Method and system for distributing secrets

Patent metadata

Field	Value
Publication number	US-9384362-B2
Application number	US-201314053488-A
Country	US
Kind code	B2
Filing date	Oct 14, 2013
Priority date	Oct 14, 2013
Publication date	Jul 5, 2016
Grant date	Jul 5, 2016

Abstract

Secrets data representing one or more secrets required to access associated resources is provided along with secrets distribution policy data representing one or more secrets distribution factors used to control the distribution of the secrets. When a requesting virtual asset submits secrets request data, virtual asset profile data associated with the requesting virtual asset is obtained. The requesting virtual asset profile data is then analyzed using at least one of the secrets distribution factors to authenticate the requesting virtual asset. The requesting virtual asset profile data is then analyzed using one or more of secrets distribution factors to determine what secrets the requesting virtual asset legitimately needs. Authorized secrets data for the requesting virtual asset representing one or more authorized secrets is then generated. The requesting virtual asset is then provided access to the authorized secrets data.

First claim

What is claimed is:

1. A system for distributing credentials comprising:
at least one processor; and
at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for distributing credentials, the process for distributing credentials including:
receiving request data from a requesting virtual asset, the request data including a request for one or more credentials required in order for the requesting virtual asset to be allowed to access one or more resources, the requested credentials being of a first type of a plurality of credential types, the one or more resources being cloud-accessible resources;
responsive to receiving the request data, obtaining profile data associated with the requesting virtual asset;
responsive to receiving the request data, authenticating, by a secrets distribution management system, the requesting virtual asset;
responsive to authenticating the requesting virtual asset and obtaining profile data associated with the requesting virtual asset, analyzing, by the secrets distribution management system, the profile data using one or more distribution factors to determine one or more credentials of the first type that the requesting virtual asset is authorized to receive, the determination being at least partly based on a role assigned to the requesting virtual asset, the requesting virtual asset being assigned at least two different roles;
determining a first source from which the first type of credential is available, wherein a plurality of credential sources are available each having different types of credentials, wherein credentials of a first type are only available from a first source, and credentials of a second type are only available from a second source; and
providing, from the first source, credentials data representing the determined one or more credentials to the requesting virtual asset, the provided credentials data including data representing one or more of the credentials associated with the request data, the providing being accomplished through at least:
encrypting set data;
assigning identification data to the encrypted set data;
storing the encrypted set data in a credentials store;
providing the requesting virtual asset the identification data and an encryption key for identifying and decrypting the encrypted set data; and
providing the requesting virtual asset access to the credentials store.

2. The system for distributing credentials of claim 1 wherein at least one of the one or more credentials is selected from the group of credentials consisting of:
database access credentials;
external services access credentials;
internal services access data;
passwords;
passphrases;
biometric data;
digital certificates;
encryption keys; and
SSL certificates.

3. The system for distributing credentials of claim 1 wherein at least one of the one or more resources is selected from the group of resources consisting of:
databases and data;
external services;
internal services;
cloud-based services;
data center-based services;
the Internet;
a cloud;
applications;
encrypted data;
authenticated SSL communication channels;
wireless accessible services; and
any communication channels.

4. The system for distributing credentials of claim 1 wherein at least one of the one or more distribution factors is selected from the group of distribution factors consisting of:
a determination as to whether owner identification data associated with the owner of the requesting virtual asset is included in a registry of trusted owners' owner identification data;
a determination as to whether the requesting virtual asset is in compliance with one or more security policies;
a determination as to how long the requesting virtual asset has currently been operating;
a determination of the number or resources associated with the requesting virtual asset;
a determination of modules or capabilities associated with the requesting virtual asset;
a determination of the type of requesting virtual asset and the legitimate access requirements of that type of requesting virtual asset; and
any combination thereof.

5. The system for distributing credentials of claim 1 wherein the request data is received from the requesting virtual asset through a resource services gateway.

6. The system for distributing credentials of claim 5 wherein the requesting virtual asset is communicatively coupled to the resource services gateway via a secure communications channel.

7. The system for distributing credentials of claim 6 wherein the secure communications channel is an authenticated Secure Sockets Layer (SSL) communications channel.

8. The system for distributing credentials of claim 1 wherein the request data is received from the requesting virtual asset through a resource services gateway proxy.

9. The system for distributing credentials of claim 8 wherein the requesting virtual asset is communicatively coupled to the resource services gateway proxy via a secure communications channel.

10. The system for distributing credentials of claim 9 wherein the secure communications channel is an authenticated Secure Sockets Layer (SSL) communications channel.

11. The system for distributing credentials of claim 9 wherein the secure communications channel is any private communications channel.

12. The system for distributing credentials of claim 1 wherein the requesting virtual asset is a virtual asset selected from the group of the virtual assets consisting of:
a virtual machine;
a virtual server;
an instance in a cloud infrastructure;
a cloud infrastructure access system;
mobile devices;
remote sensors;
laptops;
desktops;
point-of-sale devices;
ATMs;
electronic voting machines; and
a database.

13. The system for distributing credentials of claim 1 wherein authenticating the requesting virtual asset includes determining whether owner identification data associated with the owner of the requesting virtual asset is included in a registry of trusted owners' owner identification data.

14. The system for distributing credentials of claim 13 wherein owner identification data is an account number associated with the owner of the requesting virtual asset.

15. The system for distributing credentials of claim 1 wherein a number and type of distribution factors used to analyze the profile data is determined by the type of requesting virtual asset.

16. The system for distributing credentials of claim 1 wherein a number and type of distribution factors used to analyze the profile data is determined by the capabilities of the requesting virtual asset.

17. The system for distributing credentials of claim 1 wherein the number and type of distribution factors used to analyze the profile data is determined by the reputation profile of the requesting virtual asset.

18. The system for distributing credentials of claim 1 wherein the number and type of distribution factors used to analyze the profile data is determined by the resources associated with the requesting virtual asset.

19. A system for distributing credentials comprising:
at least one processor; and
at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for distributing credentials, the process for distributing credentials including:
receiving request

Assignees

• Intuit Inc

Inventors

• Cabrera Luis Felipe
• Lietz M Shannon
• Armitage James
• Gryb Oleg
• Shanmugam Elangovan
• Philip Sabu Kuruvila
• Weaver Brett
• Bishop Thomas
• Otillio Troy
• Whitehouse Jinglei
• Wolfe Jeffrey M
• Jain Ankur

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title