Trust establishment by escalation
One example method includes contacting, by a client, a service, receiving a credential from the service, obtaining trust information from a trust broker, comparing the credential with the trust information, and either connecting to the service if the credential and trust information match, or declining to connect to the service if the credential and the trust information do not match. Other than by way of the trust information obtained from the trust broker, the client may have no way to verify whether or not the service can be trusted.
1. A method, comprising:
contacting, by a client, a service;
receiving a credential from the service;
obtaining trust information from a trust broker, wherein the trust information is obtained by the trust broker from an infrastructure manager of a cloud environment in which the service runs;
comparing the credential with the trust information; and
either:
connecting to the service if the credential and trust information match; or
declining to connect to the service if the credential and the trust information do not match.
2. The method as recited in claim 1 , wherein other than by way of the trust information obtained from the trust broker, the client has no way to verify whether or not the service can be trusted.
3. The method as recited in claim 1 , wherein the credential is a certificate that includes a unique identifier of the service.
4. The method as recited in claim 1 , wherein the trust information comprises a unique identifier of the service.
5. The method as recited in claim 1 , wherein the trust broker is an edge service running in a cloud environment that also hosts the service.
6. The method as recited in claim 1 , wherein the trust broker is an element of a virtual private network and is not accessible by clients outside the virtual private network.
7. The method as recited in claim 1 , wherein the infrastructure manager communicates with the service entirely within the cloud environment.
8. The method as recited in claim 1 , wherein the trust information is obtained by the infrastructure manager from a hypervisor that manages operation of the service.
9. The method as recited in claim 1 , wherein the trust information is obtained by the client by way of a plurality of connections, and all of the connections are trusted connections.
10. The method as recited in claim 1 , wherein the service runs on a virtual machine in a cloud environment.
11. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
obtaining trust information from a trust broker, wherein the trust information is obtained by the trust broker from an infrastructure manager of a cloud environment in which the service runs;
comparing the credential with the trust information; and
either:
connecting to the service if the credential and trust information match; or
declining to connect to the service if the credential and the trust information do not match.
12. The non-transitory storage medium as recited in claim 11 , wherein other than by way of the trust information obtained from the trust broker, the client has no way to verify whether or not the service can be trusted.
13. The non-transitory storage medium as recited in claim 11 , wherein the credential is a certificate that includes a unique identifier of the service.
14. The non-transitory storage medium as recited in claim 11 , wherein the trust information comprises a unique identifier of the service.
15. The non-transitory storage medium as recited in claim 11 , wherein the trust broker is an edge service running in a cloud environment that also hosts the service.
16. The non-transitory storage medium as recited in claim 11 , wherein the trust broker is an element of a virtual private network and is not accessible by clients outside the virtual private network.
17. The non-transitory storage medium as recited in claim 11 , wherein the infrastructure manager communicates with the service entirely within the cloud environment.
18. The non-transitory storage medium as recited in claim 11 , wherein the trust information is obtained by the infrastructure manager from a hypervisor that manages operation of the service.
19. The non-transitory storage medium as recited in claim 11 , wherein the trust information is obtained by the client by way of a plurality of connections, and all of the connections are trusted connections.
20. The non-transitory storage medium as recited in claim 11 , wherein the service runs on a virtual machine in a cloud environment.