Authentication of services on a partition

• US 8,844,006 B2
• Filed: 09/30/2008
• Issued: 09/23/2014
• Est. Priority Date: 09/30/2008
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Euler, Keith S., Craig, Russell O
• Primary Examiner(s): SHAIFER HARRIMAN, DANT B
• Application Number:
  US13/121,662
• Publication Number:
  US 20110179476A1
• Time in Patent Office: 2,184 Days
• Field of Search: 726/6
• US Class Current: 726/6
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs

Abstract

Embodiments of the disclosure describe systems and methods for authenticating services running on a partition. In this regard, one embodiment of a system for authenticating a service includes a partition including a list of authorized services, and a service running on the partition; and a management processor in communication with the partition, wherein the management processor is configured to generate credentials for the service running on the partition if the service is listed in the list of authorized services.

Claims

1. A system for authenticating a service, comprising:

a partition configured to execute the service;

a list of authorized services associated with the partition; and

a management processor in communication with the partition, the management processor configured to generate credentials for the service if the service is listed in the list of authorized services, the credentials facilitating a request by the service for use of computing resources of the management processor by the service.

2. The system of claim 1, further comprising a message queue for sending a request for credentials from the service to the management processor.

3. The system of claim 2, wherein the message queue is configured to verify that the service is listed in the list of authorized services before sending the request for credentials to the management processor.

4. The system of claim 1, further comprising an in-band communication daemon for sending a request of the service for management processor resources to the management processor, the request including the credentials for the service.

5. The system of claim 4, wherein the management processor is configured to verify that the request is authorized for the service before executing the request.

6. The system of claim 1, wherein the service requests credentials from the management processor using a unique service identifier corresponding to the service.

7. The system of claim 1, wherein the service comprises an application and wherein wherein the credentials are for use of the computing resources of the management processor by the service independent of other services associated with the partition.

8. A method for authenticating a service running on a partition, the method comprising:

initiating a request for credentials by the service;

verifying that the service is listed in an authorized services group associated with the partition; and

if the service is listed in the authorized services group, sending the request for credentials to a management processor.

9. The method of claim 8, further comprising sending a request to the management processor for computing resources for the service, the request including credentials for the service received from the management processor in response to the request.

10. The method of claim 9, wherein the credentials include a random password generated by the management processor.

11. The method of claim 9, wherein the credentials expire after a specified amount of time.

12. The method of claim 11, further comprising, if the credentials have expired, automatically sending a new request for credentials to the management processor.

13. The method of claim 8, further comprising:

creating a partition;

installing the authorized services group on the partition;

assigning a unique service identifier to the service; and

in response to assigning the unique service identifier, adding the unique service identifier to the authorized services group.

14. A non-transitory computer readable storage device comprising a program for authentication of services, the program when executed by a computer processor causing the processor to perform the steps of:

initiating a request for credentials by the service, the request including a unique service identifier corresponding to the service;

verifying that the service is listed in an authorized services group; and

if the service is listed in the authorized services group, sending the request for credentials to a management processor.

15. The non-transitory computer readable storage device of claim 14, wherein the program causes the processor to further perform the step of receiving credentials for the service from the management processor in response to the request.

16. The non-transitory computer readable storage device of claim 15, wherein the program causes the processor to further perform the step of sending a request to the management processor for computing resources for the service, the request including the unique service identifier and the credentials.