METHOD FOR OBTAINING VETTED CERTIFICATES BY MICROSERVICES IN ELASTIC CLOUD ENVIRONMENTS

• US 20180048638A1
• Filed: 08/11/2016
• Published: 02/15/2018
• Est. Priority Date: 08/11/2016
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: LEWIS, ADAM C., METKE, ANTHONY R., THOMAS, SHANTHI E.
• Granted Patent: US 10,404,680 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method and is provided for obtaining a vetted certificate for a microservice in an elastic cloud environment. The microservice receives a one-time authentication credential. The microservice utilizes the one-time authentication credential to obtain a client secret. The microservice obtains an access token and CSR (Certificate Signing Request) attributes using the client secret and constructs a CSR utilizing the CSR attributes. The microservice requests a vetted certificate from a Certificate Authority (CA) and includes the access token and the CSR in the request. If the access token and the CSR pass vetting at the CA, the CA sends a vetted certificate to the microservice.

Claims

1. A method for obtaining a vetted certificate for a microservice in an elastic cloud environment, the method comprising:

receiving a one-time authentication credential at the microservice;

utilizing the one-time authentication credential to obtain a client secret;

obtaining an access token and CSR (Certificate Signing Request) attributes at the microservice using the client secret;

constructing a CSR at the microservice utilizing the CSR attributes;

requesting a vetted certificate from a Certificate Authority (CA), the request including the access token and the CSR; and

if the access token and the CSR pass vetting, receiving a vetted certificate from the CA at the microservice.

2. The method of claim 1, wherein the one-time authentication credential comprises a type of microservice.

3. The method of claim 1, wherein the one-time authentication credential comprises a first piece of data and a second piece of data, wherein the first piece of data comprises a service type and the second piece of data comprises a service instance.

4. The method of claim 1, wherein the client secret associates a type of service with a secret management service.

5. The method of claim 1, wherein the step of if the access token and the CSR pass vetting, receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice if the access token matches a stored access token at the CA.

6. The method of claim 1, wherein the step of if the access token and the CSR pass vetting, receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice if the access token maps to a stored access token at the CA.

7. The method of claim 1, wherein the step of if the access token and the CSR pass vetting, receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice if the access token is equivalent to a stored access token at the CA.

8. The method of claim 1, wherein the step of if the access token and the CSR pass vetting, receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice if the access token is associated with a stored access token at the CA.

9. The method of claim 1, wherein the step of if the access token and the CSR pass vetting, receiving a vetted certificate from the CA at the microservice comprises receiving a vetted certificate from the CA at the microservice if the CSR matches a stored CSR at the CA.

10. A method for obtaining a vetted certificate for a microservice in an elastic cloud environment, the method comprising:

obtaining an access token at the microservice;

requesting a vetted certificate from a Certificate Authority (CA), the request including the access token; and

receiving a vetted certificate from the CA at the microservice if the access token matches a stored access token at the CA.

11. The method of claim 10, wherein the step of receiving a vetted certificate from the CA at the microservice if the access token matches a stored access token at the CA comprises receiving a vetted certificate from the CA at the microservice if the access token maps to a stored access token at the CA.

12. The method of claim 10, wherein the step of receiving a vetted certificate from the CA at the microservice if the access token matches a stored access token at the CA comprises receiving a vetted certificate from the CA at the microservice if the access token is equivalent to a stored access token at the CA.

13. The method of claim 10, wherein the step of receiving a vetted certificate from the CA at the microservice if the access token matches a stored access token at the CA comprises receiving a vetted certificate from the CA at the microservice if the access token is associated with a stored access token at the CA.

14. A microservice comprising:

a transceiver; and

a processor configured to;

receive a one-time authentication credential via the transceiver;

utilize the one-time authentication credential to obtain a client secret via the transceiver;

obtain an access token and CSR (Certificate Signing Request) attributes using the client secret via the transceiver;

construct a CSR utilizing the CSR attributes;

request a vetted certificate from a Certificate Authority (CA) via the transceiver, the request including the access token and the CSR; and

receive a vetted certificate from the CA via the transceiver if the access token and the CSR pass vetting.

15. The microservice of claim 14, wherein the onetime authentication credential comprises a type of microservice.

16. The microservice of claim 14, wherein the one-time authentication credential comprises a first piece of data and a second piece of data, wherein the first piece of data comprises a service type and the second piece of data comprises a service instance.

17. The microservice of claim 14, wherein the client secret associates a type of service with a secret management service.

18. The microservice of claim 14, wherein the processor is configured to receive a vetted certificate from the CA via the transceiver if the access token matches a stored access token at the CA.

19. The microservice of claim 14, wherein the processor is configured to receive a vetted certificate from the CA via the transceiver if the CSR matches a stored CSR at the CA.