SECURE AND AUTOMATED CREDENTIAL INFORMATION TRANSFER MECHANISM

• US 20140380441A1
• Filed: 09/10/2014
• Published: 12/25/2014
• Est. Priority Date: 02/05/2010
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services Limited (Accenture PLC)
• Inventors: Stauth, Sean, Wee, Sewook
• Granted Patent: US 9,276,926 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

A mechanism for securely transmitting credentials to instantiated virtual machines is provided. A central server is used to turn on a virtual machine. When the virtual machine is turned on, the central server sends it a secret text string. The virtual machine requests the credentials from the central server by transmitting the secret string and its instance ID. The central server validates the secret string and source IP to determine whether they are authentic. Once verified, the central server transmits the credentials to the virtual machine in a secure channel and invalidates the secret string. The credentials can now be used to authenticate API calls.

Claims

1. (canceled)

2. A computer-implemented method comprising:

generating, by a central server that has access to credential information, a one-time-use password;

transmitting, by the central server, an instruction to a remote server to activate an application instance, the instruction including the one-time-use password;

receiving, by the central server and from the remote server, a request for the credential information, the request including at least (i) the one-time-use password, and (ii) an unique identifier associated with the application instance;

validating, by the central server, (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request;

in response to validating (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request, invalidating, by the central server, the one-time-use password; and

transmitting, by the central server a secure message that creates a file that includes the credential information in a secure location on the remote server.

3. The method of claim 2, wherein validating, by the central server, (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request comprises:

determining that the one-time-use password matches the unique identifier.

4. The method of claim 2, wherein the request is received over a Hypertext Transfer Protocol connection.

5. The method of claim 2, comprising:

determining, by the central server and based at least on a programmed policy, to activate the application instance on the remote server,

where generating, by a central server that has access to credential information, a one-time-use password is in response to determining, by the central server and based at least on a programmed policy, to activate the application instance on the remote server.

6. The method of claim 2, wherein the credential information enables the remote server to activate the application instance.

7. The method of claim 2, wherein the credential information comprises one or more of a secret access key or an access key identifier.

8. The method of claim 2, wherein the secure message comprises a message provided over a Secure Sockets Layer connection.

9. The method of claim 2, comprising:

generating, by the central server that has access to credential information, another one-time-use password;

transmitting, by the central server, another instruction to another remote server to activate another application instance, the other instruction including the other one-time-use password;

receiving, by the central server and from the other remote server, another request for the credential information, the other request including at least (i) the other one-time-use password, and (ii) another unique identifier associated with the application instance;

validating, by the central server, (i) the other one-time-use password that is included in the other received request, and (ii) the other unique identifier that is included in the other received request;

in response to validating (i) the other one-time-use password that is included in the other received request, and (ii) the other unique identifier that is included in the other received request, invalidating, by the central server, the other one-time-use password; and

transmitting, by the central server another secure message that creates another file that includes the other credential information in another secure location on the remote server.

10. A system comprising:

one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising;

generating, by a central server that has access to credential information, a one-time-use password;

transmitting, by the central server, an instruction to a remote server to activate an application instance, the instruction including the one-time-use password;

receiving, by the central server and from the remote server, a request for the credential information, the request including at least (i) the one-time-use password, and (ii) an unique identifier associated with the application instance;

validating, by the central server, (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request;

in response to validating (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request, invalidating, by the central server, the one-time-use password; and

transmitting, by the central server a secure message that creates a file that includes the credential information in a secure location on the remote server.

11. The system of claim 10, wherein validating, by the central server, (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request comprises:

determining that the one-time-use password matches the unique identifier.

12. The system of claim 10, wherein the request is received over a Hypertext Transfer Protocol connection.

13. The system of claim 10, comprising:

determining, by the central server and based at least on a programmed policy, to activate the application instance on the remote server,

where generating, by a central server that has access to credential information, a one-time-use password is in response to determining, by the central server and based at least on a programmed policy, to activate the application instance on the remote server.

14. The system of claim 10, wherein the credential information enables the remote server to activate the application instance.

15. The system of claim 10, wherein the credential information comprises one or more of a secret access key or an access key identifier.

16. The system of claim 10, wherein the secure message comprises a message provided over a Secure Sockets Layer connection.

17. The system of claim 10, comprising:

generating, by the central server that has access to credential information, another one-time-use password;

transmitting, by the central server, another instruction to another remote server to activate another application instance, the other instruction including the other one-time-use password;

receiving, by the central server and from the other remote server, another request for the credential information, the other request including at least (i) the other one-time-use password, and (ii) another unique identifier associated with the application instance;

validating, by the central server, (i) the other one-time-use password that is included in the other received request, and (ii) the other unique identifier that is included in the other received request;

in response to validating (i) the other one-time-use password that is included in the other received request, and (ii) the other unique identifier that is included in the other received request, invalidating, by the central server, the other one-time-use password; and

transmitting, by the central server another secure message that creates another file that includes the other credential information in another secure location on the remote server.

18. A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

generating, by a central server that has access to credential information, a one-time-use password;

transmitting, by the central server, an instruction to a remote server to activate an application instance, the instruction including the one-time-use password;

receiving, by the central server and from the remote server, a request for the credential information, the request including at least (i) the one-time-use password, and (ii) an unique identifier associated with the application instance;

validating, by the central server, (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request;

in response to validating (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request, invalidating, by the central server, the one-time-use password; and

transmitting, by the central server a secure message that creates a file that includes the credential information in a secure location on the remote server.

19. The medium of claim 18, wherein validating, by the central server, (i) the one-time-use password that is included in the received request, and (ii) the unique identifier that is included in the received request comprises:

determining that the one-time-use password matches the unique identifier.

20. The medium of claim 18, comprising:

determining, by the central server and based at least on a programmed policy, to activate the application instance on the remote server,

where generating, by a central server that has access to credential information, a one-time-use password is in response to determining, by the central server and based at least on a programmed policy, to activate the application instance on the remote server.

21. The medium of claim 18, wherein the credential information enables the remote server to activate the application instance.