Container Identity Tokens for Keyless Microservice Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing credential data for microservices in isolated guest operating systems, such as containers, is cumbersome and inefficient, leading to time-consuming key updates and preventing client-server authentication, especially when microservices lack access to host credentials.
Innovation Solution
Implementing a keyless authentication scheme using identity assertion tokens for microservices deployed in isolated OS environments, and client-server authentication for co-located microservices, eliminating the need for digital certificates and cryptography keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates and cryptography keys are used for microservice authentication, then authentication security is maintained, but credential management overhead increases and performance decreases
Solution Approach 1:
The patent extracts the authentication verification process from the traditional digital certificate model. Instead of requiring full certificate validation with cryptographic operations, the system extracts only the essential identity information into compact identity tokens that can be verified efficiently without heavy cryptographic overhead.
Solution Approach 2:
The patent creates simplified copies of authentication credentials in the form of identity tokens. These tokens contain essential identity information without the full cryptographic apparatus of digital certificates, enabling fast verification while maintaining security. The tokens are distributed to microservices as lightweight representations of their authentication credentials.
2Reliability
If digital certificates are used for authentication, then security is ensured, but credential management becomes cumbersome and time-consuming
Solution Approach 1:
The patent implements dynamic token generation and refresh mechanisms. Identity tokens can be renewed and updated without the complex key rotation processes required by digital certificates. The system dynamically issues new tokens as microservices need them, eliminating the rigid key update cycles and manual management overhead associated with certificate-based authentication.
Solution Approach 2:
The authentication service automatically manages identity token issuance, renewal, and revocation without requiring manual intervention. Microservices can autonomously obtain and refresh their identity tokens through standardized API calls, eliminating the need for administrators to manually manage cryptographic keys and certificate lifecycles.
3Productivity
If isolated guest operating systems are used for microservices, then resource efficiency improves, but access to host credentials is prevented
Solution Approach 1:
The patent introduces identity tokens as an intermediary mechanism that bridges the isolation gap. Instead of requiring direct access to host credentials, the host system issues identity tokens to microservices running in isolated containers. These tokens serve as portable credentials that microservices can use for authentication without needing to access or manage host-level cryptographic materials.
Solution Approach 2:
The patent segments the authentication credential system into host-managed identity token issuance and microservice-level token usage. The host system retains control over credential generation and validation, while microservices in isolated environments receive and use only the necessary token fragments for their specific authentication needs, maintaining both isolation and functionality.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Techniques of keyless authentication of computing services in distributed computing systems are disclosed herein. One example technique includes upon receiving a command to instantiate a computing service, transmitting a request to an authentication service for an identity assertion token corresponding to an application execution of which instantiates the computing service. The example technique can also include upon receiving the requested identity assertion token, storing the received identity assertion token in the container and modifying an entry of a configuration file in the container that allows the instantiated computing service to access the stored identity assertion token and authenticate to the authentication service using the identity assertion token.