of claim 10, wherein the onetime authentication credential comprises a type of microservice.

12. The microservice of claim 10, wherein the one-time authentication credential comprises a first piece of data and a second piece of data, wherein the first piece of data comprises a service type and the second piece of data comprises a service instance.

13. The microservice of claim 10, wherein the client secret associates a type of service with a secret management service.

14. The microservice of claim 10, wherein the processor is configured to receive a vetted certificate from the CA via the transceiver if the access token matches a stored access token at the CA.

15. The microservice of claim 10, wherein the processor is configured to receive a vetted certificate from the CA via the transceiver if the CSR matches a stored CSR at the CA.