Identity management for software components using one-time use credential and dynamically created identity credential

1. A method carried out by one or more computing devices, the method comprising;

requesting, from a certification authority, a one-time use credential as a first identity credential for at least one of a plurality of application component instances of an application using a request that comprises: a unique application component instance identifier and a request for a public key and private key pair, the one-time use credential being limited to a single use in requesting a dynamically-created second identity credential for a same application component instance;

requesting from a certification authority, the dynamically-created second identity credential for a same application component instance of the application using the one time use credential by issuing a request signed using at least one of a public key or private key of the public key and private key pair of the requested one-time use credential;

receiving the dynamically-created second identity credential in response to the issued request; and

using the dynamically-created second identity credential in a cryptographic function by the application component instance for one or more of encrypting information, verifying signatures or digitally signing data.

2. The method of claim 1 , wherein the request for the created first identity credential is sent by an application manager.

3. The method of claim 1 , wherein the request for the one-time use credential as the first identity credential and the request for the dynamically created second identity credential includes a unique identifier that uniquely identifies the application component instance.

4. The method of claim 3 , wherein the application component instance interacts with an industrial sensor.

5. The method of claim 1 wherein the one-time use credential and the created second identity credential each comprise a PKI certificate produced by a certificate authority.

6. The method of claim 1 wherein a virtual machine receives the generated one-time use credential for the application component instance and passes the generated one-time use credential for the application component instance to a container that makes the first identity credential available to the application component instance.

7. A method carried out by one or more computing devices, the method comprising:

requesting, from a certification authority, a one-time use credential as a first identity credential for at least one of a plurality of application component instances of an application using a unique identifier associated with the at least one application component instance, the one-time use credential being limited to a single use in requesting a dynamically-created second identity credential for a same application component instance;

receiving a cryptographically generated one-time use credential as the first identity credential for the application component instance based on the unique identifier, in response to the request;

providing the cryptographically generated one-time use credential by a virtualization engine for use by a container that contains the at least one application component instance, and

requesting, from the certification authority, the second identity credential for the application component instance using a request signed based on the one-time use credential.

8. The method of claim 7 , wherein the cryptographic function is an authentication operation.

9. The method of claim 7 , wherein the request includes information that uniquely identifies the at least one application component instance.

10. The method of claim 9 , wherein the at least one application component instance interacts with an industrial sensor.

11. The method of claim 7 wherein the one-time use credential comprises a public key infrastructure (PKI) certificate produced by a certificate authority.

12. The method of claim 7 wherein a virtual machine receives the generated one-time use credential for the application component instance and passes the generated one-time use credential for the application component instance to a container that makes the first identity credential available to the application component instance.

13. The method of claim 7 comprising:

requesting the dynamically-created second identity credential for the application component instance using a certificate-signing request signed based on the one-time use credential;

receiving the dynamically-created second identity credential in response to authentication of the one-time use credential; and

using the dynamically-created second identity credential in a cryptographic function by the at least one application component instance.

14. One or more computing devices comprising:

memory that stores executable instructions;

at least one processor, operatively coupled to execute the executable instructions and based the execution:

request, from a certification authority, a one-time use credential as a first identity credential for at least one of a plurality of application component instances of an application, the one-time use credential being limited to a single use in requesting a dynamically-created second identity credential for the at least one application component instance;

request, from the certification authority, the dynamically-created second identity credential for the application component instance using a request signed based on the one-time use credential;

receive the dynamically-created second identity credential in response to the request for the dynamically created second identity credential; and

use the dynamically-created second identity credential in a cryptographic function by the application component instance for one or more of; encrypting information verifying signatures or digitally signing data.

15. The method of claim 14 , wherein the request for the one-time use credential as the first identity credential and the request for the dynamically created second identity credential includes a unique identifier that uniquely identifies the same application component instance.

16. One or more computing devices comprising:

memory that stores executable instructions;

at least one processor, operatively coupled to execute the executable instructions and based the execution:

request, from a certification authority, a one-time use credential as a first identity credential for an application component instance of a plurality of application component instances using a unique identifier associated with the application component instance and wherein the request is for a public key and private key pair, the one-time use credential being limited to a single use in requesting a second identity credential for a same application component instance;

receive a cryptographically generated one-time use credential as the first identity credential for the application component instance based on the unique identifier, in response to the request, using at least one of a public key or private key of the public key and private key pair;

provide the cryptographically generated one-time use credential by a virtualization engine for use by a container that contains the application component instance and

request, from the certification authority, the second identity credential for the application component instance using a request signed based on the one-time use credential.