SYSTEM AND METHOD FOR KEY RECOVERY

• US 20060242415A1
• Filed: 05/06/2005
• Published: 10/26/2006
• Est. Priority Date: 04/22/2005
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Gaylor, Timothy R.
• Granted Patent: US 7,831,833 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A secure mechanism for transparent key recovery for a user who has changed authentication information is disclosed. A password manager agent intercepts requests by a user to access secure resources that require user credentials. Upon detecting changed authentication information for the user, the password manager agent automatically regenerates the components of a cryptographic key associated with the user that was previously used to encrypt user credentials for the user and then destroyed. After regeneration of the original cryptographic key, the password manager agent uses the key to decrypt the user credentials necessary for the requested application. The regenerated key is then destroyed and the user credentials are re-encrypted by the password manager agent using a new cryptographic key associated with the user made up of multiple components. Following the re-encryption of the user credentials, the components used to assemble the new key are securely stored in multiple locations and the new key is destroyed.

Claims

1. A method of providing access to a resource, comprising:

receiving a first authenticator for a user;

encrypting using a first key, in response to receipt of the first authenticator, a user credential required for access to at least one resource;

destroying the first key;

receiving, subsequent to the destruction of the first key, a second authenticator used to authenticate the user;

receiving a request from the user to access the at least one resource;

regenerating the first key following validation of the identity of the user;

decrypting the encrypted user credential using the regenerated first key;

providing the decrypted user credential to the at least one resource;

encrypting the user credential using a second key created following the receipt of the second authenticator; and

destroying the second key.

2. The method of claim 1, further comprising:

wherein the first authenticator and the second authenticator are at least one of the group of user-supplied domain passwords, tokens, or smart cards, biometrics, SAML assertions and assertions.

3. The method of claim 1, comprising the further step of:

receiving a third authenticator from a user prior to the regeneration of the first key.

4. The method of claim 1, comprising the further step of:

receiving a third authenticator from an administrator prior to the regeneration of the first key.

5. The method of claim 1, comprising the further step of:

receiving a third authenticator from a user; and

receiving a fourth authenticator from an administrator, the third authenticator and the fourth authenticator received prior to the regeneration of the first key.

6. The method of claim 1 wherein the first key used to encrypt the user credential is generated from a plurality of components which are stored in separate locations prior to the first key being regenerated.

7. The method of claim 6 wherein at least some of the components stored in separate locations are retrieved and used to regenerate the first key following the validation of the identity of the user.

8. The method of claim 1, further comprising:

destroying the regenerated first key after using the first key to decrypt the encrypted user credential.

9. The method of claim 1 wherein the first key is used to encrypt an authentication key which is used to encrypt the user credential.

10. The method of claim 9 wherein the authentication key is used to encrypt a credential key which is used to encrypt the user credential.

11. The method of claim 1 wherein the first key is created using a plurality of cryptographically strong random numbers generated from a first source.

13. The method of claim 11 wherein at least two of the plurality of cryptographically strong random numbers are combined and hashed as part of the creation of the key.

15. The method of claim 1 wherein the resource is an application.

12. The method of claim 111 wherein the key is created using a cryptographically strong random number generated from a second source.

14. The method of claim 111 wherein at least one of the plurality of cryptographically strong random numbers used to create the key is encrypted prior to being stored in a separate location from the rest of the plurality of cryptographically strong random numbers.

16. A system for providing secure access to a resource, comprising:

a password management agent, the password manager agent detecting a user request to access a secure resource from a user and determining the authenticator associated with the user has changed subsequent to the encryption of a user credential required to access the requested secure resource;

a first key used to encrypt the user credential required to access the requested secure resource, the first key generated from a plurality of cryptographically strong components, destroyed after encrypting the user credential, and regenerated following the detection by the password manager agent of the user request; and

a second key used to encrypt the user credential subsequent to the decryption of the user credential using the regenerated key, the second key generated from a plurality of cryptographically strong components and destroyed after encrypting the user credential.

17. The system of claim 16 wherein the secure resource is an application.

18. The system of claim 16 wherein the plurality of cryptographically strong components are cryptographically strong random numbers generated by at least two separate processes.

19. The system of claim 18 wherein at least two of the plurality of cryptographically strong random numbers are stored on physically separate devices following the generation of the first and second key.

20. The system of claim 18 wherein at least two of the plurality of cryptographically strong random numbers are stored on logically separate devices following the generation of the first and second key.

21. The system of claim 18 wherein at least two of the plurality of cryptographically strong random numbers are combined and hashed and a result of the hash is used to generate the first or second encryption key.

22. The system of claim 16 wherein at least part of the first or second authenticator is used to generate the first or second encryption key.

23. An article of manufacture having embodied thereon computer-readable program means for providing access to a secure resource, the article of manufacture comprising:

computer-readable program means for receiving a first authenticator for a user;

computer-readable program means for encrypting using a first key, in response to receipt of the first authenticator, a user credential required for access to at least one resource;

computer-readable program means for destroying the first key;

computer-readable program means for receiving, subsequent to the destruction of the first key, a second authenticator used to authenticate the user;

computer-readable program means for receiving a request from the user to access the at least one resource;

computer-readable program means for regenerating the first key following validation of the identity of the user;

computer-readable program means for decrypting the encrypted user credential using the regenerated first key;

computer-readable program means for providing the decrypted user credential to the at least one resource;

computer-readable program means for encrypting the user credential using a second key created following the receipt of the second authenticator; and

computer-readable program means for destroying the second key.

24. The article of manufacture of claim 23 wherein the first authenticator and the second authenticator are at least one of the group of user-supplied domain passwords, tokens, or smart cards, biometrics, SAML assertions and assertions.

25. The article of manufacture of claim 23, comprising further:

computer-readable program means for receiving a third authenticator from a user prior to the regeneration of the first key.

26. The article of manufacture of claim 23, comprising further:

computer-readable program means for receiving a third authenticator from an administrator prior to the regeneration of the first key.

27. The article of manufacture of claim 23, comprising further:

computer-readable program means for receiving a third authenticator from a user; and

computer-readable program means for receiving a fourth authenticator from an administrator, the third authenticator and the fourth authenticator received prior to the regeneration of the first key.

28. The article of manufacture of claim 23 wherein the first key used to encrypt the user credential is generated from a plurality of components which are stored in separate locations prior to the first key being regenerated.

29. The article of manufacture of claim 28 wherein at least some of the components stored in separate locations are retrieved and used to regenerate the first key following the validation of the identity of the user.

30. The article of manufacture of claim 23 wherein the first key is created using a plurality of cryptographically strong random numbers generated from a first source.

31. The article of manufacture of claim 23 wherein the key is created using a cryptographically strong random number generated from a second source.

32. The article of manufacture of claim 30 wherein at least two of the plurality of cryptographically strong random numbers are combined and hashed as part of the creation of the key.

33. A method of providing access to a secure resource over a network, comprising:

providing a user credential associated with a user, the user credential encrypted using a first key and associated with the user following a first authentication of the user to the network using a first authenticator, the first key destroyed following the encryption of the user credential;

receiving, subsequent to the first authentication, a request from the user to access a secure resource, the secure resource requiring the encrypted user credential;

determining that the request for the secure resource originated from the user following a second authentication of the user to the network using a second authenticator;

regenerating, automatically without additional user input, the first key, following validation of the identity of the user;

decrypting the encrypted user credential using the regenerated first key;

providing the decrypted user credential to the secure resource; and

encrypting the user credential using a second key created following the receipt of the second authenticator, the second key destroyed following the encryption.