Distribution of user credentials

Patent metadata

Field	Value
Publication number	US-9641335-B2
Application number	US-201314028208-A
Country	US
Kind code	B2
Filing date	Sep 16, 2013
Priority date	Sep 16, 2013
Publication date	May 2, 2017
Grant date	May 2, 2017

Abstract

A method relates to distributing user credentials in a distributed physical access control system, and more generally to distributing user credentials in a distributed system. A method may include storing a user credential database (DB), a first transformed credential DB and a second transformed credential DB for authenticating users to access a first and a second service provided by the device. The method may include generating the first transformed credential DB and the second transformed credential DB based on the user credential DB and comparing a credential received from a user to the first or the second transformed credential DB to determine whether to grant access to the first or the second service. The method may include distributing the user credential DB to a plurality of other devices connected in a network for the other devices to generate transformed credential DBs for authenticating users to access services.

First claim

What is claimed is:

1. A device including:
a memory to store a user credential database (DB) for storing untransformed credentials, a first transformed credential DB for authenticating users for accessing a first service provided by the device, and a second transformed credential DB for authenticating users for accessing a second service provided by the device;
a communication interface to receive an untransformed credential;
a processor to:
update the first transformed credential DB and the second transformed credential DB based on the user credential DB,
transform the received untransformed credential to generate a transformed received credential, and
compare the transformed received credential to a first transformed credential stored in the first transformed credential DB to determine whether the received untransformed credential is correct or not correct to complete authentication of a user to access the first service or compare the transformed received credential to a second transformed credential stored in the second transformed credential DB to determine whether the received untransformed credential is correct or not correct to complete authentication of the user to access the second service; and

wherein the communication interface is configured to:
distribute the user credential DB to a plurality of other devices connected in a peer-to-peer network for the other devices to generate transformed credential DB s for authenticating users to access services provided by the other devices, and
receive the user credential DB from the other devices in the peer-to-peer network.

2. The device of claim 1 ,
wherein the user credential DB is an encrypted user credential DB, wherein the encrypted user credential DB stores untransformed user credentials, and wherein the processor is configured to decrypt the encrypted user credential DB and to generate the first transformed DB and second transformed credential DB based on the decrypted user credential DB; and
wherein the communication interface is configured to distribute the encrypted user credential DB to the other devices for the other devices to generate the other transformed credential DBs for authenticating users to access services provided by the other devices.

3. The device of claim 2 ,
wherein the first service includes one of a secure shell (SSH) server, a file transfer protocol (FTP) server, a remote desktop protocol (RDP) server, a virtual private network (VPN) server, or a virtual network channel (VNC) server,
wherein the second service is different than the first service and includes one of a secure shell (SSH) server, a file transfer protocol (FTP) server, a remote desktop protocol (RDP) server, a virtual private network (VPN) server, or a virtual network channel (VNC) server,
wherein the user credential DB stores unhashed credentials, the first transformed credential DB stores first hashed credentials, and the second transformed credential DB stores second hashed credentials;
wherein the processor is configured to update the first transformed credential DB and the second transformed credential DB by:
performing a first hashing operation on the unhashed credentials stored in the user credential DB to generate the first hashed credentials to store in the first transformed credential DB, and
performing a second hashing operation on the unhashed credentials stored in the user credential DB to generate the second hashed credentials to store in the second transformed credential DB,

wherein the processor is configured to:
determine that the untransformed credential is correct when the transformed received credential is identical to the first transformed credential and determine that the untransformed credential is not correct when the transformed received credential is not identical to the first transformed credential, or
determine that the untransformed credential is correct when the transformed received credential is identical to the second transformed credential and determine that the untransformed credential is not correct when the transformed received credential is not identical to the first transformed credential.

4. The device of claim 2 ,
wherein the processor is configured to generate the first transformed credential DB by transforming credentials from the decrypted user credential DB using a cryptographic one-way function; and
wherein the processor is configured to generate the second transformed credential DB by transforming credentials from the decrypted user credential DB using a cryptographic one-way function.

5. The device of claim 4 , wherein the first transformed credential DB and the second transformed credential DB are each configured to authenticate a same user with a same credential.

6. The device of claim 4 ,
wherein the processor is configured to receive updated user credentials from an administrator, update the user credential DB, generate the first transformed credential DB and the second transformed credential DB based on the updated user credential DB, and
wherein the communication interface is configured to distribute the updated user credential DB to the other devices for the other devices to generate the other transformed credential DBs for authenticating users to access services provided by the other devices.

7. The device of claim 2 , wherein the processor is configured to decrypt the encrypted user credential DB based on a password received through the communication interface from an administrator, the device further comprising:
a housing enclosing the memory, the communication interface, and the processor, wherein the housing physically separates the device from the plurality of other devices connected in the peer-to-peer network.

8. The device of claim 7 , wherein the processor is configured to:
decrypt, based on the password received through the communication interface from the administrator, an encrypted key to generate an unencrypted key; and
decrypt the encrypted user credential DB based on the unencrypted key.

9. The device of claim 8 , wherein the processor if further configured to:
decrypt an encrypted administrator password based on the key, to generate a decrypted administrator password; and
authorize access when the password received from the administrator is identical to the decrypted administrator password.

10. A method including:
storing a user credential database (DB) to store untransformed credentials, a first transformed credential DB for authenticating users to access a first service provided by a device, and a second transformed credential DB for authenticating users to access a second service provided by the device;
generating the first transformed credential DB and the second transformed credential DB based on the user credential DB;
receiving an untransformed credential in the device and transforming the credential to generate a transformed received credential;
comparing the transformed received credential to a first transformed credential stored in the first transformed credential DB to determine whether the received untransformed credential is correct or not correct to complete authentication of a user to access the first service or comparing the received credential to a second transformed credential stored in the second transformed credential DB to determine whether the received untransformed credential is correct or not correct to complete authentication of the user to access the second service;
distributing the user credential DB to a plurality of other devices connected in a peer-to-peer network for the other devices to generate transformed credential DB s for authenticating users to access services provided by the other devices; and
receiving the user creden

Assignees

• Axis Ab

Inventors

• Bruce Mathias
• Hansson Niklas

Classifications

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/32 Primary

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• G06F9/468 Primary

  Specific access rights for resources, e.g. using capability register · CPC title