Granted Patent B2

US 12,470,387 · App. 18/422,916 · Granted Nov 11, 2025

Inventors: Jacob M. Lindholm (Londonderry, NH); Joshua Aaron Horwitz (Centreville, VA)

Assignee: Oracle International Corporation

H04L9/3213G06F16/27H04L63/083

Abstract

Claims (96)

1 . A method, comprising:

receiving, by a manager instance of a computing system, a first request for a first token to access a computing resource, the first request from a computing process of a plurality of computing processes associated with a service account,

determining, by the manager instance of the computing system, an identity of the service account based at least in part on an authentication;

generating, by the manager instance of the computing system, a second request for the first token based at least in part on the authentication;

transmitting, by the manager instance of the computing system, the second request to a token issuance service of the computing system, the second request comprising a manager instance signature and the identity of the service account;

generating, by the token issuance service of the computing system, a third request for the first token, the third request comprising the identity of the service account and a token issuance service signature;

transmitting, by the token issuance service of the computing system, the third request to an identity service of the computing system;

determining, by the identity service of the computing system, whether to generate the first token based at least in part on a policy associated with the service account; and

generating, by the identity service of the computing system, the first token based at least in part on determining whether to generate the first token.

2 . The method of claim 1 , wherein the method further comprises:

detecting a creation of a container for storing the computing process;

generating, by an application programming interface (API) server, a second token associated with the computing process based at least in part on detecting the creation of the container; and

transmitting the second token to an agent of the computing system.

3 . The method of claim 2 , wherein the first request comprises the second token, and wherein the method further comprises:

transmitting a fourth request to the API server to authenticate the second token; and

receiving from the API server a response indicating the second token is authenticated, wherein the response further comprises a respective identity of a cluster and a namespace associated with the service computing process, and wherein the identity service determines whether to generate the first token based at least in part on the respective identity of the cluster, the namespace, and the service account.

4 . The method of claim 3 , wherein the first request comprises a cryptographic signature, and wherein the method further comprises:

accessing a cryptographic key associated with the computing process;

decrypting the cryptographic signature based at least in part on the cryptographic key;

accessing a first hash value from the first request based at least in part on decrypting the cryptographic signature;

determining a second hash value based at least in part on the first request,

comparing the first hash value to the second hash value, wherein the first request is authenticated based at least in part on the comparing the first hash value to the second hash value.

5 . The method of claim 3 , wherein the method further comprises:

transmitting the second token to an authentication provider of the computing system;

generating, by the authentication provider, a fourth request for a computing service managing the computing resource, wherein the fourth request comprises a fifth request from the computing process for the computing resource and the second token; and

transmitting the fourth request to the computing service.

6 . The method of claim 5 , wherein the computing process is a first computing process, and wherein the method further comprises:

receiving, by the authentication provider, a sixth request for the computing resource from a second computing process associated with the service account;

generating a seventh request comprising the six the request and the second token; and

transmitting the seventh request to the computing service.

7 . The method of claim 1 , wherein the method further comprises:

authenticating the second request is performed by a network interface controller that provides an interface between the manager instance and the token issuance service.

8 . A computing system comprising:

one or more processors; and

one or more computer-readable media having stored thereon a sequence of instructions, when executed, cause the one or more processors to:

receive, by a manager instance of the computing system, a first request for a first token to access a computing resource, the first request from a computing process of a plurality of computing processes associated with a service account,

determine, by the manager instance of the computing system, an identity of the service account based at least in part on an authentication;

generate, by the manager instance of the computing system, a second request for the first token based at least in part on the authentication;

transmit, by the manager instance of the computing system, the second request to a token issuance service of the computing system, the second request comprising a manager instance signature and the identity of the service account;

generate, by the token issuance service of the computing system, a third request for the first token, the third request comprising the identity of the service account and a token issuance service signature;

transmit, by the token issuance service of the computing system, the third request to an identity service of the computing system;

determine, by the identity service of the computing system, whether to generate the first token based at least in part on a policy associated with the service account; and

generate, by the identity service of the computing system, the first token based at least in part on determining whether to generate the first token.

9 . The computing system of claim 8 , wherein the sequence of instructions, when executed, further cause the one or more processors to:

detect a creation of a container for storing the computing process;

generate, by an application programming interface (API) server, a second token associated with the computing process based at least in part on detecting the creation of the container; and

transmit the second token to an agent of the computing system.

10 . The computing system of claim 9 , wherein the sequence of instructions, when executed, further cause the one or more processors to:

transmit a fourth request to the API server to authenticate the second token; and

receive from the API server a response indicating the second token is authenticated, wherein the response further comprises a respective identity of a cluster and a namespace associated with the service computing process, and wherein the identity service determines whether to generate the first token based at least in part on the respective identity of the cluster, the namespace, and the service account.

