Robotic process automation system and method with secure credential vault

• US 10,733,329 B1
• Filed: 04/20/2018
• Issued: 08/04/2020
• Est. Priority Date: 04/20/2018
• Status: Active Grant

• Current Assignee: Automation Anywhere, Inc.
• Original Assignee: Automation Anywhere, Inc.
• Inventors: Ragupathy, Badrinath, Abdul Razack, Rajaa Mohamad, Kakhandiki, Abhijit
• Primary Examiner(s): Murphy, J. Brant
• Application Number:
  US15/957,917
• Time in Patent Office: 837 Days
• CPC Class Codes: B25J 13/06 Control stands, e.g. consoles, switchboards
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

A robotic process automation system with improved security in the form of a credential vault includes data storage for storing bots. The data storage also stores credentials in encrypted form where the credentials are not associated with any of the plurality of bots. The credentials include standard credentials and user specific credentials. A processor is operatively coupled to the data storage and is configured to execute instructions that when executed cause the processor to provide to an administrator a control console. The instructions implement a standard credential generator and a user specific credential generator, to generate a user specific credential template useable by a user to enter credentials specific to the user. The instructions also implement a configurable locker that is stored in encrypted form in the data storage to associate a set of users as a group and to provide selected standard credentials to the group.

Claims

1. A computer implemented method for robotic process automation comprising:

managing by a control room server a plurality of stored bots, each bot comprising a set of encoded instructions to perform user level interaction with an application program;

the control room server useable by authorized users and operating to

permit creation of standard credentials useable by any authorized user, and user specific credential templates useable by a user to enter credentials specific to the user;

cause deployment of selected bots, each selected bot deployed to a bot runner that executes on a computing device; and

manage a credential vault that operates to securely store credentials in encrypted form and provide the credentials to the bot runners as requested by the bot runners,

wherein the credential vault is configurable to comprise a plurality of lockers, each locker operable by a privileged user, to associate a set of users as a group and to provide selected standard credentials to the group.

2. The computer implemented method of claim 1 wherein the credentials are transferred from data storage to volatile memory in encrypted form and are decrypted and stored in the volatile memory in unencrypted form and are erased from the volatile memory when use by a bot runner that executes on a computing device is complete.

3. The computer implemented method of claim 1 wherein the credential vault further comprises a configurable locker that has associated therewith one or more privileges, wherein the privileges can be modified only by users possessing appropriate privileges.

4. The computer implemented method of claim 3 wherein users may be assigned one or more roles and wherein the configurable locker associates privileges for a user with a role of the user.

5. The robotic process automation system of claim 1 wherein installation of the control room server causes generation of:

a master key usable by the administrator to unlock the credential vault;

a public key employed in conjunction with the master key to unlock the credential vault; and

a data encryption key, that is encrypted with the master key, and used to encrypt credentials upon storage and retrieval.

6. The robotic process automation system of claim 5 wherein the master key is erased from memory upon initiation of the control room server.

7. The robotic process automation system of claim 5 wherein the data encryption key remains in the credential vault during encryption and decryption of credentials.

8. A robotic process automation system comprising:

data storage for storing,

a plurality of bots, each bot comprising one or more configurable commands arranged to perform assigned tasks to interact with one or more user level applications,

credentials in encrypted form and not associated with any of the plurality of bots, the credentials comprising standard credentials and user specific credentials; and

a processor operatively coupled to the data storage and configured to execute instructions that when executed cause the processor to provide to an administrator a control console, the instructions implementing;

a standard credential generator, operable by a privileged user by way of a control console, to generate a set of standard credentials associated with and useable by any authorized user;

a user specific credential generator, operable by the privileged user by way of the control console, to generate a user specific credential template useable by a user to enter credentials specific to the user;

a configurable locker, stored in encrypted form in the data storage, operable by the privileged user, to associate a set of users as a group and to provide selected standard credentials to the group; and

wherein a bot deployed by a user of the group obtains standard credentials assigned to the group and user specific credentials of the user of the group that deploys the bot.

9. The robotic process automation system of claim 8 wherein the credentials are transferred from the data storage to volatile memory in encrypted form and are decrypted and stored in the volatile memory in unencrypted form and are erased from the volatile memory when use by a requesting bot is complete.

10. The robotic process automation system of claim 8 wherein the configurable locker has associated therewith one or more privileges, wherein the privileges can be modified only by users possessing appropriate privileges.

11. The robotic process automation system of claim 10 wherein users may be assigned one or more roles and wherein the configurable locker associates privileges for a user with a role of the user.

12. The robotic process automation system of claim 8 wherein installation of the control console causes generation of:

a master key usable by the administrator to unlock the configurable locker;

a public key employed in conjunction with the master key to unlock the configurable locker; and

a data encryption key, that is encrypted with the master key, and used to encrypt credentials upon storage and retrieval.

13. The robotic process automation system of claim 12 wherein the master key is erased from memory upon initiation of the control console.

14. The robotic process automation system of claim 12 wherein the data encryption key remains in the configurable locker during encryption and decryption of credentials.

15. A tangible storage medium, having stored thereupon one or more program modules comprising computer-executable instructions for execution on a computer system, the computer-executable instructions executing on a server processor to cause the computer system to implement a robotic process automation system by:

operating with data storage to store,

a plurality of bots, each bot comprising one or more configurable commands arranged to perform assigned tasks to interact with one or more user level applications,

credentials in encrypted form and not associated with any of the plurality of bots, the credentials comprising standard credentials and user specific credentials; and

providing to an administrator a control console, the computer-executable instructions implementing;

a standard credential generator, operable by an administrator by way of the control console, to generate a set of standard credentials associated and useable by any authorized user;

a user specific credential generator, operable by the administrator by way of the control console, to generate a user specific credential template useable by a user to enter credentials specific to the user;

a configurable locker, stored in encrypted form in the data storage, operable by the administrator and the user, to associate a set of users as a group and to provide selected standard credentials to the group; and

wherein a bot deployed by a user of the group obtains standard credentials assigned to the group and user specific credentials of the user of the group that deploys the bot.

16. The tangible storage medium of claim 15 wherein the credentials are transferred from data storage to volatile memory in encrypted form and are decrypted and stored in the volatile memory in unencrypted form and are erased from the volatile memory when use by a bot is complete.

17. The tangible storage medium of claim 15 wherein the configurable locker has associated therewith one or more privileges, wherein the privileges can be modified only by users possessing appropriate privileges.

18. The tangible storage medium of claim 17 wherein users may be assigned one or more roles and wherein the configurable locker associates privileges for a user with a role of the user.

19. The robotic process automation system of claim 15 wherein installation of the control console causes generation of:

a master key usable by the administrator to unlock the configurable locker;

a public key employed in conjunction with the master key to unlock the configurable locker; and

a data encryption key, that is encrypted with the master key, and used to encrypt credentials upon storage and retrieval.

20. The robotic process automation system of claim 19 wherein the master key is erased from memory upon initiation of the control console and wherein the data encryption key remains in the configurable locker during encryption and decryption of credentials.