Client-side sharing of cryptographic keys

Patent metadata

Field	Value
Publication number	US-12425195-B2
Application number	US-202318225448-A
Country	US
Kind code	B2
Filing date	Jul 24, 2023
Priority date	Jul 24, 2023
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

An example may involve determining that a first proxy server is to share security credentials with a set of one or more proxy servers, wherein the set of one or more proxy servers is associated with the security credentials, and wherein the set of one or more proxy servers includes a second proxy server; transmitting, to the second proxy server, a request for the first proxy server to have access to the security credentials; and receiving, from the second proxy server, a credential key in an encrypted form, wherein the credential key is configured to decrypt the security credentials.

First claim

What is claimed is:

1. A method comprising:
determining that a first proxy server is to share security credentials with a set of one or more proxy servers when a unique identifier of the first proxy server has been added to a list, wherein the set of one or more proxy servers is represented by the list of their respective unique identifiers and is associated with the security credentials, and wherein the set of one or more proxy servers includes a second proxy server;
transmitting, to the second proxy server, a request for the first proxy server to have access to the security credentials; and
receiving, from the second proxy server, a credential key in an encrypted form, wherein the credential key is configured to decrypt the security credentials.

2. The method of claim 1 , further comprising:
receiving, from the first proxy server, a request for the credential key; and
transmitting, to the first proxy server, the credential key in the encrypted form.

3. The method of claim 1 , further comprising:
receiving, from the first proxy server, a request for the security credentials; and
transmitting, to the first proxy server, the security credentials in the encrypted form.

4. The method of claim 3 , wherein the first proxy server is disposed upon a managed network, and wherein the first proxy server is configured to:
decrypt the security credentials using the credential key; and
use the security credentials to remotely access computing devices on the managed network.

5. The method of claim 1 , wherein determining that the first proxy server is to share the security credentials with the set of one or more proxy servers comprises determining that the security credentials have been newly configured for the set of one or more proxy servers.

6. The method of claim 5 , further comprising, prior to determining that the first proxy server is to share the security credentials with the set of one or more proxy servers:
generating an ephemeral key, encrypting the security credentials with the ephemeral key, and storing the security credentials as encrypted.

7. The method of claim 6 , further comprising:
determining that the credential key exists;
obtaining the credential key from a proxy server of the set of one or more proxy servers;
decrypting the security credentials with the ephemeral key; and
re-encrypting the security credentials with the credential key.

8. The method of claim 6 , further comprising:
determining that the credential key does not yet exist;
generating the credential key;
transmitting the credential key to a proxy server of the set of one or more proxy servers;
receiving the credential key in the encrypted form from the proxy server;
decrypting the security credentials with the ephemeral key; and
re-encrypting the security credentials with the credential key.

9. The method of claim 1 , further comprising:
prior to transmitting the request, identifying the second proxy server from the set of one or more proxy servers based on random selection or an ordering of the set of one or more proxy servers.

10. The method of claim 1 , wherein a server device:
stores the security credentials in the encrypted form,
transmits the request to the second proxy server,
receives the credential key in the encrypted form from the second proxy server, and
stores the credential key in the encrypted form.

11. The method of claim 1 , further comprising:
determining that a third proxy server is to share the security credentials with the set of one or more proxy servers, wherein the set of one or more proxy servers includes a fourth proxy server;
transmitting, to the fourth proxy server, a request for the third proxy server to have access to the security credentials; and
receiving, from the fourth proxy server, the credential key in the encrypted form.

12. The method of claim 1 , wherein the credential key is a symmetric or asymmetric cryptographic key.

13. A method comprising:
receiving a request for a first proxy server to have access to security credentials when a unique identifier of the first proxy server has been added to a list, wherein the request is received by a second proxy server that is in a set of one or more proxy servers represented by the list of their respective unique identifiers;
validating that the first proxy server is a member of the set and has proper authorization to access the security credentials;
encrypting a credential key into an encrypted form; and
transmitting, to a location that is accessible by the first proxy server, the credential key in the encrypted form.

14. The method of claim 13 , wherein the first proxy server and the second proxy server are disposed upon a managed network, wherein the first proxy server receives the request from a computing device that is not disposed upon the managed network, and wherein the first proxy server transmits the credential key in the encrypted form to the computing device.

15. The method of claim 13 , wherein the request for the first proxy server to have access to the security credentials is based on determining that the security credentials have been newly configured for the set of one or more proxy servers.

16. The method of claim 13 , further comprising:
transmitting, by the first proxy server, a request for the credential key;
receiving, by the first proxy server, the credential key in the encrypted form;
transmitting, by the first proxy server, a request for the security credentials; and
receiving, by the first proxy server, the security credentials in the encrypted form.

17. The method of claim 16 , wherein the first proxy server is disposed upon a managed network, the method further comprising:
decrypting, by the first proxy server, the security credentials using the credential key; and
using, by the first proxy server, the security credentials to remotely access computing devices on the managed network.

18. A non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing system, cause the computing system to perform operations comprising:
determining that a first proxy server is to share security credentials with a set of one or more proxy servers when a unique identifier of the first proxy server has been added to a list, wherein the set of one or more proxy servers is represented by the list of their respective unique identifiers and is associated with the security credentials, and wherein the set of one or more proxy servers includes a second proxy server;
transmitting, to the second proxy server, a request for the first proxy server to have access to the security credentials; and
receiving, from the second proxy server, a credential key in an encrypted form, wherein the credential key is configured to decrypt the security credentials.

Assignees

• Servicenow Inc
• Service Now Inc

Inventors

• Song Jiayin
• Granger Matis
• Hsu Shu-Wei

Classifications

• H04L9/0861 Primary

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L2209/76

  Proxy, i.e. using intermediary entity to perform cryptographic operations · CPC title

• H04L9/0825 Primary

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title