Split password vault

• US 8,819,768 B1
• Filed: 12/30/2011
• Issued: 08/26/2014
• Est. Priority Date: 05/03/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Koeten, Robert, Popp, Nicolas
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US13/341,205
• Time in Patent Office: 970 Days
• Field of Search: 726 1- 3, 726/8, 380/270, 380 44- 45, 713183-185, 713165-167
• US Class Current: 726/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 41/022 Multivendor or multi-standard integration
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/30 Profiles

Abstract

A cloud service access and information gateway receives, from a user device, a request to access a cloud service. The cloud service access and information gateway determines an identity of a user making the request to access the cloud service and compares the identity of the user to a password vault control policy. The cloud service access and information gateway determines, based on the comparing, one or more sections of a split password vault to which the user has access. The split password vault comprises a first section storing a first set of log-in credentials and a second section storing a second set of log-in credentials.

Claims

1. A method, comprising:

receiving, from a user device, a request to access a cloud service;

determining an identity of a user making the request to access the cloud service;

comparing, by a processor, the identity of the user to a password vault control policy; and

determining, based on the comparing, one or more sections of a split password vault to which the user has access, the split password vault comprising a first section storing a first set of log-in credentials and a second section storing a second set of log-in credentials, wherein the user has control over management of the first section of the split password vault and an organization associated with the user has control over management of the second section of the split password vault.

2. The method of claim 1, further comprising:

determining whether log-in credentials for the cloud service are present in the one or more sections of the split password vault to which the user has access; and

if the log-in credentials are present, providing access to the cloud service.

3. The method of claim 1, wherein the user has control over management of the first password section and an organization has control over management of the second password section.

4. The method of claim 1, wherein the first section of the split password vault comprises a personal password section and the second section of the split password vault comprises a corporate password section.

5. The method of claim 1, wherein a cloud service access and information gateway compares the identity of the user to the password vault control policy.

6. The method of claim 5, wherein the cloud service access and information gateway is independent of the user device and the cloud service.

7. The method of claim 1, further comprising:

detecting a change in status of the user; and

severing access to the second section of the split password vault.

8. A system, comprising:

a processor; and

a memory coupled with the processor, the memory storing;

a split password vault storing log-in credentials for a plurality of cloud services, the split password vault comprising a first section storing a first set of log-in credentials and a second section storing a second set of log-in credentials, wherein the user has control over management of the first section of the split password vault and an organization associated with the user has control over management of the second section of the split password vault.

9. The system of claim 8, wherein the processor is configured to:

receive, from a user device, a request to access one of the plurality of cloud services;

determine an identity of a user making the request to access the cloud service;

compare the identity of the user to a password vault control policy; and

determine, based on the comparing, one or more sections of the split password vault to which the user has access.

10. The system of claim 9, wherein the processor is further configured to:

determine whether log-in credentials for the cloud service are present in the one or more sections of the split password vault to which the user has access; and

if the log-in credentials are present, provide access to the cloud service.

11. The system of claim 8, wherein the user has control over management of the first password section and an organization has control over management of the second password section.

12. The system of claim 8, wherein the first section of the split password vault comprises a personal password section and the second section of the split password vault comprises a corporate password section.

13. The system of claim 9, wherein a cloud service access and information gateway compares the identity of the user to the password vault control policy, and wherein the cloud service access and information gateway is independent of the user device and the cloud service.

14. The system of claim 9, wherein the processor is further configured to:

detect a change in status of the user; and

sever access to the second section of the split password vault.

15. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving, from a user device, a request to access a cloud service;

determining an identity of a user making the request to access the cloud service;

comparing, by the processor, the identity of the user to a password vault control policy; and

determining, based on the comparing, one or more sections of a split password vault to which the user has access, the split password vault comprising a first section storing a first set of log-in credentials and a second section storing a second set of log-in credentials, wherein the user has control over management of the first section of the split password vault and an organization associated with the user has control over management of the second section of the split password vault.

16. The non-transitory computer readable storage medium of claim 15, wherein the operations further comprise:

determining whether log-in credentials for the cloud service are present in the one or more sections of the split password vault to which the user has access; and

if the log-in credentials are present, providing access to the cloud service.

17. The non-transitory computer readable storage medium of claim 15, wherein the user has control over management of the first password section and an organization has control over management of the second password section.

18. The non-transitory computer readable storage medium of claim 15, wherein the first section of the split password vault comprises a personal password section and the second section of the split password vault comprises a corporate password section.

19. The non-transitory computer readable storage medium of claim 15, wherein s cloud service access and information gateway compares the identity of the user to the password vault control policy, and wherein the cloud service access and information gateway is independent of the user device and the cloud service.

20. The non-transitory computer readable storage medium of claim 15, wherein the operations further comprise:

detecting a change in status of the user; and

severing access to the second section of the split password vault.