US 12,413,427 B2
Mutual authentication between clusters
Alex John Hockey, London (GB); and James Warren Turner, London (GB)
Assigned to MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed by MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed on Jun. 28, 2022, as Appl. No. 17/852,302.
Claims priority of application No. 2206156 (GB), filed on Apr. 28, 2022.
Prior Publication US 2023/0353392 A1, Nov. 2, 2023
Int. Cl. H04L 9/32 (2006.01)
CPC H04L 9/3273 (2013.01) [H04L 9/3265 (2013.01); H04L 9/3268 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method of processing data traffic in a communications network comprising a first cluster comprising one or more compute nodes and a second cluster comprising one or more compute nodes, the first and second clusters configured to provide a service in the communications network, the method comprising:
receiving, by the first cluster, first data traffic;
communicating the first data traffic within the first cluster using a first service mesh in the first cluster, wherein the first data traffic is communicated within the first cluster using a secure communications protocol with mutual authentication based on a certificate chain having a root certificate, wherein the first cluster provides the service in the first cluster, in addition to the second cluster providing the service;
generating, by a client executing in the first cluster, second data traffic for processing by the second cluster, the second cluster having access to the root certificate and having a second service mesh that is independent of the first service mesh, wherein the first and second service meshes are configured to use root certificate to issue leaf certificates to proxies of the first and second service meshes, and wherein each virtual machine of the first and second clusters are configured to trust the root certificate;
using the first service mesh, routing the second data traffic to the second cluster using the secure communications protocol with mutual authentication;
performing mutual authentication between the first cluster and the second cluster using at least the certificate chain having the root certificate; and
in response to performing the mutual authentication between the first cluster and the second cluster, routing application data from the client to the second cluster using the secure communications protocol, wherein the application data is usable to provide the service in the communications network, and wherein a control plane of the first service mesh does not configure a proxy of the first service mesh with conflicting rules.