Authenticating applications to a network service

1. A multi-layered security method, comprising:

receiving, by a service provider comprising a processor from an application, a certificate at a port of the service provider;

authenticating, by the service provider, the application with the certificate to access the service provider over a logical connection between the application and the service provider;

confirming, by the service provider, that the port at which the certificate was received from the application is an authorized port of the service provider for the application; and

after the authenticating and the confirming, validating, by the service provider, that each respective packet of a plurality of packets sent from the application comprises a key from the service provider.

2. The multi-layered security method of claim 1 , wherein the key has a time expiration.

3. The multi-layered security method of claim 2 , further comprising:

in response to the time expiration of the key, sending, by the service provider to the application, an updated key;

receiving, by the service provider from the application, a further packet containing the updated key; and

validating, by the service provider, the further packet using the updated key.

4. The multi-layered security method of claim 1 , further comprising receiving a request from the application to obtain the certificate from the service provider.

5. The multi-layered security method of claim 4 , further comprising generating the certificate for the application in response to gaining approval from a network administrator.

6. The multi-layered security method of claim 1 , wherein the application is authorized to use a subset of ports belonging to the service provider.

7. The multi-layered security method of claim 1 , wherein the logical connection is encrypted.

8. The multi-layered security method of claim 1 , further comprising maintaining a table comprising the information, the table specifying which of multiple ports belonging to the service provider are authorized for use by the application, wherein the confirming that the port at which the certificate was received from the application is an authorized port is based on determining that the port at which the certificate was received from the application is specified in the table as authorized for use by the application.

9. A switch comprising:

a processor; and

a non-transitory storage medium storing instructions executable on the processor to:

generate a certificate for an application authorized to use the switch;

receive, from the application, the certificate at a port of the switch;

authenticate the application using the certificate received from the application;

confirm that the port at which the certificate was received from the application is an authorized port of the switch for the application by accessing information that identifies the authorized port for the application; and

after the authenticating and the confirming, validate each respective packet of a plurality of packets received by the switch from the application, by determining that the respective packet contains a valid key so as to provide per-packet authorization to protect the switch.

10. The switch of claim 9 , wherein the instructions are executable on the processor to seek approval from a network administrator before generating the certificate.

11. The switch of claim 9 , wherein the instructions are executable on the processor to, in response to expiration of the key, send an updated key to the application.

12. The switch of claim 9 , wherein the instructions are executable on the processor to:

decline to process the respective packet, in response to the validating indicating that the key contained in the respective packet is invalid; and

process the respective packet to provide a service of the switch to the application, in response to the validating indicating that the key contained in the respective packet is valid.

13. A non-transitory computer readable storage medium comprising program instructions that, when executed, cause a service provider to:

receive, from an application, a certificate at a port of the service provider;

authenticate, using the certificate, the application to access the service provider over a logical connection between the application and the service provider;

confirm that the port at which the certificate was received from the application is an authorized port of the service provider for the application by accessing information that identifies the authorized port for the application; and

after the authenticating and the confirming, validate that each respective packet of a plurality of packets sent from the application comprises a valid key from the certificate issued to the application for accessing the service provider.

14. The non-transitory computer readable storage medium of claim 13 ,

wherein the program instructions, when executed, cause the service provider to:

in response to expiration of the key, send an updated key to the application;

receive, from the application, a further packet containing the updated key; and

validate the further packet using the updated key.

15. The switch of claim 12 , further comprising a storage to store a port authentication table comprising the information, the port authentication table listing which port the application is authorized to use for communication with the switch, wherein the confirming that the port at which the certificate was received from the application is an authorized port is based on determining that the port at which the certificate was received from the application is specified in the port authorization table as authorized for use by the application.

16. The switch of claim 9 , wherein the key has an expiration time after which the key is no longer valid.

17. The non-transitory computer readable storage medium of claim 13 , wherein the key has an expiration time after which the key is no longer valid.

18. The method of claim 1 , further comprising:

declining, by the service provider, to process the respective packet, in response to the validating indicating that the key contained in the respective packet is invalid; and

processing, by the service provider, the respective packet to provide a service of the service provider to the application, in response to the validating indicating that the key contained in the respective packet is valid.

19. The non-transitory computer readable storage medium of claim 13 , wherein the program instructions when executed cause the service provider to:

decline to process the respective packet, in response to the validating indicating that the key contained in the respective packet is invalid; and

process the respective packet to provide a service to the application, in response to the validating indicating that the key contained in the respective packet is valid.