Secure storage in file system

• US 8,140,866 B2
• Filed: 11/17/2009
• Issued: 03/20/2012
• Est. Priority Date: 01/21/2004
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Becker, Georg C., Kuersch, Ralf, Theobald, Dietmar, Schneider, Juergen
• Primary Examiner(s): Dinh, Minh
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US12/619,925
• Publication Number:
  US 20100061552A1
• Time in Patent Office: 854 Days
• Field of Search: None
• US Class Current: 713/193
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A node may contain a secure store agent. A process executing on the node may request connection information from the secure store agent. An encryption key phrase may be accessed, responsive to the request for connection information, to decrypt the requested connection information. The requested connection information may be obtained from a secure storage file in a file system.

Claims

1. A computer-implemented method comprising:

receiving a connection request to connect to a node;

accessing a key phrase to be used to decrypt encrypted connection information;

combining a system identifier with the key phrase to generate an encryption key, the system identifier identifying a system requesting decrypted connection information;

accessing the encrypted connection information for the node from a secure storage file; and

using the encryption key to decrypt, using one or more processors, the encrypted connection information to provide the decrypted connection information including an address and password for connecting to the node.

2. The method of claim 1, wherein the accessing of the key phrase comprises accessing the key phrase from a file system of an application server.

3. The method of claim 1, wherein the accessing of the key phrase comprises accessing the key phrase from a shared directory of a distributed system.

4. The method of claim 1, wherein the accessing of the key phrase comprises prompting a user for an input that provides the key phrase.

5. The method of claim 1, wherein the node comprises a database.

6. The method of claim 1, wherein the connection requested is received from a user device by an application server within a distributed system, the node being a further device within the distributed system.

7. The method of claim 1, wherein the secure storage file is in a shared directory of a distributed system.

8. The method of claim 1, wherein the encrypted connection information comprises an encrypted string, the encrypted string being parsed into a plurality of substrings.

9. The method of claim 8, wherein the decrypting of the encrypted connection information comprises decrypting at least one of the substrings.

10. A system comprising:

an application server to receive a connection request to connect to a node, access a key phrase to be used to decrypt encrypted connection information, and access the encrypted connection information for the node from a secure storage file;

a key generator to combine a system identifier with the key phrase to generate an encryption key, the system identifier to identify a system requesting decrypted connection information; and

a shared directory of a distributed system to store the encrypted connection information within the secure storage file and to provide the encrypted connection information to the application server, the application server using the encryption key to decrypt, using one or more processors, the encrypted connection information to provide decrypted connection information including an address and password for connecting to the node.

11. The system of claim 10, wherein the application server comprises a file system, the key phrase being stored on the file system.

12. The system of claim 10, wherein the shared directory is further configured to store the key phrase.

13. The system of claim 10, wherein a data store of the shared directory may be transitioned from storing unencrypted data to storing encrypted data.

14. A non-transitory machine-readable storage medium having embodied thereon instructions which, when executed by one or more processors, performs operations comprising:

receiving a connection request to connect to a node;

accessing a key phrase to be used to decrypt encrypted connection information;

combining a system identifier with the key phrase to generate an encryption key, the system identifier identifying a system requesting decrypted connection information;

accessing the encrypted connection information for the node from a secure storage file; and

using the encryption key to decrypt, the encrypted connection information to provide decrypted connection information including an address and password for connecting to the node.

15. The non-transitory machine-readable storage medium of claim 14, wherein the accessing of the encrypted connection information comprises obtaining the encrypted connection information from a secure storage file in a shared directory of a distributed system.