SECURE STORAGE IN FILE SYSTEM

• US 20100061552A1
• Filed: 11/17/2009
• Published: 03/11/2010
• Est. Priority Date: 01/21/2004
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Kuersch, Ralf, Theobald, Dietmar, Becker, Georg C., Schneider, Juergen
• Granted Patent: US 8,140,866 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A node may contain a secure store agent. A process executing on the node may request connection information from the secure store agent. An encryption key phrase may be accessed, responsive to the request for connection information, to decrypt the requested connection information. The requested connection information may be obtained from a secure storage file in a file system.

Claims

1. A computer-implemented method comprising:

receiving a connection request to connect to a node;

accessing a key phrase;

accessing encrypted connection information for the node; and

using the key phrase to decrypt, using one or more processors, the encrypted connection information to provide decrypted connection information including a password for the node.

2. The method of claim 1, wherein the accessing of the key phrase comprises accessing the key phrase from a file system of an application server.

3. The method of claim 1, wherein the accessing of the key phrase comprises accessing the key phrase from a shared directory of a distributed system.

4. The method of claim 1, wherein the accessing of the key phrase comprises prompting a user for an input that provides the key phrase.

5. The method of claim 1, wherein the node comprises a database.

6. The method of claim 1, wherein the decrypted connection information further comprises an address for the node.

7. The method of claim 1, further comprising:

combining a system identifier with the key phrase to generate an effective encryption key, the system identifier identifying a system requesting the decrypted connection information.

8. The method of claim 7, wherein the using of the key phrase to decrypt the encrypted connection information comprises using the effective encryption key to decrypt the encrypted connection information.

9. The method of claim 1, wherein the accessing of the encrypted connection information comprises obtaining the encrypted connection information from a secure storage file in a shared directory of a distributed system.

10. The method of claim 1, wherein the encrypted connection information comprises an encrypted string, the encrypted string being parsed into a plurality of substrings.

11. The method of claim 10, wherein the decrypting of the encrypted connection information comprises decrypting at least one of the substrings.

12. A system comprising:

an application server to receive a connection request to connect to a node, access a key phrase, and access encrypted connection information for the node; and

a shared directory of a distributed system to store the encrypted connection information and to provide the encrypted connection information to the application server, the application server using the key phrase to decrypt, using one or more processors, the encrypted connection information to provide decrypted connection information including a password for the node.

13. The system of claim 12, further comprising:

a key generator to combine a system identifier with the key phrase to generate an effective encryption key, the system identifier to identify a system requesting the decrypted connection information.

14. The system of claim 12, wherein the application server comprises a file system, the key phrase being stored on the file system.

15. The system of claim 12, wherein the shared directory is further configured to store the key phrase.

16. The system of claim 12, wherein a data store of the shared directory may be transitioned from storing unencrypted data to storing encrypted data.

17. A machine-readable storage medium having embodied thereon instructions which, when executed by one or more processors, performs a method comprising:

receiving a connection request to connect to a node;

accessing a key phrase;

accessing encrypted connection information for the node; and

using the key phrase to decrypt, using one or more processors, the encrypted connection information to provide decrypted connection information including a password for the node.

18. The machine-readable storage medium of claim 17, wherein the method further comprises:

combining a system identifier with the key phrase to generate an effective encryption key, the system identifier identifying a system requesting the decrypted connection information.

19. The machine-readable storage medium of claim 18, wherein the using of the key phrase to decrypt the encrypted connection information comprises using the effective encryption key to decrypt the encrypted connection information.

20. The machine-readable storage medium of claim 17, wherein the accessing of the encrypted connection information comprises obtaining the encrypted connection information from a secure storage file in a shared directory of a distributed system.