Remote authorization for operations

• US 20070234406A1
• Filed: 03/29/2006
• Published: 10/04/2007
• Est. Priority Date: 03/29/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Carter, Stephen, Burch, Lloyd
• Granted Patent: US 7,810,139 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Techniques for the remote authorization of secure operations are provided. A secure security system restricts access to a secure operation via an access key. An authorization acquisition service obtains the access key on request from the secure security system when an attempt is made to initiate the secure operation. The authorization acquisition service gains access the access key from a secure store via a secret. That is, the secret store is accessible via the secret. The secret is obtained directly or indirectly from a remote authorization principal over a network.

Claims

1. A method, comprising:

receiving a request for authorization to initiate an operation of a security system;

notifying a remote authorization principal of the request;

obtaining a secret in response to the notification;

acquiring an access key in response to the secret; and

submitting the access key to the security system to initiate the operation.

2. The method of claim 1, wherein obtaining further includes receiving the secret as the access key.

3. The method of claim 1, wherein notifying further includes at least one of:

transmitting the request as a text message to a communication device of the remote authorization principal;

transmitting the request as an electronic mail message to a mail account associated with the remote authorization principal;

transmitting the request as an event to a secure World-Wide Web (WWW) service that then uses another mechanism to contact and notify the remote authorization principal; and

transmitting the request as a voice message to communication device of the remote authorization principal.

4. The method of claim 1, wherein notifying further includes identifying for the remote authorization principal with the request notification a mechanism by which the remote authorization principal may obtain the secret using credentials of the remote authorization principal

5. The method of claim 1, wherein obtaining further includes at least one of:

receiving the secret from a secure World-Wide Web (WWW) service activated by the remote authorization principal;

receiving the secret as touch tone codes from a communication device of the remote authorization principal;

receiving the secret as a text message submitted by the remote authorization principal from the communication device;

receiving the secret as a voice instruction from the remote authorization principal with the communication device; and

receiving the secret from the communication device identified with a unique device identifier upon instruction to do so by the remote authorization principal.

6. The method of claim 1, wherein obtaining further includes receiving the secret as a randomly and time sensitive secret from the remote authorization principal after the remote authorization principal access at least one of a device and a service to acquire the secret in response to the notification.

7. The method of claim 1 further comprising:

notifying one or more additional remote authorization principals of the request;

obtaining one or more additional secrets from the one or more additional remote authorization principals;

acquiring one or more additional access keys in response to the one or more additional secrets; and

submitting the one or more additional access keys to the security system to finalize the initiation of the operation.

8. The method of claim 7, wherein obtaining one or more additional secrets further include receiving the one or more additional secrets as the acquired one or more additional access keys.

9. The method of claim 1 further comprising:

notifying one or more additional remote authorization principals of the request;

obtaining one or more additional secrets from the one or more additional remote authorization principals;

using the one or more additional secrets as additional information used for purposes of acquiring the access key.

10. The method of claim 1 further comprising, resolving at least one of a notification mechanism and an acquisition access key mechanism in response to one or more policies.

11. A method, comprising:

receiving a request for a secret from a remote authorization acquisition service, wherein the secret is used to initiate an operation with a security system;

acquiring the secret from one or more sources; and

causing the secret to be communicated to the remote authorization acquisition service.

12. The method of claim 11, wherein receiving further includes identifying the one or more sources or identifying techniques to be used with the one or more sources from instructions that are included with the request.

13. The method of claim 11, wherein receiving further includes receiving the request via at least one of an event notification from a service activated by the remote authorization acquisition service, a text message sent from the remote authorization acquisition service, an email message sent from the remote authorization acquisition service, and a voice message sent from the remote authorization acquisition service.

14. The method of claim 11, wherein acquiring further includes interfacing a device having the secret to a network to acquire the secret.

15. The method of claim 11, wherein acquiring further includes accessing a random secret generation device or service to acquire the secret.

16. The method of claim 11 further comprising, processing the method on a voice-enabled communication device that interacts with an authorization principal.

17. A method, comprising:

detecting a request for initiating a secure operation;

evaluating a policy associated with authorizing the secure operation for initiation; and

making a request to an authorization acquisition service to acquire one or more access keys pursuant to the policy from one or more remote authorization principals.

18. The method of claim 17 further comprising, receiving and verifying the one more access keys, which are received from the authorization acquisition service in response to one or more secrets obtained from the one or more remote authorization principals.

19. The method of claim 17, wherein making further includes supplying one or more identifiers for the one or more access keys or supplying a procedure for acquiring the one or more access keys with the request to the authorization acquisition service.

20. The method of claim 17 further comprising, periodically synchronizing with a secret store to ensure the secret store has the one or more access keys, and wherein the secret store is accessed by the authorization acquisition service in response to one or more secrets obtained from the one or more remote authorization principals.

21. The method of claim 17 further comprising, supplying the one or more access keys successfully received from the authorization acquisition service to a secure loader, wherein the secure loader initiates the secure operation.

22. A system, comprising:

a secret store; and

an authorization acquisition service, wherein the secret store is to include one or more access keys used by a security system to initiate a secure operation, and wherein the authorization acquisition service is to access the secret store to acquire the one or more access keys in response to one or more secrets obtained from one or more remote authorization principals.

23. The system of claim 22, wherein the authorization acquisition service is to contact the one or more remote authorization principals via phones operated by the one or more remote authorization principals.

24. The system of claim 22, wherein the authorization acquisition service is to receive the one or more secrets directly from the one or more remote authorization principals or indirectly from devices or services activated by the one or more remote authorization principals.

25. The system of claim 22, wherein the one or more access keys are periodically and randomly changed within the secret store.

26. The system of claim 25, wherein the one or more access keys are regularly synchronized with the security system.

27. The system of claim 22, wherein the one or more secrets to be used to access the secret store are periodically and randomly changed.

28. The system of claim 22, wherein the one or more secrets are regularly synchronized with devices or services associated with the one or more remote authorization principals.