Enforcing a Segmentation Policy Using Cryptographic Proof of Identity

A non-transitory computer-readable storage medium storing instructions for enforcing an access control policy, the instructions when executed by one or more processors causing the one or more processors to perform steps comprising:

• sending, by a first operating system instance executing on a first computing device, a connection request from a first workload executing on the first operating system instance to a second workload executing on a second operating system instance on a second computing device;
• providing, by the first operating system instance to the second operating system instance, a first identity and a first cryptographic proof of the first identity;
• receiving, from the second operating system instance at the first operating system instance, a second identity and a second cryptographic proof of the second identity;
• authenticating, by the first operating system instance, the second identity received from the second operating system instance based on the second cryptographic proof of the second identity;
• responsive to authenticating the second identity received from the second operating system instance, determining, based on the second identity, if the second workload executing on the second operating system instance is permitted to communicate with the first workload according to management instructions stored by the first operating system instance;
• responsive to determining that the second workload is permitted to communicate with the first workload, establishing an authenticated connection between the first workload and the second workload;
• and
• facilitating communication between the first workload and the second workload over the authenticated connection.

A computing device comprising:

• one or more processors;
• and
• a non-transitory computer-readable storage medium storing instructions for enforcing an access control policy, the instructions when executed by the one or more processor causing the one or more processors to perform steps comprising:
• sending, by a first operating system instance executing on a first computing device, a connection request from a first workload executing on the first operating system instance to a second workload executing on a second operating system instance on a second computing device;
• providing, by the first operating system instance to the second operating system instance, a first identity and a first cryptographic proof of the first identity;
• receiving, from the second operating system instance at the first operating system instance, a second identity and a second cryptographic proof of the second identity;
• authenticating, by the first operating system instance, the second identity received from the second operating system instance based on the second cryptographic proof of the second identity;
• responsive to authenticating the second identity received from the second operating system instance, determining, based on the second identity, if the second workload executing on the second operating system instance is permitted to communicate with the first workload according to management instructions stored by the first operating system instance;
• responsive to determining that the second workload is permitted to communicate with the first workload,
• establishing an authenticated connection between the first workload and the second workload;
• and
• facilitating communication between the first workload and the second workload over the authenticated connection.