# US 2018/0324256 A1 · Scalable authentication between heterogeneous services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324256 A1 - Document ID: US20180324256A1 - Status: Published application - Kind: A1 - Application number: 15/849,803 - Filed: 2017-12-21 - Published: 2018-11-08 - Earliest claimed: 2017-05-02 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Simon HELSEN; Nicholas R. IBARLUZEA; Ritchard L. SCHACHER - Web page: https://patentgrep.com/patent/US20180324256A1 ## CPC - G06F 21/44: Program or device authentication - G06F 21/6236: {between heterogeneous systems} - H04L 41/0226: Mapping or translating multiple network management protocols - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - H04W 12/069: using certificates or pre-shared keys - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods, computer program products, and systems are presented. The methods include, for instance: receiving a request for a private credential of a first service of the two or more services from the first service, generating the private credential of the first service based on identity information of the first service, storing the private credential of the first service and the identity information of the first service in a local database, and sending the private credential of the first service to the first service for secure communication from the first service. ## Claims ### Claim 1 A computer implemented method for authenticating two or more services for communication, comprising: receiving, by one or more processor, a request for a private credential of a first service of the two or more services from the first service, wherein the request includes identity information of the first service; generating, by the one or more processor, the private credential of the first service based on the identity information of the first service, wherein the private credential of the first service is encrypted for a secure transfer; storing, by the one or more processor, a key for the private credential of the first service in a local database; and sending, by the one or more processor, the private credential of the first service to the first service such that the first service may securely communicate with another service of the two or more services by use of the private credential of the first service. ### Claim 2 (depends on 1) The computer implemented method of claim 1, further comprising: generating a service credential for a service instance of the first service, upon being informed, by a fabric, that the fabric will provision the first service; generating a toolchain credential for a toolchain to which the instance of the first service will be bound, upon being informed by the fabric that the fabric will bind the service instance to the toolchain; and storing respective keys for the service credential and the toolchain credential for the first service in the local database. ### Claim 3 (depends on 2) The computer implemented method of claim 2, wherein the private credential of the first service includes the service credential and the toolchain credential. ### Claim 4 (depends on 2) The computer implemented method of claim 2, further comprising: invalidating the association between the service credential and the toolchain credential, the service instance corresponding to the service credential, the service instance of the first service being bound to the toolchain corresponding to the toolchain credential, upon being informed by the fabric that the fabric will unbind the service instance of the first service from the toolchain; and invalidating the service credential corresponding to the service instance of the first service, upon being informed by the fabric that the fabric will deprovision the service instance. ### Claim 5 (depends on 1) The computer implemented method of claim 1, further comprising: receiving a request, from the first service, for a first target credential specifying a second service of the two or more services as a recipient of messages from the first service, wherein the request includes the private credential of the first service; ascertaining that the second service is valid and operational; generating the first target credential for the messages from the first service to the second service; storing a key for the first target credential in the local database; and sending the first target credential to the first service such that the first service may securely send the messages to the second message by use of the first target credential. ### Claim 6 (depends on 5) The computer implemented method of claim 5, further comprising: receiving an inquiry as to the validity of the first target credential from the second service, wherein the second service has received a message from the first service that includes the first target credential; ascertaining that the first target credential has been previously generated for the first service to send messages to the second service; sending a validation for the first target credential to the second service such that the second service may securely respond to the message from the first service. ### Claim 7 (depends on 5) The computer implemented method of claim 5, further comprising: receiving an inquiry as to the validity of the first target credential from the second service, wherein the second service has received a message from the first service that includes the first target credential; discovering that the first target credential is not valid; sending a repudiation on the first target credential to the second service such that the second service may not respond to the message.