Push-based trust model for public cloud applications

• US 9,473,482 B2
• Filed: 12/16/2014
• Issued: 10/18/2016
• Est. Priority Date: 12/20/2013
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Koivuniemi, Samuli J., Ahmed, Zahid N., Lonial, Sumit, Beauford, Mike
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/571,761
• Publication Number:
  US 20150180848A1
• Time in Patent Office: 672 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In accordance with the exemplary embodiments of the invention there is at least a method and apparatus to perform operations including deploying, with a device of a private network, an application instance with an application web service in a cloud network; and based on the deploying, communicating with the application web service in the cloud network to establish a trust relationship with the application web service for the application instance.

Claims

1. A method comprising:

deploying, with a device of a private network, an application instance to a public cloud with an application web service in a cloud network, wherein the deploying is using a deployment script defined in a machine image of the device for the application instance, and wherein the machine image when started causes application credentials to be passed to the application instance; and

using at least the application credentials, communicating with the application web service in the cloud network to establish a trust relationship with the application web service for the application instance.

2. The method according to claim 1, wherein the application credentials are passed to the application instance by a third party provider separate from the cloud network.

3. The method according to claim 2, wherein the application credentials passed to the application instance comprises at least one of a username and password, and a security key.

4. The method according to claim 1, comprising:

connecting to the application instance using the application credentials passed to the application instance; and

deploying a child certificate into the application image for the trust relationship.

5. The method according to claim 4, comprising:

after the connecting, assigning secrets read from environmental variables to the application instance for the trust relationship, wherein the environmental variables are from a location controlled by the private network.

6. The method according to claim 1, wherein the machine image, when started for the application instance, loads a deployment agent to connect back to the private network.

7. The method according to claim 6, wherein a validation of the connection back is performed based on the application credentials passed to the application instance.

8. The method according to claim 7, comprising based on the validating, a child certificate and corresponding configuration information is assigned to the application instance.

9. The method according to claim 1, wherein the deployment script comprises an auto scaling rule.

10. A non-transitory computer readable medium embodying computer program code, the computer program code executable by at least one hardware processor to perform the method according to claim 1.

11. An apparatus comprising:

at least one hardware processor; and

at least one memory including computer program code, where the at least one memory and the computer program code are configured, with the at least one hardware processor, to cause the apparatus to at least;

deploy, with a device of a private network, an application instance to a public cloud with an application web service in a cloud network, wherein the deploying is using a deployment script defined in a machine image of the device for the application instance, and wherein the machine image when started causes application credentials to be passed to the application instance; and

using at least the application credentials, communicate with the application web service in the cloud network to establish a trust relationship with the application web service for the application instance.

12. The apparatus according to claim 11, wherein the script application credentials are passed to the application instance by a third party provider separate from the cloud network.

13. The apparatus according to claim 11, wherein the application credentials passed to the application instance comprises at least one of a username and password, and a security key.

14. The apparatus according to claim 11, wherein the at least one memory including the computer program code is configured with the at least one hardware processor to cause the apparatus to:

connect to the application instance using the security key passed to the application instance; and

deploy a child certificate into the application image for the trust relationship.

15. The apparatus according to claim 14, wherein the at least one memory including the computer program code is configured with the at least one hardware processor to cause the apparatus to:

after the connecting, assign secrets read from environmental variables to the application instance for the trust relationship, wherein the environmental variables are from a location controlled by the private network.

16. The apparatus according to claim 11, wherein the machine image, when started for the application instance, loads a deployment agent to connect back to the private network.

17. The apparatus according to claim 16, wherein a validation of the connection back is performed based on the application credentials passed to the application instance.

18. The apparatus according to claim 17, wherein the at least one memory including the computer program code is configured with the at least one hardware processor to cause the apparatus to:

based on the validating, assign a child certificate and corresponding configuration information to the application instance.

19. The apparatus according to claim 11, wherein the deployment script comprises an auto scaling rule.