Credential vault encryption

• US 7,865,943 B2
• Filed: 06/19/2007
• Issued: 01/04/2011
• Est. Priority Date: 09/22/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Vu, Daniel, Hayler, Don L.
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US11/765,303
• Publication Number:
  US 20080077809A1
• Time in Patent Office: 1,295 Days
• Field of Search: 726/6, 713/150, 713/155, 713/168
• US Class Current: 726/6
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A number of secondary passwords can be encrypted with a primary password and stored in a credential vault. An encrypted secondary password from the credential vault can be decrypted using the primary password and provided the secondary password to an application. Encrypted secondary passwords can be updated when the primary password changes.

Claims

1. A method comprising:

receiving a primary password to a reverse proxy system from a user;

encrypting a plurality of secondary passwords with the primary password, each secondary password comprising a password to a separate remote web application accessed by the user through the reverse proxy;

storing the encrypted secondary passwords in a credential vault;

decrypting an encrypted secondary password from the credential vault using the primary password; and

responsive to a request for the user to access one of the remote web applications, providing the secondary password for the remote web application to the remote web application.

2. The method of claim 1, wherein the secondary passwords are encrypted with a function of the primary password.

3. The method of claim 1, wherein the secondary passwords are encrypted with a hash of the primary password.

4. The method of claim 1, further comprising:

encrypting a fixed sting; and

storing the encrypted fixed string in the credential vault.

5. The method of claim 4, further comprising:

decrypting the fixed string to test if the primary password has changed since the secondary passwords and fixed string have been encrypted.

6. The method of claim 5, further comprising:

based upon a comparison of the decrypted fixed string to a known value of the fixed string, determining that the primary password has been changed; and

prompting the user to input a new primary password and the old primary password.

7. The method of claim 6, further comprising:

decrypting the secondary password using the old primary password; and

re-encrypting the secondary password using the new primary password.

8. A non-transitory computer readable medium including code to:

receive a primary password to a reverse proxy system from a user;

encrypt a plurality of secondary passwords with the primary password, each secondary password comprising a password to a separate remote web application accessed by the user through the reverse proxy;

store the encrypted secondary passwords in a credential vault;

decrypt an encrypted secondary password from the credential vault using the primary password; and

responsive to a request for the user to access one of the remote web applications, provide the secondary password for the remote web application to the remote web application.

9. The computer readable medium of claim 8, wherein the secondary passwords are encrypted with a function of the primary password.

10. The computer readable medium of claim 8, wherein the secondary passwords are encrypted with a hash of the primary password.

11. The computer readable medium of claim 8, the code further to:

encrypt a fixed sting; and

store the encrypted fixed string in the credential vault.

12. The computer readable medium of claim 11, the code further to:

decrypt the fixed string to test if the primary password has changed since the secondary passwords and fixed string have been encrypted.

13. The computer readable medium of claim 12, the code further to:

determine, based upon a comparison of the decrypted fixed string to a known value of the fixed string, that the primary password has been changed; and

prompt the user to input a new primary password and the old primary password.

14. The computer readable medium of claim 13, the code further to:

decrypt the secondary password using the old primary password; and

re-encrypt the secondary password using the new primary password.

15. A method comprising:

encrypting a number of secondary passwords with a first primary password;

encrypting a fixed string with the first primary password;

storing the secondary passwords and the encrypted fixed string in a credential vault;

receiving a password for a user;

decrypting the encrypted fixed string with the received password; and

upon determining that the decrypted fixed string does not match the fixed string;

prompting the user to input both the first primary password and a second primary password,

decrypting the secondary passwords with the first primary password, and

re-encrypting the secondary passwords with the second primary password.

16. The method of claim 15, wherein the primary password is a password to a reverse proxy system.

17. The method of claim 15, wherein the secondary passwords are passwords to remote web applications.

18. The method of claim 15, wherein the secondary passwords are encrypted with a function of the primary password.

19. The method of claim 15, wherein the secondary passwords are encrypted with a hash of the primary password.

20. A system comprising:

a reverse proxy server configured to receive a primary password to the reverse proxy system from a user; and

a credential vault in communication with the reverse proxy server, the credential vault configured to;

encrypt a plurality of secondary passwords with the primary password, each secondary password comprising a password to a separate remote web application accessed by the user through the reverse proxy;

store the encrypted secondary passwords in a credential vault;

decrypt an encrypted secondary password from the credential vault using the primary password; and

responsive to a request for the user to access one of the remote web applications, provide the secondary password for the remote web application to the remote web application.

21. The system of claim 20, wherein the secondary passwords are encrypted with a function of the primary password.

22. The system of claim 20, wherein the secondary passwords are encrypted with a hash of the primary password.

23. The system of claim 20, the credential vault further configured to:

encrypt a fixed sting; and

store the encrypted fixed string in the credential vault.

24. The system of claim 23, the credential vault further configured to:

decrypt the fixed string to test if the primary password has changed since the secondary passwords and fixed string have been encrypted.

25. The system of claim 24, the credential vault further configured to:

based upon a comparison of the decrypted fixed string to a known value of the fixed string, determine that the primary password has been changed; and

prompt the user to input a new primary password and the old primary password.

26. The system of claim 25, the credential vault further configured to:

decrypt the secondary password using the old primary password; and

re-encrypt the secondary password using the new primary password.

27. A non-transitory computer readable medium including code to:

encrypt a number of secondary passwords with a first primary password;

encrypt a fixed string with the first primary password;

store the secondary passwords and the encrypted fixed string in a credential vault;

receive a password for a user;

decrypt the encrypted fixed string with the received password; and

upon determining that the decrypted fixed string does not match the fixed string;

prompt the user to input both the first primary password and a second primary password,

decrypting the secondary passwords with the first primary password, and

re-encrypting the secondary passwords with the second primary password.

28. The computer readable medium of claim 27, wherein the primary password is a password to a reverse proxy system.

29. The computer readable medium of claim 27, wherein the secondary passwords are passwords to remote web applications.

30. The computer readable medium of claim 27, wherein the secondary passwords are encrypted with a function of the primary password.

31. The computer readable medium of claim 27, wherein the secondary passwords are encrypted with a hash of the primary password.

32. A system comprising:

an interface configured to receive a password from a user; and

a credential vault in communication with the interface, the credential vault configured to;

encrypt a number of secondary passwords with a first primary password;

encrypt a fixed string with the first primary password;

store the secondary passwords and the encrypted fixed string in the credential vault;

decrypt the encrypted fixed string with the received password; and

upon determining that the decrypted fixed string does not match the fixed string;

prompt the user to input both the first primary password and a second primary password,

decrypt the secondary passwords with the first primary password, and

re-encrypt the secondary passwords with the second primary password.

33. The system of claim 32, wherein the primary password is a password to a reverse proxy system.

34. The system of claim 32, wherein the secondary passwords are passwords to remote web applications.

35. The system of claim 32, wherein the secondary passwords are encrypted with a function of the primary password.

36. The system of claim 32, wherein the secondary passwords are encrypted with a hash of the primary password.