Autonomous secrets management for a temporary shared access signature service

Patent metadata

Field	Value
Publication number	US-10691790-B2
Application number	US-201815920840-A
Country	US
Kind code	B2
Filing date	Mar 14, 2018
Priority date	Mar 14, 2018
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

Various methods and systems are provided for autonomous secrets management for a temporary shared access signature (“SAS”) service. Input for a temporary access request for an account resource, is received from a client. The temporary access request is validated, based on communicating a validation request to the secrets management service (“SMS”) that can be utilized to store, renew and distribute secrets in a distributed computing environment. Validating the temporary access request is based on determining a storage account location path for SAS keys that provide temporary access to account resources. An access policy associated with the temporary access request is accessed. An SAS key request, associated with temporary access request, is communicated to the SMS. The SAS key request includes at least a portion of the access policy. An SAS key is received from the SMS. The SAS key, for access to the account resource, is communicated to the client.

First claim

What is claimed is:

1. A method for managing temporary shared access signature (“SAS”) services, the method comprising:
receiving, at a secrets management service (“SMS”), from a temporary SAS service, a validation request to validate a temporary access request for an account resource;
determining that an account associated with the validation request is further associated with a corresponding storage location of a SAS key for authenticating temporary access to account resources for the account;
communicating the storage location for the SAS key as validation of the temporary access request;
receiving, from the temporary SAS service, a SAS key request for the SAS key; and
communicating the SAS key to the temporary SAS service.

2. The method of claim 1 , wherein the validation request comprises an account identifier, wherein validating the temporary access request operates as an indication that the account is supported via the SMS for providing temporary access to account resources.

3. The method of claim 1 , wherein determining that the account corresponds to the storage location of the SAS key for authenticating temporary access to account resources operates as an indication that the SMS manages automatic renewal of one or more keys based on a rollover policy.

4. The method of claim 1 , wherein the SAS key request further comprises at least a portion of an access policy, wherein the portion of the access policy indicates an expiration time associated the SAS key being requested.

5. The method of claim 1 , wherein the SAS key is associated with a primary storage account key and a secondary storage account key, and wherein a rollover policy specifies interleaving expirations of the primary and secondary keys.

6. The method of claim 1 , wherein the SAS key is associated with a storage account key, and wherein the SMS automatically renewing the storage account key comprises generating a secrets package comprising regenerated shared access keys.

7. The method of claim 1 , wherein input, for a temporary access request for an account resource of an account, is received via a client device having a graphical user interface to the temporary SAS service.

8. One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:
receiving, from a client device, input for a temporary access request for an account resource of an account;
accessing an access policy associated with the temporary access request;
communicating a shared access signature “SAS” key request to a secrets management service (“SMS”), the SAS request comprising at least a portion of the access policy, and wherein the SMS automatically renews one or more keys associated with granting temporary access requests;
receiving an SAS key from the SMS; and
communicating the SAS key to the client device.

9. The media of claim 8 , further comprising:
communicating a validation request to validate the temporary access request; and
receiving a storage location for the SAS key as validation of the temporary access request.

10. The media of claim 9 , the operation further comprising
receiving, from the temporary SAS service, the validation request to validate the temporary access request;
determining that the account associated with the validation request is further associated with the storage location of the SAS key for temporary access to account resources for the account;
communicating the storage location for the SAS key as validation of the temporary access request;
receiving, from the temporary SAS service, the SAS key request for the SAS key; and
communicating the SAS key to the temporary SAS service.

11. The media of claim 9 , wherein the validation request comprises an account identifier, wherein validating the temporary access request operates as an indication that the account is supported via the SMS for providing temporary access to account resources.

12. The media of claim 8 , wherein determining that the account corresponds to a storage location of the SAS key for authenticating temporary access to account resources operates as an indication that the SMS manages automatic renewal of one or more keys based on a rollover policy.

13. The media of claim 8 , wherein the input comprising a subscription identifier and a storage account identifier, for a temporary access request for the account resource of the account, is received via a client device accessing a graphical user interface to the temporary SAS service.

14. The media of claim 8 , wherein the SAS key is associated with a storage account key, and wherein the SMS automatically renewing the storage account key comprises generating a secrets package comprising regenerated shared access keys.

15. The media of claim 8 , wherein the portion of the access policy indicates an expiration time associated the SAS key being requested.

16. A computer system comprising:
one or more hardware processors and memory configured to provide computer program instructions to the one or more hardware processors;
a temporary shared access signature service (“SAS”) configured to utilize the one or more hardware processors to:
receive, from a client device, input for a temporary access request for an account resource of an account;
communicate a validation request to validate the temporary access request;
receive a storage location for the SAS key as validation of the temporary access request;
access an access policy associated with the temporary access request;
communicate a SAS key request to a secrets management service (“SMS”), the SAS request comprising at least a portion of the access policy, and wherein the SMS automatically renews one or more keys associated with granting temporary access requests;
receive an SAS key from the SMS; and
communicate the SAS key to the client.

17. The computer system of claim 16 , further comprising a secrets management service (“SMS”) to configured to utilize the one or more hardware processors to:
receive, from the temporary SAS service, the validation request to validate the temporary access request;
determine that the account associated with the validation request is further associated with the storage location of the SAS key for temporary access to account resources for the account;
communicate the storage location for the SAS key as validation of the temporary access request;
receive, from the temporary SAS service, the SAS key request for the SAS key; and
communicating the SAS key to the temporary SAS service.

18. The computer system of claim 16 , wherein determining that the account corresponds to a storage location of the SAS key for authenticating temporary access to account resources operates as an indication that the SMS manages automatic renewal of one or more keys based on a rollover policy.

19. The computer system of claim 16 , wherein the SAS key request further comprises at least a portion of an access policy, wherein the portion of the access policy indicates an expiration time associated the SAS key being requested.

20. The computer system of claim 16 , wherein the SAS key is associated with a storage account key, and wherein the SMS automatically renewing the storage account key comprises generating a secrets package comprising regenerated shared access keys.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Lounsberry Brian S
• Tevosyan Kahren
• Munshi Vyom P
• Shankar Chetan S
• Bandla Pavan Gopal
• Lipiec Pawel Tomasz
• Kalarickal Sandeep S

Classifications

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• G06F21/46 Primary

  by designing passwords or checking the strength of passwords · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• H04L2209/64

  Self-signed certificates · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title