Patent ID: 11968233
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computer-implemented method comprising:
receiving, by one or more processors, a trust rule between a first service and a second service in a plurality of services that are deployed in a distributed system, the trust rule defining whether the first service is allowed to access the second service;
obtaining, by the one or more processors, a trust tree for the distributed system, the trust tree comprising a plurality of certificates for accessing the plurality of services, wherein the plurality of services belongs to at least one trust domain in the distributed system, and wherein the obtaining the trust tree comprises generating a leaf node in the trust tree for a service in the plurality of services and a non-leaf node in the trust tree for a trust domain in the at least one trust domain based on a relationship between the plurality of services and the least one trust domain; and
selecting, by the one or more processors, from the plurality of certificates a first group of certificates for the first service based on the trust rule and the trust tree, the first group of certificates enabling the first service to access the second service, wherein the selecting the first group of certificates comprises identifying a target leaf node in the trust tree based on a second position of the second service in the distributed system.