Coordinating credentials across disparate credential stores

• US 20090049531A1
• Filed: 08/17/2007
• Published: 02/19/2009
• Est. Priority Date: 08/17/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Ford, Karl E., Norman, James M., Mashayekhi, Cameron
• Granted Patent: US 8,196,191 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

Apparatus and methods are described for coordinating user credentials across multiple disparate credential stores. A synchronizing engine requests and receives past and present credential information from the disparate credential stores. Users indicate which, if any, of the credential information they desire to synch together. Upon common formatting of the credential information, comparisons reveal whether differences exist between the past and present versions. If differences exist, the information is updated. In this manner, users link together various passwords, keys or other secrets to maintain convenience from a single point of control, such as in a single-sign-on (SSO) environment, regardless of the disparateness of the stores. The reverse is also possible such that linked credentials are accessible from the multiple stores. Retrofitting existing SSO services is another feature as are computer program products and computing network interaction. User or enterprise policies are also used in governing these credentials.

Claims

1. In a computing system environment, a method of coordinating user credentials across multiple disparate credential stores, comprising:

determining credential information for at least two of said multiple disparate credential stores;

commonly formatting said credential information;

of the commonly formatted said credential information, indicating various user credentials for synchronizing;

determining updated credential information for the at least two of said multiple disparate credential stores;

commonly formatting said updated credential information; and

if the updated credential information and the credential information differ, updating the various user credentials.

2. The method of claim 1, further including comparing a first hash of the commonly formatted said credential information to a second hash of the commonly formatted said updated credential information when determining said differences.

3. The method of claim 2, further including storing the first hash or second hash in a shadow file.

4. The method of claim 1, wherein the indicating various user credentials for synchronizing further includes symbolically linking two or more passwords together, the passwords being associated with the at least two of said multiple disparate credential stores.

5. The method of claim 1, further including establishing a policy for when the determining updated credential information for the at least two of said multiple disparate credential stores occurs.

6. The method of claim 1, further including retrofitting an existing single-sign-on service with a synchronizing engine to manage the updating.

7. The method of claim 1, further including indicating various user credentials for no-synchronizing.

8. The method of claim 1, wherein the updating the various user credentials further includes synchronizing a first password of a first of the at least two of said multiple disparate credential stores to a second password of a second of the at least two of said multiple disparate credential stores.

9. In a computing system environment, a method of coordinating user credentials across multiple disparate credential stores, comprising:

requesting credential information for at least two of said multiple disparate credential stores;

receiving the requested credential information through a common interface and in a common format;

computing a first hash for the received credential information;

requesting updated credential information for the at least two of said multiple disparate credential stores;

receiving the updated credential information through the common interface and in the common format;

computing a second hash for the received updated credential information; and

if the second hash does not match the first hash, updating various user credentials.

10. The method of claim 9, wherein the requesting updated credential information occurs upon a criterion of an established policy.

11. The method of claim 9, further including providing a synchronizing engine to interface with a single-sign-on service, the synchronizing engine for the requesting and receiving the credential information and the updated credential information.

12. The method of claim 11, further including interfacing the synchronizing engine and the single-sign-on service with a layer intermediate the multiple disparate credential stores.

13. The method of claim 9, further including indicating the various user credentials to be updated.

14. The method of claim 13, wherein the indicating further includes symbolically linking two or more passwords together, the passwords being associated with the at least two of said multiple disparate credential stores.

15. A computer program product available as a download or on a computer readable medium having executable instructions for coordinating user credentials across multiple disparate credential stores, comprising:

a first component for requesting and receiving credential information and, thereafter, updated credential information for at least two of said multiple disparate credential stores;

a second component to commonly format the credential information and the updated credential information;

a third component to receive user input indicating various user credentials of the credential information desired to be synchronized together in the event the credential information and the updated credential information have differences; and

a fourth component for determining whether the credential information and the updated credential information actually have said differences.

16. The computer program product of claim 15, wherein one or more of the components reside with a synchronizing engine for retrofitting with an existing single-sign-on service.

17. The computer program product of claim 15, further including a fifth component for storing a policy, the fourth and fifth components in communication with one another so that the determining said differences between the credential information and the updated credential information occurs according to the policy.

18. A computing system for coordinating user credentials across multiple disparate credential stores, comprising:

a user interface module for indicating various credentials to be synchronized with one another;

a single-sign-on service;

a synchronizing engine interfacing with the single-sign-on service; and

at least two credential stores having dissimilar credential information, wherein the synchronizing engine receives the credential information in a common format and is configured to compare past and present versions of the credential information to ascertain whether differences exist, in the event differences exist, the synchronizing engine being configured to update the various credentials indicated by a user via the user interface module.

19. The computing system of claim 18, further including a variety of files accessible by the synchronizing engine to ascertain user or enterprise policies.

20. The computing system of claim 18, further including an aggregation and distribution layer intermediate the at least two credential stores and the synchronizing engine.

21. The computing system of claim 18, wherein the user interface module is a CASA manager.

22. The computing system of claim 18, wherein the at least two credential stores include one or more of a Firefox password manager, Gnome Keyring, KDE Wallet, Windows Passport, CASA store, and SecretStore.

23. The computing system of claim 18, further including a driver for retrieving the credential information from the at least two credential stores.

24. The computing system of claim 18, wherein the synchronizing engine is a computer program product available as a download or on a computer readable medium having executable instructions for installation on one or more physical computing devices.

25. The computing system of claim 18, wherein the synchronizing engine is further configured to apply uniform policy across the at least two credential stores.