Establishing secure, mutually authenticated communication credentials
First Claim
1. A method for automatically updating credential information between a trusted server residing on a trusted network and an edge server residing on a perimeter network outside the trusted network, at least one server in the trusted network administering a distributed directory service, said method comprising:
- reading, by the trusted server, current credential information associated with the edge server residing on the perimeter network outside the trusted network, wherein the credential information includes a public key created by the edge server and a password created by the edge server, said public key and said password being associated with the edge server;
determining, by the trusted server, an expiration status of the current credential information associated with the edge server;
storing replacement credential information in an edge configuration object in the distributed directory service when a replacement criteria is met, said replacement credential information including a replacement password created by and associated with the edge server, said replacement password being encrypted;
propagating, by any trusted server in the trusted network, the replacement credential information stored in the edge configuration object from the distributed directory service to the edge server in the perimeter network, wherein said trusted server secures the authenticity of the replacement credential information by digitally signing the credential information with a private key created by and associated with said trusted server;
verifying, at the edge server, that the replacement credential information received from the propagating trusted server has been digitally signed by said propagating trusted server, whereby the replacement credential information is rejected when said verifying fails; and
utilizing, by the trusted server, the replacement credential information when an attempt to utilize the current credential information fails.
2 Assignments
0 Petitions
Accused Products
Abstract
Establishing secure, mutually authenticated communication between a trusted network and a perimeter network. Servers on the perimeter network may be securely and automatically configured to communicate with the trusted network. Servers not functioning properly may be stopped from communicating with the other servers. Credential information relating to a perimeter server may be automatically, and regularly, updated without intervention.
-
Citations
20 Claims
-
1. A method for automatically updating credential information between a trusted server residing on a trusted network and an edge server residing on a perimeter network outside the trusted network, at least one server in the trusted network administering a distributed directory service, said method comprising:
-
reading, by the trusted server, current credential information associated with the edge server residing on the perimeter network outside the trusted network, wherein the credential information includes a public key created by the edge server and a password created by the edge server, said public key and said password being associated with the edge server; determining, by the trusted server, an expiration status of the current credential information associated with the edge server; storing replacement credential information in an edge configuration object in the distributed directory service when a replacement criteria is met, said replacement credential information including a replacement password created by and associated with the edge server, said replacement password being encrypted; propagating, by any trusted server in the trusted network, the replacement credential information stored in the edge configuration object from the distributed directory service to the edge server in the perimeter network, wherein said trusted server secures the authenticity of the replacement credential information by digitally signing the credential information with a private key created by and associated with said trusted server; verifying, at the edge server, that the replacement credential information received from the propagating trusted server has been digitally signed by said propagating trusted server, whereby the replacement credential information is rejected when said verifying fails; and utilizing, by the trusted server, the replacement credential information when an attempt to utilize the current credential information fails. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A system for automatically updating credential information between a trusted server residing on a trusted network and an edge server residing on a perimeter network outside the trusted network, at least one server in the trusted network administering a distributed directory service, said system comprising:
-
a distributed directory service for storing information used to secure communication between the trusted servers of the trusted network and the edge server; and one or more processors configured to execute computer-executable instructions for; reading, by the trusted server, current credential information associated with the edge server residing on the perimeter network outside the trusted network, wherein the credential information includes a public key created by the edge server and a password created by the edge server, said public key and said password being associated with the edge server; determining, by the trusted server, an expiration status of the current credential information associated with the edge server; storing replacement credential information in an edge configuration object in the distributed directory service when a replacement criteria is met, said replacement credential information including a replacement password created by and associated with the edge server, said replacement password being encrypted; propagating, by any trusted server in the trusted network, the replacement credential information stored in the edge configuration object from the distributed directory service to the edge server in the perimeter network, wherein said trusted server secures the authenticity of the replacement credential information by digitally signing the credential information with a private key created by and associated with said trusted server; verifying, at the edge server, that the replacement credential information received from the propagating trusted server has been digitally signed by said propagating trusted server, whereby the replacement credential information is rejected when said verifying fails; and utilizing, by the trusted server, the replacement credential information when an attempt to utilize the current credential information fails. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A method for disenfranchising a server computing device residing on a trusted network or a perimeter network from communication with other server computing devices on the trusted network or the perimeter network, said trusted network administering a distributed directory service on one or more domain controller computing devices, said distributing directory service comprising credential information corresponding to each of the server computing devices on the trusted network and the perimeter network, said method comprising:
-
receiving instructions at the one or more domain controller computing devices from an administrator from within the trusted network instructing that one of the server computing devices requires disenfranchisement from communicating with the other server computing devices, wherein said receiving instructions includes receiving an indication that the server computing device requiring disenfranchisement poses a security risk; and deleting credential information associated with the server computing device requiring disenfranchisement within the distributed directory service on the one or more domain controller computing devices based on the received instructions, wherein said deleting comprises deleting a configuration object associated with the server computing device within the distributed directory service, thereby eliminating the ability of any server computing device on the trusted network or the perimeter network to establish communication with the server with deleted credential information.
-
Specification