Protected resource access control utilizing intermediate values of a hash chain

• US 8,990,905 B1
• Filed: 09/28/2012
• Issued: 03/24/2015
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Bailey, Daniel V., Duane, William M., Young, Eric
• Primary Examiner(s): SHAIFER HARRIMAN, DANT B
• Application Number:
  US13/629,771
• Time in Patent Office: 907 Days
• Field of Search: 726/5
• US Class Current: 726/5
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A processing device comprises a processor coupled to a memory and is configured to associate intermediate values of a hash chain with respective access control intervals, and to provide a given one of the intermediate values to user in order to allow the user to access a protected resource in the corresponding access control interval. A final value of the hash chain is provided to an access control module associated with the protected resource, and an initial value of the hash chain is stored in a secure manner. The hash chain may be generated by applying a one-way hash function to the initial value a designated number of times in order to obtain the intermediate values and the final value. The protected resource may comprise, for example, a storage array or other processing platform component, with the intermediate values controlling service technician access to that component.

Claims

1. A method comprising:

associating intermediate values of a hash chain with respective access control intervals;

providing a given one of the intermediate values to a user in order to allow the user to access a protected resource in the corresponding access control interval;

providing a final value of the hash chain to an access control module associated with the protected resource; and

storing an initial value of the hash chain in a secure manner inaccessible to the access control module;

wherein the final value of the hash chain is further provided to each of one or more additional access control modules associated with respective protected resources; and

wherein said associating, providing the given one of the intermediate values, providing the final value and storing are performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 wherein the associating, providing the given one of the intermediate values and providing the final value are performed by a credential generation module.

3. The method of claim 1 wherein the user is required to present the intermediate value in combination with additional authentication data in order to access the protected resource in the corresponding access control interval.

4. The method of claim 1 further comprising generating the hash chain by applying a one-way hash function to an initial value N times in order to obtain the intermediate values and a final value where N denotes the number of access control intervals.

6. The method of claim 1 wherein the intermediate values of the hash chain comprise authentication data utilized in an access control system.

7. The method of claim 1 wherein the intermediate values of the hash chain comprise respective secure service credentials utilized to allow at least one service technician to access the protected resource in respective ones of the access control intervals.

8. The method of claim 1 wherein associating intermediate values of the hash chain with respective access control intervals further comprises associating a first one of the intermediate values immediately following an initial value of the hash chain with a final one of the access control intervals.

9. The method of claim 1 wherein associating intermediate values of the hash chain with respective access control intervals further comprises associating a final one of the intermediate values immediately preceding a final value of the hash chain with a first one of the access control intervals.

10. The method of claim 1 wherein associating intermediate values of the hash chain with respective access control intervals comprises associating at least a portion of the intermediate values with respective ones of the access control intervals in accordance with a reverse sequential ordering.

13. The method of claim 1 wherein the hash chain comprises a tree having one or more interior branches each defined by application of a one-way hash function to a common key and identifying information.

14. The method of claim 13 wherein the interior branch is of the form:

H⁽ⁿ⁾(H(H(K),ID)),

where n denotes a particular number of applications of hash function H, K denotes the common key and ID denotes the identifying information.

15. The method of claim 13 wherein the interior branch is of the form:

H⁽ⁿ⁾(H(H(H(K),ID₁),ID₂)),

where n denotes a particular number of applications of hash function H, K denotes the common key, ID₁ denotes identifying information of a protected resource and ID₂ denotes identifying information of a user.

16. A computer program product comprising a non-transitory processor-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device cause the method of claim 1 to be performed.

5. A method comprising:

associating intermediate values of a hash chain with respective access control intervals;

providing a given one of the intermediate values to a user in order to allow the user to access a protected resource in the corresponding access control interval;

providing a final value of the hash chain to an access control module associated with the protected resource;

storing an initial value of the hash chain in a secure manner inaccessible to the access control module;

generating one or more additional final values for one or more respective additional hash chains having respective distinct initial values; and

providing the one or more additional final values to respective additional access control modules associated with respective protected resources;

wherein said associating, providing the given one of the intermediate values, providing the final value, storing, generating and providing the one or more additional final values are performed by at least one processing device comprising a processor coupled to a memory.

