Credential management

Patent metadata

Field	Value
Publication number	US-2016087964-A1
Application number	US-201514963760-A
Country	US
Kind code	A1
Filing date	Dec 9, 2015
Priority date	Sep 27, 2013
Publication date	Mar 24, 2016
Grant date	—

Abstract

A credential management system is described that provides a way to disable and/or rotate credentials, such as when a credential is suspected to have been compromised, while minimizing potential impact to various systems that may depend on such credentials. The credentials may be disabled temporarily at first and the availability of various resources is monitored for changes. If no significant drop of availability in the resources has occurred, the credential may be disabled for a longer period of time. In this manner, the credentials may be disabled and re-enabled for increasingly longer time intervals until it is determined with sufficient confidence/certainty that disabling the credential will not adversely impact critical systems, at which point the credential can be rotated and/or permanently disabled. This process also enables the system to determine which systems are affected by a credential in cases where such information is not known.

First claim

What is claimed is:

1 . A computer implemented method, comprising:
at a credential management system including at least one processor and memory, the memory communicatively coupled to the at least one processor and storing instructions, the at least one processor executing the instructions to perform the operations of: identifying a credential in a set of credentials corresponding to a user, the user authenticated to access a first computing resource based at least in part on the credential; detecting whether the credential is to be rotated within a first period of time; disabling the credential; monitoring an availability of a second computing resource while the credential is disabled; and determining, by the at least one processor of the credential management system, whether to re-enable or disable the credential based at least in part on the availability of the second computing resource and an availability threshold.

2 . The computer implemented method of claim 1 , further comprising re-enabling the credential based at least in part on the availability of the second computing resource decreasing below the availability threshold during a first time interval.

3 . The computer-implemented method of claim 2 , further comprising disabling the credential based at least in part on the availability of the second computing resource remaining above at least the availability threshold during a second time interval, the second time interval being longer than the first time interval.

4 . The computer-implemented method of claim 3 , further comprising re-enabling the credential based at least in part on the availability of the second computing resource remaining unchanged for at least one of the first time interval or the second time interval.

5 . The computer implemented method of claim 3 , further comprising:
disabling the credential for a second amount of time based at least in part upon the availability remaining above at least at the availability threshold during both the first time interval and the second time interval, the second amount of time longer than the first amount of time, first time interval, or the second time interval.

6 . The computer implemented method of claim 1 , wherein detecting whether the credential is to be rotated further comprises:
arranging the set of credentials based on permissions associated with each credential; and selecting the credential based on the permissions.

7 . The computer implemented method of claim 1 , further comprising:
generating a second version of the credential to replace the credential based at least in part on the monitoring of the availability of the one or more second computing resources.

8 . A computing system, comprising:
at least one processor; and memory including instructions that, when executed by the at least one processor, cause the computing system to: monitor an availability of one or more computing resources accessible using a credential, the credential capable of being used to authenticate against one or more authentication systems to access the one or more first computing resources, the credential having an expiration time period; disable the credential for a first time interval, the first time interval shorter than the expiration time period; determining that the availability of one or more second computing resources related to the credential remain at least at a minimum threshold while the credential is disabled; and disable the credential until a change in the availability of one or more second computing resources is detected.

9 . The computing system of claim 8 , wherein the instructions when executed further cause the computer system to:
re-enable the credential in response to at least one of the availability remaining substantially unchanged or an expiration of a first time interval.

10 . The computing system of claim 9 , wherein the instructions when executed further cause the computer system to:
determine that the availability of the one or more second computing resources remained at least at a minimum threshold during a first time interval during which use of the credential was disabled; disable the credential for a second time interval that is longer than the first time interval; determine that the availability of the one or more second computing resources remained at least at the minimum threshold during at least the first time interval and the second time interval; and permanently disable the credential.

11 . The computing system of claim 8 , wherein the instructions when executed further cause the computer system to:
detect that the availability of a critical second resource has decreased below the minimum threshold; and re-enable the credential in response to detecting that the availability of the critical second resource has decreased.

12 . The computing system of claim 8 , wherein the credential is disabled for a third time interval longer than the first time interval or the second time interval as the expiration time of the credential approaches.

13 . The computing system of claim 8 , wherein the instructions when executed further cause the computer system to:
re-enable the credential in response to detecting a disruption in the availability of the one or more second computing resources prior to the end of the first time interval.

14 . The computing system of claim 8 , wherein disabling the credential includes:
determining a confidence metric of the credential based at least in part on the availability of the one or more second computing resources.

15 . A non-transitory computer-readable storage medium storing instructions that, when executed by at least one processor of a computing system, causes the computer system to:
select a credential, the credential capable of being used to authenticate against one or more authentication systems to access one or more first computing resources; disable the credential for a time interval; monitor an availability of one or more second computing resources related to the credential; maintain the credential as disabled if the availability of the one or more second computing resources remains above at least a minimum threshold during the time interval; and maintain the credential as disabled until a change in the availability of the one or more second computing resources.

16 . The non-transitory computer-readable storage medium of claim 15 , wherein the instructions to monitor the availability of the one or more computing resources when executed further cause the computing system to:
determine an availability of the one or more second computing resources based at least in part on information contained in one or more logs.

17 . The non-transitory computer-readable storage medium of claim 15 , wherein the instructions when executed further cause the computing system to:
detect that the availability of a critical second resource, of the one or more second computing resources, has decreased below the minimum threshold; and re-enable the credential in response to detecting that the availability of the critical second resource has decreased.

18 . The non-transitory computer-readable storage medium of claim 15 , wherein the instructions to select the credential when executed further cause the computing system to:
identify a plurality of credentials that are likely to have been compromised by executing automated searches across one or more specified locations.

19 . The non-transitory computer-readable storage medium of claim 15 , wherein the one or

Assignees

• Amazon Tech Inc

Inventors

• Irving Jr James Leon
• Mikulski Andrew Paul
• Roth Gregory Branchek
• Kruse William Frederick

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04W12/082

  using revocation of authorisation · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title