Patent ID: 11968233
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 16:
17. A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by an electronic device to cause the electronic device to perform a method comprising:
receiving a trust rule between a first service and a second service in a plurality of services that are deployed in a distributed system, the trust rule defining whether the first service is allowed to access the second service;
obtaining a trust tree for the distributed system, the trust tree comprising a plurality of certificates for accessing the plurality of services, wherein the plurality of services belongs to at least one trust domain in the distributed system, and wherein the obtaining the trust tree comprises generating a leaf node in the trust tree for a service in the plurality of services and a non-leaf node in the trust tree for a trust domain in the at least one trust domain based on a relationship between the plurality of services and the least one trust domain; and
selecting from the plurality of certificates a first group of certificates for the first service based on the trust rule and the trust tree, the first group of certificates enabling the first service to access the second service, wherein the selecting the first group of certificates comprises identifying a target leaf node in the trust tree based on a second position of the second service in the distributed system.