11. The method of claim 5 wherein the distinct initial values of the respective hash chains are derived from a common key.

12. The method of claim 11 wherein each of the protected resources has associated identifying information and the distinct initial values of the respective hash chains are each determined as a function of the common key and the identifying information for the corresponding protected resource.

17. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the processing device being configured to associate intermediate values of a hash chain with respective access control intervals, to provide a given one of the intermediate values to a user in order to allow the user to access a protected resource in the corresponding access control interval, to provide a final value of the hash chain to an access control module associated with the protected resource, and to store an initial value of the hash chain in a secure manner inaccessible to the access control module;

wherein the processing device is further configured to provide the final value of the hash chain to each of one or more additional access control modules associated with respective protected resources.

18. The apparatus of claim 17 wherein the protected resource comprises a storage array having an associated access control module.

19. The apparatus of claim 18 wherein the processing device is implemented on a common processing platform with the access control module.

20. A method comprising:

receiving a given intermediate value of a hash chain from a user attempting to access a corresponding protected resource;

hashing the intermediate value a particular number of times determined based on a current access control interval in order to obtain a result; and

if the result matches a final value of the hash chain, granting the user access to the protected resource;

wherein the hash chain comprises an initial value, the final value and a plurality of intermediate values including the given intermediate value;

wherein the final value is provided to each of a plurality of access control modules associated with respective protected resources and the initial value is stored in a secure manner inaccessible to the access control modules;

wherein the intermediate values of the hash chain are associated with respective access control intervals; and

wherein said receiving, hashing, and granting are performed by at least one processing device comprising a processor coupled to a memory.

21. The method of claim 20 wherein the receiving, hashing and granting are performed by the access control module.

22. The method of claim 21 wherein the access control module stores information indicative of a latest access control interval for which the module has received one of the intermediate values from a user.

23. The method of claim 22 further comprising:

comparing a current access control interval associated with a presented intermediate value with the stored information indicative of the latest access control interval; and

denying access to the protected resource if the current access control interval precedes in time the latest access control interval indicated by the stored information.

24. The method of claim 20 further comprising replacing a previously-stored final value of the hash chain with the given intermediate value if that intermediate value results in granting the user access to the protected resource, such that the given intermediate value serves as a final value in verifying a subsequently-received intermediate value.

25. A computer program product comprising a non-transitory processor-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device cause the steps of the method of claim 20 to be performed.

26. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the processing device being configured to receive a given intermediate value of a hash chain from a user attempting to access a corresponding protected resource, to hash the intermediate value a particular number of times determined based on a current access control interval in order to obtain a result, and if the result matches a final value of the hash chain, to grant the user access to the protected resource;

wherein the hash chain comprises an initial value, the final value and a plurality of intermediate values including the given intermediate value;

wherein the final value is provided to each of a plurality of access control modules associated with respective protected resources and the initial value is stored in a secure manner inaccessible to the access control modules; and

wherein the intermediate values of the hash chain are associated with respective access control intervals.

27. The apparatus of claim 26 wherein the protected resource comprises a storage array having associated therewith the access control module.

28. The apparatus of claim 27 wherein the processing device is implemented on a common processing platform with the access control module.

29. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the processing device being configured to;

associate intermediate values of a hash chain with respective access control intervals;

provide a given one of the intermediate values to a user in order to allow the user to access a protected resource in the corresponding access control interval;

provide a final value of the hash chain to an access control module associated with the protected resource;

store an initial value of the hash chain in a secure manner inaccessible to the access control module;

generate one or more additional final values for one or more respective additional hash chains having respective distinct initial values; and

provide the one or more additional final values to respective additional access control modules associated with respective protected resources.