Credential Vault Encryption

• US 20080077809A1
• Filed: 06/19/2007
• Published: 03/27/2008
• Est. Priority Date: 09/22/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Vu, Daniel, Hayler, Don L.
• Granted Patent: US 7,865,943 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A number of secondary passwords can be encrypted with a primary password and stored in a credential vault. An encrypted secondary password from the credential vault can be decrypted using the primary password and provided the secondary password to an application. Encrypted secondary passwords can be updated when the primary password changes.

Claims

1. A method comprising:

encrypting a number of secondary passwords with a primary password;

storing the secondary passwords in a credential vault; and

decrypting an encrypted secondary password from the credential vault using the primary password and providing the secondary password to an application.

2. The method of claim 1, wherein the primary password is a password to a reverse proxy system.

3. The method of claim 1, wherein the secondary passwords are passwords to remote web applications.

4. The method of claim 1, wherein the secondary passwords are encrypted with a function of the primary password.

5. The method of claim 1, wherein the secondary passwords are encrypted with a hash of the primary password.

6. The method of claim 1, wherein a fixed sting is encrypted and stored in the credential vault.

7. The method of claim 5, wherein the fixed string is decrypted to test if the primary password has changed since the secondary passwords and fixed string have been encrypted.

8. The method of claim 6, wherein the user is prompted to input the new and old primary password if the primary password has been changed.

9. The method of claim 7, wherein the secondary password is decrypted using the old primary password and re-encrypted using the new primary password.

10. A computer readable medium including code to:

encrypt a number of secondary passwords with a primary password;

store the secondary passwords in a credential vault; and

decrypt an encrypted secondary password from the credential vault using the primary password and providing the secondary password to an application.

11. The computer-readable medium of claim 10, wherein the secondary passwords are passwords to remote web applications.

12. The computer readable medium of claim 10, wherein, the primary password is a password to a reverse proxy system.

13. The method of claims 10, wherein the secondary passwords are encrypted with a function of the primary password.

14. The computer readable medium of claim 10, wherein the secondary passwords are encrypted with a hash of the primary password.

15. The computer readable medium of claim 10, wherein a fixed string is encrypted and stored in the credential vault.

16. The computer readable medium of claim 14, wherein the fixed string is decrypted to test if the primary password has changed since the secondary passwords and fixed string have been encrypted.

17. The computer readable medium of claim 15, wherein the user is prompted to input the new and old primary password if the primary password has been changed.

18. The computer readable medium of claim 15, wherein the secondary password is decrypted using the old primary password and re-encrypted using the new primary password.

19. A method comprising:

encrypting a number of secondary passwords with a primary password;

encrypting a fixed string with the primary password;

storing the secondary passwords and encrypted fixed string in a credential vault; and

receiving a password for user;

using the received password to decrypt the encrypted fixed string;

if the decrypted fixed string does not match the fixed string, prompting a user to input both new and old primary passwords, decrypting the secondary passwords with the old primary password and then re-encrypting the secondary passwords with the new primary password.

20. The method of claim 19, wherein the primary password is a password to a reverse proxy system.

21. The method of claim 19, wherein the secondary passwords are passwords to remote web applications.

22. The method of claim 19, wherein the secondary passwords are encrypted with a function of the primary password.

23. The method of claim 19, wherein the secondary passwords are encrypted with a hash of the primary password.