Cloud-based identity management and authentication system for containers and applications

1. A method for assigning identity and strong authentication credentials to each instance of an individual application or a group of applications, comprising the steps of:

runtime monitoring of a computer system of a specific entity;

assigning an entity identifier (ID) of the specific entity to be shared by an application and the computer system of the specific entity;

scanning the application on the computer system;

classifying the application on the computer system;

assigning a security group to the application;

assigning of a unique name and an application identity to an application instance of the application;

assigning of a security validation token to the application instance;

with a handler process:

generating a certificate signing request based on the unique name, the security group, and the entity ID, and

submitting the certificate signing request to a credential manager;

with the credential manager:

receiving the certificate signing request;

extracting the security group, entity ID, the application identity, and the security validation token from the submitted request;

validating the security validation token;

signing the digital certificate with a private key of a root certificate corresponding to the provided entity ID;

issuing a digital certificate;

revoking the security validation token; and

transmitting the signed digital certificate to the requesting handler process, and

wherein the computer system comprises a plurality of applications, and

wherein a strong cryptographic identity is shared by the plurality of applications.

2. The method of claim 1 ,

wherein the computer system comprises a plurality of containers, and

wherein the strong cryptographic identity is shared by a plurality of containers.

3. The method of claim 1 , wherein the strong cryptographic identity comprises the unique name, group, and entity ID.

4. The method of claim 1 wherein a computer system is scanned, detected applications are classified, security policy for assigning identity to the applications is checked, group assignment for the application is obtained, and an identity is assigned to the application.

5. A method for authenticating a certificate signing request and assigning identity to each instance of an application or a group of applications comprising the steps of:

at the computing device:

scanning a computer system for one or more executable applications;

extracting an entity identifier (ID) from a pre-defined location;

extracting a group name from the pre-defined location;

extracting a validation token from the pre-defined location;

submitting a certificate signing request along with the entity ID, the group name, and validation token;

at the credential server:

creating a new entity ID for a new entity;

generating a root certificate for the new entity;

generating a validation token for use in authenticating certificate signing request;

transmitting the validation token to the customer over a secure channel;

validating the entity ID and the validation token received in the certificate signing request;

at an orchestration server:

establishing a secure connection to the credential server;

authenticating the credential server;

downloading a set of tokens for issuing a certificate; and

transmitting the entity ID, the validation token, and the group name to the client computing device, and

wherein the computer system comprises a plurality of applications, and

wherein a strong cryptographic identity is shared by the plurality of applications.

6. The method of claim 5 , wherein the certificate signing request comprises a request to sign a strong cryptographic identity for the application is made for a container.

7. The method of claim 5 , wherein the certificate signing request comprises a request to the sign strong cryptographic identity for the application is made for a plurality of applications.

8. The method of claim 5 , wherein the certificate authority is a local certificate authority.

9. The method of claim 5 , wherein the certificate authority is a remote certificate authority.

10. The method of claim 5 , wherein the handler process receives the validation token directly from the credential server.

11. The method of claim 5 further comprising:

transmitting the application/container attribute to the client computing device.

12. A computerized system for issuing and managing strong cryptographic identities or digital certificates to each instance of an application or a group of applications in a cloud-computing platform, comprising the steps of:

a publicly accessible credential server in the cloud-computing platform;

a handler process that monitors a group of applications on a computing device; and

a credential server that:

generates a root digital certificate for each entity identifier (ID);

provides a mechanism to generate a one-time use token for the entity ID;

provides a mechanism to create a security group for the entity ID;

listens on a network port for an incoming request from a handler process to issue the root digital certificate for each instance of a group of applications;

validates an incoming certificate signing requests via received validation tokens;

transmits a signed digital certificate to the handler process; and

revokes the pre-generated validation tokens that have expired or have been used in obtaining a digital certificate or strong cryptographic credential, and

wherein the computer system comprises a plurality of applications, and

wherein a strong cryptographic identity is shared by the plurality of applications.

13. The computerized system of claim 12 , wherein a secure channel is established with the credential server for obtaining the authentication tokens.

14. The computerized system of claim 12 , wherein authentication tokens are made available to an application in the group of applications at the start of an execution process of the application.

15. The computerized system of claim 12 , wherein the actions are performed by a separate handler process.

16. The computerized system of claim 12 , wherein the one-time use token, a security group name, and the entity ID are provided to the handler process by an application orchestration server.