Techniques for establishing and managing a distributed credential store

• US 7,647,256 B2
• Filed: 01/29/2004
• Issued: 01/12/2010
• Est. Priority Date: 01/29/2004
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Carter, Stephen R., Burch, Lloyd Leon, Earl, Douglas G.
• Primary Examiner(s): Frenel; Vanel
• Application Number:
  US10/767,884
• Publication Number:
  US 20050171872A1
• Time in Patent Office: 2,175 Days
• Field of Search: 705/29, 713/201, 713/150, 709/229, 707/200, 726/5
• US Class Current: 705/29
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06Q 10/0875 Itemisation or classification of parts, supplies or services, e.g. bill of materials
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

Techniques are provided for establishing and managing a distributed credential store. An identity service aggregates identity information from one or more identity stores and maintains the information as a remote credential store. Initially, the remote credential store, or portions thereof, is transmitted to a principal service as an initial configuration of a local credential store. A principal interacts with the principal service for defining or modifying a policy that identifies portions of the remote credential store which are to be synchronized with the local credential store. In some embodiments, the principal interacts with the principal service for defining a local policy that identifies portions of the local credential store which are not synchronized with the remote credential store. The interactions between the credential stores are trusted and secured.

Claims

1. A method for managing a distributed credential store, the method implemented in a computer-readable medium and is executed by a client, the method comprising:

establishing, by the client, a trust relationship with a remote credential store via an identity service, the identity service logically assembles and creates the remote credential store from multiple identity stores and the identity service generates the remote credential store by inspecting a global contract associated with a principal that is a user, by inspecting a trust specification, and by inspecting global policies, wherein the global contract defines how the principal is authenticated to various other principals or other users using specific identifying information and the global contract provides information that permits the identity service to acquire attribute information for a given relationship of the principal in relation to the other principals, and the global contract identifies the multiple identity stores used to assemble the remote credential store, and wherein the global policies restrict certain relationships based on physical locations, time limitations, calendar day limitations, or specific predefined events that restrict the certain relationships, and wherein the trust specification dictates a type of secure communication and methods of that secure communication that are to be used when the principal interacts with the identity service and the trust specification ensures that other communications directed to the remote credential store or a local credential store of the principal are secure and verifiable;

receiving, by the client, changes associated with one or more entries in the remote credential store into the local credential store;

transmitting, by the client, changes associated with one or more entries in the local credential store to the remote credential store, wherein the local credential store includes a local synchronization policy defined and created by the user and the changes that are received from the remote credential store and the changes that are transmitted from the local credential store are defined in the local synchronization policy, the local synchronization policy defines fields of the remote credential store that are to be selectively synchronized with the local credential store;

maintaining, by the client, selective sets of the one or more entries within the local credential store for separate unique principals, each entry associated with a particular unique principal and each entry uniquely encrypted for its particular unique principal where that unique principal knows the proper decryption algorithm.

2. The method of claim 1 further comprising identifying, by the client and for the remote credential store the one or more entries in the remote credential store which are to be received as the changes.

3. The method of claim 2 further comprising managing, by the client, one or more personal identity information entries within the local credential store which are not transmitted as the changes associated with the one or more entries in the local credential store to the remote credential store.

4. The method of claim 1 further comprising managing, by the client, portions of the local credential store from memory and managing other portions from storage.

5. The method of claim 1 further comprising managing, by the client, the trust relationship between the local credential store and the remote credential store using the trust specification.