Setuid-filter method for providing secure access to a credentials store for computer systems

• US 20050166048A1
• Filed: 01/28/2004
• Published: 07/28/2005
• Est. Priority Date: 01/28/2004
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Magennis, Gerard, Buchendorfer, Thomas
• Granted Patent: US 7,392,386 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

A method that provides access to Privileged Accounts to users by way of a two-way-encrypted credential store. In accordance with this invention, a process that needs to retrieve credentials for a third party system causes the operating system to launch a second process. This second process runs under a secured user id without interactive access. The requesting process can then pass generalized command streams to the second process, including tokenized credential retrieval requests. These tokenized credential retrieval requests are processed to authenticate the requests, perform audit logging of requests and retrieval of credentials. Tokenized credential requests transformed by the second process into credentials, which can be embedded within a command stream and then either forwarded to a sub-process or returned to the requesting process.

Claims

1. A method for use in a computer system that effects secure access to a store comprising:

providing said store with an exclusive user id;

initiating a process responsive to a store access request;

changing a context of the process to the user id of said store;

communicating between said process and said store via private communications channels; and

obtaining data responsive to said store access request.

2. A method in accordance with claim 1 further comprising:

sending the data responsive to said store access request to a downstream process.

3. A method in accordance with claim 1 further comprising:

logging said store access request.

4. A method in accordance with claim 3 wherein sending the data responsive to said store access request to a downstream process further comprises never sending the data to the requestor.

5. A method in accordance with claim 1 wherein said computer system employs the UNIX operating system and wherein said context changing comprises invoking the UNIX set user id facility.

6. A computer system comprising:

a data store having an exclusive user id in the computer system;

a system for providing secure access to said data store, said system being configured to be responsive to a request for access to said data store by changing its user id to the exclusive user id; and

private communications channels between said system and said data store for communicating and responding to requests for data.

7. A computer system according to claim 6 wherein the system for providing secure access is further configured to provide data from said data store to a downstream process.

8. A computer system according to claim 6 wherein the system for providing secure access is further configured to log requests for access to said data store.