Authorizing administrative operations using a split knowledge protocol

• US 8,190,905 B1
• Filed: 09/29/2006
• Issued: 05/29/2012
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Chang, Lawrence Wen-Hao, Subramanian, Ananthan
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US11/541,024
• Time in Patent Office: 2,069 Days
• Field of Search: 709/229, 380/286, 380/9, 380/862, 380/30, 705/7
• US Class Current: 713/180
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A system and method for authorizing administrative operations in a computer is provided. The computer initiates the split knowledge protocol upon an attempt by an administrator to invoke the operations. The administrator identifies a predetermined number of entities designated to authorize the operation. The computer creates a bit sequence and splits the bit sequence into a number of segments equal to the predetermined number of entities. Each entity thereafter decrypts a respective element to essentially authorize invocation of the operations. In response, the computer processes the decrypted segments to re-create the bit sequence. As an added level of security, the computer coma) pares the re-created bit sequence with the originally created sequence and, if they match, performs the operations.

Claims

1. A method for authorizing an administrative operation on a computer, comprising:

identifying a predetermined number of entities designated to authorize the administrative operation;

generating, by a processor of the computer, a bit sequence;

splitting the bit sequence into a number of segments equal to the predetermined number of entities designated to authorize the administrative operation;

encrypting each of the segments with a key specifically associated with each entity;

decrypting, by each entity, each of the encrypted segments using a detachable storage device associated with that entity to result in individually decrypted segments;

generating a recreated bit sequence from each of the individually decrypted segments received from each entity; and

comparing the recreated bit sequence, that was generated from each of the is individually decrypted segments received from each entity, to the bit sequence where only a match between the recreated bit sequence and the bit sequence authorizes the administrative operation to be performed on the computer.

2. The method of claim 1 wherein each entity is a recovery officer associated with the computer.

3. The method of claim 1 wherein splitting further comprises splitting the bit sequence in a manner that enables generation of the bit sequence by exclusive ORing each of the predetermined number of segments together.

4. The method of claim 1 wherein each detachable storage device is a smart card.

5. The method of claim 4 wherein each smart card is associated with a recovery officer.

6. The method of claim 1 wherein the computer comprises a security appliance.

7. The method of claim 1 further comprising performing the administrative operation.

8. The method of claim 1 wherein each recovery key is encrypted by a recovery domain key for storage in a database on the computer.

9. The method of claim 1 wherein the predetermined number of segments equals a quorum associated with the detachable storage devices.

10. The method of claim 1 further comprising transmitting a request to approve the administrative operation from the computer to an entity.

11. The method of claim 1 further comprising identifying a number of recovery officers approving the administrative operation.

12. The method of claim 11 wherein the predetermined number of segments equal the number of recovery officers approving the administrative operation.

25. The method of claim 4 wherein the smart card is a recovery card.

13. A system configured to authorize an administrative operation, the system comprising:

a computer comprising one or more processors configured to, in response to receiving a request to perform the administrative operation, identify a predetermined number of entities designated to authorize the administrative operation, generate a bit sequence, split the bit sequence into a number of segments equal to the predetermined number of entities, encrypt each of the segments with a key specifically associated with each entity, send each encrypted segment to its associated entity, receive decrypted segments from each entity wherein each entity uses a detachable storage device associated with that entity to perform the decryption to result in individually decrypted segments, generate a recreated bit sequence from the individually decrypted segments, and compare the recreated bit sequence, generated from the individually decrypted segments, to the bit sequence where only a match between the recreated bit sequence and the bit sequence authorizes the administrative operation to be performed.

14. The system of claim 13 wherein the computer comprises a security appliance.

15. The system of claim 14 wherein the request comprises an identification of a number of recovery officers approving of the administrative operation.

16. The system of claim 15 wherein the predetermined number of segments equal the number of recovery officers approving of the administrative operation.

17. The system of claim 16 wherein the administrative operation comprises replacing one of the detachable storage devices.

18. The system of claim 13 wherein the bit sequence may be generated by exclusive ORing each of the segments together.

19. A non-transitory computer readable medium containing executable program instructions executed by a processor, comprising:

program instructions that identify a predetermined number of entities designated to authorize an operation;

program instructions that generate a bit sequence;

program instructions that split the bit sequence into a number of segments equal to the predetermined number of entities;

program instructions that encrypt each of the segments with a key specifically associated with each entity;

program instructions that decrypt, at each entity, each of the encrypted segments using a detachable storage device associated with that entity to result in individually decrypted segments;

program instructions that generate a recreated bit sequence from each of the individually decrypted segments received from each entity; and

is program instructions that compare the recreated bit sequence, generated from each of the individually decrypted segments, to the bit sequence where only a match between the recreated bit sequence and the bit sequence authorizes the operation to be performed on a computer having one or more processors.

20. The computer readable medium of claim 19 wherein the program instructions that split further comprises program instructions that split the bit sequence in a manner that enables generation of the bit sequence by exclusive ORing each of the predetermined number of segments together.

21. A method for authorizing an administrative operation on a computer, the method comprising:

identifying a predetermined number of entities designated to authorize the operation, the predetermined number of entities being designated based on the administrative operation;

generating, by a processor of the computer, a bit sequence;

splitting the bit sequence into a number of segments equal to the predetermined number of entities;

encrypting each of the segments with a key specifically associated with at least one of the entities;

decrypting, by each entity, each of the encrypted segments using a detachable storage device associated with that entity to result in individually decrypted segments; and

re-generating the bit sequence from the individually decrypted segments received from each entity, wherein a match between the re-generated bit sequence, from the individually decrypted segments received from each entity, and the bit sequences authorizes the administrative operation.

22. The method of claim 21 wherein the bit sequence is associated with the administrative operation.

23. The method of claim 22 wherein the administrative operation comprises replacing a first detachable storage device and wherein the bit sequence is associated with an identifier of a second detachable storage device replacing the first detachable storage device.

24. The method of claim 21 wherein the bit sequence may be re-generated by performing one or more logical operations on the segments.