Ephemeral cryptography keys for authenticating computing services

A method of data authentication in a distributed computing system having a security server storing a static private key and multiple additional servers hosting multiple computing services and an authentication service, the method comprising:

• receiving, at the authentication service, data representing a request from a computing service for a security token that is configured to authenticate the computing service to another computing service in the distributed computing system;
• and
• in response to receiving the request for the security token, at the authentication service,
• generating the requested security token;
• creating a digital signature of the generated security token using an ephemeral private key of the authentication service;
• and
• transmitting, to the computing service, a data package as a response to the received request, the data package including:
• the generated security token;
• the digital signature of the generated security token created using the ephemeral private key of the authentication service;
• and
• an ephemeral public key corresponding to the ephemeral private key of the authentication service, the ephemeral public key including a digital signature of the ephemeral public key generated using the private key stored at the security server.

A computing device in a distributed computing system having a security server storing a static private key and multiple additional servers hosting multiple computing services and an authentication service, comprising:

• a processor;
• and
• a memory operatively coupled to the processor, the memory containing instructions executable by the processor to cause the computing device to provide a computing service, wherein the memory also contains additional instructions executable by the processor to cause the computing device to:
• receive, from another computing service, a request for performing an operation along with a data package having:
• a security token of the another computing service;
• a first digital signature of the security token generated using an ephemeral private key of the authentication service;
• and
• an ephemeral public key corresponding to the ephemeral private key of the authentication service with a second digital signature of the ephemeral public key generated using the private key stored at the security server of the distributed computing system;
• and
• in response to receiving the request, at the computing device,
• validate the second digital signature using a public key corresponding to the private key stored at the security server;
• upon validating the second digital signature, validate, using the ephemeral public key included in the data package, the first digital signature;
• and
• upon validating that the first digital signature, perform the operation requested by the another computing service.