Automatic key management using enterprise user identity management

• US 10,348,727 B2
• Filed: 02/13/2015
• Issued: 07/09/2019
• Est. Priority Date: 02/13/2015
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated (Kyndryl Holdings, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Adam, Constantin M., Hernandez, Milton H., Sreedhar, Vugranam C., Vivekanandan, Prema
• Primary Examiner(s): King, John B
• Assistant Examiner(s): Dhruv, Darshan I
• Application Number:
  US14/621,852
• Publication Number:
  US 20160241558A1
• Time in Patent Office: 1,607 Days
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet

Abstract

A method forms a key pair for a user. The key pair has a public key and a private key that is unique to the user and that is encrypted using a passphrase formed from an enterprise password of the user and an identification that uniquely identifies in the enterprise a device by which the user gains access. The method stores the private key in the user device and stores the public key in an enterprise server that is accessed by the user. The method provides the private key from the user device to a client, such as a SSH client, in conjunction with the password and the identification, decrypts the private key to obtain the decrypted password and the identification, and allows the user to access the enterprise server only if the decrypted password and the identification match the password and the identification provided with the private key.

Claims

1. A method implemented by at least one data processor, comprising:

receiving from a user device an identification that uniquely identifies in an enterprise the user device by which a user accesses at least one server of the enterprise, an enterprise password of the user associated with the user device, and a list of the enterprise'"'"'s servers that are to be accessible by the user via the user device and a server access function;

forming a key pair for the user, the key pair comprising a public key and a private key that is unique to the user and that is encrypted using a passphrase comprised of the received enterprise password of the user verified by the enterprise'"'"'s directory and the identification that uniquely identifies in the enterprise the user device by which the user accesses the enterprise'"'"'s servers, where the encrypted private key is comprised of the passphrase;

storing the encrypted private key in the user device and storing the public key in each of the enterprise'"'"'s servers that are identified in the received list of the enterprise'"'"'s servers;

subsequently, when the user accesses the at least one enterprise server appearing in the list of the enterprise'"'"'s servers, providing the encrypted private key, that was stored in the user device, from the user device to the server access function in conjunction with the password and the identification that uniquely identifies in the enterprise the user device by which the user accesses the enterprise;

decrypting at the server access function the encrypted private key using the provided password and the identification that uniquely identifies in the enterprise the user device to obtain from the decrypted private key the password and the identification that uniquely identifies in the enterprise the user device;

comparing the provided password and the identification that uniquely identifies in the enterprise the user device with the password and the identification that uniquely identifies in the enterprise the user device that are obtained from the decrypted private key; and

granting the user access to the at least one enterprise server via the user device and the server access function only if the provided password and the identification that uniquely identifies in the enterprise the user device matches with the password and the identification that uniquely identifies in the enterprise the user device that are obtained from the decrypted private key.

2. The method as in claim 1, wherein the identification that uniquely identifies in the enterprise the user device by which the user accesses the enterprise comprises a medium access control (MAC) address of the user device.

3. The method as in claim 1, wherein the server access function is comprised of a secure shell (SSH) client.

4. The method as in claim 1, wherein the server access function is comprised of a jump server.

5. The method as in claim 1, further comprising, in response to a change in at least one of the enterprise password of the user and the identification that uniquely identifies the user device, forming a new key pair for the user using the changed at least one of the enterprise password and the identification, and storing a resulting new private key in the user device and storing the resulting new public key in the enterprise'"'"'s servers identified in the list.

6. The method as in claim 1, further comprising, in response to a change in a status of the user in the enterprise, identifying from the list of servers those enterprise servers that the user could access, and removing the public key of the user from all of the enterprise'"'"'s servers in the list.

7. The method of claim 1, further comprising storing in a key management store of the enterprise the user information comprising at least the encrypted private key, the public key, the identification of the user device, and the list of the enterprise'"'"'s servers that are accessible by the user, the user information being associated with an enterprise user identification.

8. The method of claim 1, where the user device accesses the at least one enterprise server via a SSH protocol connection.

9. The method of claim 1, where the user device accesses the at least one enterprise server via an HTTPS protocol connection.