Onboarding data processing systems using trusted tokens
Methods and systems for managing onboarding of data processing systems are disclosed. Data processing systems added to a distributed environment may require onboarding. To onboard the data processing systems, vouchers are required that delegate authority to an entity to onboard the data processing systems. An orchestrator may be an entity responsible for onboarding the data processing systems when they become available. To onboard the data processing systems without intervention by a user, the orchestrator may provide a trusted token to a voucher management service and may obtain the voucher in response. The trusted token may be previously generated through an interaction between the user with authority over the data processing systems and the voucher management service. The trusted token may be provided by the user to the orchestrator to indicate that the orchestrator is trusted by the user to onboard data processing systems associated with the user.
1 . A method of managing data processing systems, the method comprising:
by a voucher management service system that is embodied by a computing device that is configured to provide vouchers for onboarding of the data processing systems by an orchestrator separate from the voucher management service system:
obtaining a data package from the orchestrator as the orchestrator is attempting to onboard a data processing system of the data processing systems, the orchestrator being separate from the voucher management service system;
making a determination regarding whether the data package comprises a trusted token;
in an instance of the determination in which the data package comprises the trusted token:
obtaining a voucher for the data processing system, the voucher being one of the vouchers and comprising a public key of the orchestrator; and
providing the voucher to the orchestrator to facilitate the onboarding of the data processing system, wherein the onboarding of the data processing system comprises the orchestrator providing the data processing system with at least configuration data for the data processing system to modify a configuration of existing software and hardware components installed within the data processing system,
wherein prior to obtaining the data package from the orchestrator, the method further comprises and by the voucher management service system:
obtaining a request for the trusted token from a user associated with the data processing system;
making a second determination regarding whether the request comprises access credentials for the user, the access credentials indicating that the user has authority over the data processing system; and
in an instance of the second determination in which the request comprises the access credentials, providing the trusted token to a requestor.
2 . The method of claim 1 , wherein the request comprises credentials for the orchestrator, wherein the trusted token comprises:
a payload comprising the credentials for the orchestrator, and
a signature generated using a trusted private key.
3 . The method of claim 1 , wherein the trusted token comprises:
credentials for the orchestrator; and
a trusted signature.
4 . The method of claim 3 , wherein the data package comprises:
the trusted token;
the credentials for the orchestrator; and
the public key for the orchestrator.
5 . The method of claim 4 , wherein the voucher comprises:
verification data usable to validate a root of trust for the data processing system; and
at least one delegation of authority from the root of trust to the public key.
6 . The method of claim 5 , wherein the root of trust is a designated private key and the verification data is a corresponding public key for the designated private key.
7 . The method of claim 6 , wherein the at least one delegation of authority comprises:
a certificate comprising:
a payload comprising an intermediate public key; and
a signature generated using the designated private key.
8 . The method of claim 7 , wherein the certificate further comprises:
a second certificate comprising:
a second payload comprising the public key for the orchestrator; and
a second signature generated using an intermediate private key corresponding to the intermediate public key.
9 . A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor of a voucher management service system that is embodied by a computing device, cause the processor to perform operations for managing data processing systems by at least providing vouchers for onboarding of the data processing systems by an orchestrator separate from the voucher management service system, the operations comprising:
obtaining a data package from the orchestrator as the orchestrator is attempting to onboard a data processing system of the data processing systems, the orchestrator being separate from the voucher management service system;
making a determination regarding whether the data package comprises a trusted token;
in an instance of the determination in which the data package comprises the trusted token:
obtaining a voucher for the data processing system, the voucher being one of the vouchers and comprising a public key of the orchestrator; and
providing the voucher to the orchestrator to facilitate the onboarding of the data processing system, wherein the onboarding of the data processing system comprises the orchestrator providing the data processing system with at least configuration data for the data processing system to modify a configuration of existing software and hardware components installed within the data processing system,
wherein prior to obtaining the data package from the orchestrator, the operations further comprise:
obtaining a request for the trusted token from a user associated with the data processing system;
making a second determination regarding whether the request comprises access credentials for the user, the access credentials indicating that the user has authority over the data processing system; and
in an instance of the second determination in which the request comprises the access credentials, providing the trusted token to a requestor.
10 . The non-transitory machine-readable medium of claim 9 , wherein the request comprises credentials for the orchestrator, wherein the trusted token comprises:
a payload comprising the credentials for the orchestrator, and
a signature generated using a trusted private key.
11 . The non-transitory machine-readable medium of claim 9 , wherein the trusted token comprises:
credentials for the orchestrator; and
a trusted signature.
12 . The non-transitory machine-readable medium of claim 11 , wherein the data package comprises:
the trusted token;
the credentials for the orchestrator; and
the public key for the orchestrator.
13 . The non-transitory machine-readable medium of claim 12 , wherein the voucher comprises:
verification data usable to validate a root of trust for the data processing system; and
at least one delegation of authority from the root of trust to the public key.
14 . A voucher management service system embodied by a computing device, the voucher management service system comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing data processing systems by at least providing vouchers for onboarding of the data processing systems by an orchestrator separate from the voucher management service system, the operations comprising:
obtaining a data package from the orchestrator as the orchestrator is attempting to onboard a data processing system of the data processing systems, the orchestrator being separate from the voucher management service system;
making a determination regarding whether the data package comprises a trusted token;
in an instance of the determination in which the data package comprises the trusted token:
obtaining a voucher for the data processing system, the voucher being one of the vouchers and comprising a public key of the orchestrator; and
providing the voucher to the orchestrator to facilitate the onboarding of the data processing system, wherein the onboarding of the data processing system comprises the orchestrator providing the data processing system with at least configuration data for the data processing system to modify a configuration of existing software and hardware components installed within the data processing system,
wherein prior to obtaining the data package from the orchestrator, the operations further comprise:
obtaining a request for the trusted token from a user associated with the data processing system;
making a second determination regarding whether the request comprises access credentials for the user, the access credentials indicating that the user has authority over the data processing system; and
in an instance of the second determination in which the request comprises the access credentials, providing the trusted token to a requestor.
15 . The voucher management service system of claim 14 , wherein the request comprises credentials for the orchestrator, wherein the trusted token comprises:
a payload comprising the credentials for the orchestrator, and
a signature generated using a trusted private key.
16 . The voucher management service system of claim 14 , wherein the trusted token comprises:
credentials for the orchestrator; and
a trusted signature.
17 . The method of claim 1 , wherein prior to being onboarded, the existing software and hardware components of the data processing system lack the configuration data provided by the orchestrator, and the configuration data being needed by the existing software and hardware components for the data processing system to independently provision one or more computer-implemented services requested by a user associated with the data processing system.
18 . The non-transitory machine-readable medium of claim 13 , wherein the root of trust is a designated private key and the verification data is a corresponding public key for the designated private key.
19 . The non-transitory machine-readable medium of claim 18 , wherein the at least one delegation of authority comprises:
a certificate comprising:
a payload comprising an intermediate public key; and
a signature generated using the designated private key.
20 . The non-transitory machine-readable medium of claim 19 , wherein the certificate further comprises:
a second certificate comprising:
a second payload comprising the public key for the orchestrator; and
a second signature generated using an intermediate private key corresponding to the intermediate public key.