11 . The computing system of claim 10 , wherein the first request comprises a cryptographic signature, wherein the sequence of instructions, when executed, further cause the one or more processors to:

access a cryptographic key associated with the computing process;

decrypt the cryptographic signature based at least in part on the cryptographic key;

access a first hash value from the first request based at least in part on decrypting the cryptographic signature;

determine a second hash value based at least in part on the first request,

compare the first hash value to the second hash value, wherein the first request is authenticated based at least in part on the comparing the first hash value to the second hash value.

12 . The computing system of claim 10 , wherein the sequence of instructions, when executed, further cause the one or more processors to:

transmit the second token to an authentication provider of the computing system;

generate, by the authentication provider, a fourth request for a computing service managing the computing resource, wherein the fourth request comprises a fifth request from the computing process for the computing resource and the second token; and

transmit the fourth request to the computing service.

13 . The computing system of claim 12 , wherein the computing process is a first computing process, and wherein the sequence of instructions, when executed, further cause the one or more processors to:

receive, by the authentication provider, a sixth request for the computing resource from a second computing process associated with the service account;

generate a seventh request comprising the sixth request and the second token; and

transmit the seventh request to the computing service.

14 . The computing system of claim 8 , wherein the sequence of instructions, when executed, further cause the one or more processors to:

authenticate the second request is performed by a network interface controller that provides an interface between the manager instance and the token issuance service.

15 . One or more non-transitory computer-readable media having stored thereon a sequence of instructions that, when executed by one or more processors of a computing system, cause the computing system to:

receive, by a manager instance of the computing system, a first request for a first token to access a computing resource, the first request from a computing process of a plurality of computing processes associated with a service account,

determine, by the manager instance of the computing system, an identity of the service account based at least in part on an authentication;

generate, by the manager instance of the computing system, a second request for the first token based at least in part on the authentication;

transmit, by the manager instance of the computing system, the second request to a token issuance service of the computing system, the second request comprising a manager instance signature and the identity of the service account;

generate, by the token issuance service of the computing system, a third request for the first token, the third request comprising the identity of the service account and a token issuance service signature;

transmit, by the token issuance service of the computing system, the third request to an identity service of the computing system;

determine, by the identity service of the computing system, whether to generate the first token based at least in part on a policy associated with the service account; and

generate, by the identity service of the computing system, the first token based at least in part on determining whether to generate the first token.

16 . The one or more non-transitory computer-readable media of claim 15 , wherein the sequence of instructions, when executed, further cause the one or more processors to:

detect a creation of a container for storing the computing process;

generate, by an application programming interface (API) server, a second token associated with the computing process based at least in part on detecting the creation of the container; and

transmit the second token to an agent of the computing system.

17 . The one or more non-transitory computer-readable media of claim 16 , wherein the sequence of instructions, when executed, further cause the one or more processors to:

transmit a fourth request to the API server to authenticate the second token; and

receive from the API server a response indicating the second token is authenticated, wherein the response further comprises a respective identity of a cluster and a namespace associated with the service computing process, and wherein the identity service determines whether to generate the first token based at least in part on the respective identity of the cluster, the namespace, and the service account.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein the first request comprises a cryptographic signature, and wherein the sequence of instructions, when executed, further cause the one or more processors to:

access a cryptographic key associated with the computing process;

decrypt the cryptographic signature based at least in part on the cryptographic key;

access a first hash value from the first request based at least in part on decrypting the cryptographic signature;

determine a second hash value based at least in part on the first request,

compare the first hash value to the second hash value, wherein the first request is authenticated based at least in part on the comparing the first hash value to the second hash value.

19 . The one or more non-transitory computer-readable media of claim 17 , wherein the sequence of instructions, when executed, further cause the one or more processors to:

transmit the second token to an authentication provider of the computing system;

generate, by the authentication provider, a fourth request for a computing service managing the computing resource, wherein the fourth request comprises a fifth request from the computing process for the computing resource and the second token; and

transmit the fourth request to the computing service.

20 . The one or more non-transitory computer-readable media of claim 19 , wherein the computing process is a first computing process, and wherein the sequence of instructions, when executed, further cause the one or more processors to:

receive, by the authentication provider, a sixth request for the computing resource from a second computing process associated with the service account;

generate a seventh request comprising the sixth request and the second token; and

transmit the seventh request to the computing service.

Assignments (1)

Continuity (2)

References Cited (13)