Managing support access in software-as-a-service systems

Patent metadata

Field	Value
Publication number	US-9781102-B1
Application number	US-201414200572-A
Country	US
Kind code	B1
Filing date	Mar 7, 2014
Priority date	Mar 8, 2013
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

An improved technique involves setting an administrator password in a server to a temporary password upon receipt of a request for administrator access to the server. Along these lines, when a support engineer receives a support ticket from a customer, the support engineer sends a request to obtain administrator access to the customer's server to an access control computer. The access control computer, upon receipt of the request, generates a temporary password that grants the support engineer a one-time administrator access to the server. The access control computer then changes the administrator password on the server to the temporary password and reveals the temporary password to the support engineer. At some time either after the engineer obtains administrator access to the server or after some specified time has passed, the access control computer invalidates the temporary password by changing the administrator password to a different password.

First claim

What is claimed is:

1. A method of operating a computing device configured to manage a software-as-a-service (SaaS) system, the method comprising:
receiving, by the computing device from a user commencing a support operation on a server of the SaaS system, a request to obtain administrator access to the server of the SaaS system;
generating, by the computing device, a temporary password in response to receipt of the request;
setting, by the computing device, an administrator password of the server to the temporary password;
revealing, by the computing device, the temporary password to the user, the temporary password enabling the user to obtain administrator access to the server and to perform support operations thereon, wherein revealing the temporary password to the user includes causing the temporary password to be displayed in a display device of a user computer; and
changing, by the computing device, the administrator password from the temporary password to a different password once a specified amount of time has elapsed after the temporary password is revealed to the user;
wherein the request to obtain administrator access to the server includes a user identifier that identifies the user from whom the request was received; and
wherein the method further comprises writing the user identifier and the temporary password into an entry in an audit log stored in a storage device of the computing device upon the generation of the temporary password in order to strengthen accountability in the support operations;
wherein setting the administrator password of the server to the temporary password includes:
sending a message from the computing device to the server of the SaaS system instructing that the administrator password of the server of the SaaS system be set to the temporary password and
after sending the message, receiving, by the computing device, another message from the server of the SaaS system confirming that the administrator password of the server of the SaaS system has been set to the temporary password; and

wherein the temporary password is displayed on the display device in response to receipt, by the computing device, of the other message confirming that the administrator password of the server of the SaaS system has been set to the temporary password.

2. A method as in claim 1 , further comprising writing the user identifier and the temporary password into an entry in another audit log stored in a storage device of the server when the user obtains administrator access to the server, the other audit log indicating a correlation between user activity on the server with the user identity based on the temporary password used by the user to obtain administrator access to the server.

3. A method as in claim 2 , further comprising:
writing timestamps in the other audit log, each timestamp indicating a time at which a user activity was performed in the server; and
verifying that another user sharing administrator access to the server with the user performed a particular activity in the server based on the timestamps written to the other audit log.

4. A method as in claim 1 , further comprising, upon receipt of a request to obtain administrator access to the server of the SaaS system from another user prior to the user having commenced the support operation on the server, performing a conflict assessment operation that denies the generation of the temporary password for the other user once the specified amount of time has not passed upon the receipt of the request to obtain administrator access to the server of the SaaS system from the other user.

5. A method as in claim 1 , further comprising providing to the user computer operated by the user a software program configured to run in a browser of the user computer;
wherein the user sends the request to obtain administrator access to the server of the SaaS system to the computing device via the software program and
wherein revealing the temporary password to the user further includes causing the temporary password to be displayed in a browser window of the browser on the display device of the user computer.

6. A method as in claim 1 , wherein revealing the temporary password to the user includes enclosing the temporary password within an email message addressed to the user.

7. A method as in claim 1 , wherein setting the administrator password to the temporary password includes:
creating a temporary administrator account on the server that is accessed using the administrator password; and
wherein changing the administrator password from the temporary password to a different password includes:
removing the temporary administrator account from the server.

8. A method as in claim 1 , wherein generating the temporary password includes invoking a random number generator, the random number generator outputting a specified number of ASCII characters.

9. An apparatus constructed and arranged to manage a software-as-a-service (SaaS) system, the apparatus comprising:
a network interface; and
a controller including controlling circuitry, the controlling circuitry being constructed and arranged to:
receive, from a user over the network interface commencing a support operation on a server of the SaaS system, a request to obtain administrator access to the server of the SaaS system;
generate a temporary password in response to receipt of the request;
set the administrator password of the server to the temporary password;
reveal the temporary password to the user, the temporary password enabling the user to obtain administrator access to the server and to perform support operations thereon, wherein when the controlling circuitry reveals the temporary password to the user the controlling circuitry causes the temporary password to be displayed in a display device of a user computer; and
change the administrator password from the temporary password to a different password once a specified amount of time has elapsed after the temporary password is revealed to the user;
wherein the request to obtain administrator access to the server includes a user identifier that identifies the user from whom the request was received; and

wherein the controlling circuitry is further constructed and arranged to write the user identifier and the temporary password into an entry in an audit log stored in a storage device of the apparatus upon the generation of the temporary password in order to strengthen accountability in the support operations;
wherein the controlling circuitry constructed and arranged to set the administrator password of the server to the temporary password is further constructed and arranged to:
send a message across the network interface to the server of the SaaS system instructing that the administrator password of the server of the SaaS system be set to the temporary password and
after sending the message, receive, by the control circuitry, another message from the server of the SaaS system confirming that the administrator password of the server of the SaaS system has been set to the temporary password; and

wherein the temporary password is displayed on the display device in response to receipt, by the control circuitry, of the other message confirming that the administrator password of the server of the SaaS system has been set to the temporary password.

10. An apparatus as in claim 9 , wherein the controlling circuitry is further constructed and arranged to write the user identifier and the temporary password into an entry in another audit log stored in a storage device of the server when the user obtains administrator access to the server, the other audit log enabling a correlation between user activity on the server with the user iden

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Knjazihhin Denis
• Lawrence Jr Joseph Xavier
• Shapiro David
• Zehme Dan Uwe

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0846 Primary

  using time-dependent-passwords, e.g. periodically changing passwords · CPC title

• H04L63/102

  Entity profiles · CPC title