Service Identity (Re: Machine Identity)

[Jeroen Massar <[e-mail]>]

Balazs Lengyel wrote:
> IMHO virtualization, and programs like VmWare are one example where it 
> is hard to say what are you trying to identify. The physical box or the 
> virtual machine?

One should identify the *service*

That solves all the issues mentioned here.

The service could be "your p2p app" but also "HTTP host a.example.com" 
or "HTTP host b.example.com" etc.

SSH Keys are a good example of this, they identify the SSH service. You 
can find that service on IPv4 port 22 and IPv6 port 22, maybe on 
different other IP addresses or other port numbers. Everytime you 
connect to that service, you can communicate with it using the same 
public key, as it's private key remains the same. Now if another SSH 
service steals the IP address or port number, you will get a different 
key to talk with.

Solving this with HIP, but instead of "Host" making it "Service" based 
would be great.

Note that a lot of virtualization is service based, not really host 
based. For that matter, the larger sites actually only care about 
services: deploy 1000 HTTP proxies for site X, deploy 1000 crawler bots 
for purpose Z etc. They really can't care less about the host itself, 
that is just a place where the service runs.

Greets,
  Jeroen