# US 10,375,056 B2 · Providing a secure communication channel during active directory disaster recovery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,056 B2 - Document ID: US10375056B2 - Status: Granted - Kind: B2 - Application number: 15/291,886 - Filed: 2016-10-12 - Published: 2018-04-12 - Granted: 2019-08-06 - Earliest claimed: 2016-10-12 - Assignees: Quest Software, Inc. - Applicants: Quest Software Inc. - Inventors: Sergey Alexandrovich Kalitin; Sergey Romanovich Vartanov - Web page: https://patentgrep.com/patent/US10375056B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) - G06F 11/1464: {for networked environments} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A secure communication channel can be established between a recovery console and a recovery agent during an Active Directory disaster recovery. This secure channel can be established without employing the Kerberos or NT LAN Manager (NTLM) authentication protocols. Therefore, the recovery console and recovery agent will be able to establish a secure channel even when the domain controller is in Directory Services Restore Mode (DSRM) and NTLM is disabled. A secure channel can be established between the recovery console and the recovery agent based on the Microsoft Secure Channel (Schanel) Security Support Provider (SSP). The Schannel implementation can be modified in a manner that allows the client to be authenticated within the Schannel architecture. ## Claims ### Claim 1 A method, performed by a recovery agent executing on a server, for establishing a secure connection between a recovery console executing on a client and the recovery agent, the method comprising: receiving, from the recovery console, a console certificate; storing the console certificate to enable the recovery agent to access the console certificate during subsequent attempts to establish a secure connection with the recovery agent; installing a hook on a function that is called by a security support provider to accept a certificate context received from a client; intercepting a call to the function that is made as part of a particular client's attempt to establish a secure connection with the recovery agent; and as part of intercepting the call, verifying a certificate context obtained from the intercepted call against the console certificate that was previously received from the recovery console and stored, wherein when the certificate context is verified, the recovery agent allows the intercepted call to complete, whereas when the certificate context is not verified, the recovery agent causes the intercepted call to fail. ### Claim 2 (depends on 1) The method of claim 1, wherein the function is the AcceptSecurityContext function. ### Claim 3 (depends on 1) The method of claim 1, wherein the console certificate is not stored in a trusted certificate store, and wherein verifying the certificate context against the console certificate comprises performing a binary comparison. ### Claim 4 (depends on 1) The method of claim 1, wherein the server is a domain controller and the method is performed while the domain controller is in Directory Services Restore Mode. ### Claim 5 (depends on 1) The method of claim 1, wherein the server is a domain controller and the method is performed when Kerberos authentication is not available. ### Claim 6 (depends on 1) The method of claim 1, wherein the console certificate is stored in a virtual certificate store. ### Claim 7 (depends on 6) The method of claim 6, further comprising: intercepting a call to a function to open a collection certificate store; adding the virtual certificate store to the collection certificate store. ### Claim 8 (depends on 7) The method of claim 7, wherein the function to open the collection certificate store is the CertOpenStore function. ### Claim 9 (depends on 7) The method of claim 7, wherein verifying the certificate context against the console certificate comprises verifying the certificate context against the console certificate that is included in the collection certificate store. ### Claim 10 (depends on 1) The method of claim 1, wherein the security support provider is Schannel. ### Claim 11 A method for establishing a secure connection between a recovery console executing on a client and a recovery agent executing on a server, the method comprising: sending, by the recovery console, a console certificate to the recovery agent; storing, by the recovery agent, the console certificate to enable the recovery agent to access the console certificate during subsequent attempts to establish a secure connection with the recovery agent; installing, by the recovery agent, a hook on a first function that is called by a server-side security support provider to accept a certificate context received from a client; requesting, by the recovery console, that a client-side security support provider establish a secure connection between the recovery console and the recovery agent thereby causing the client-side security support provider to send a security token containing a console certificate context to the server-side security support provider; in response to the server-side security support provider receiving the security token and calling the first function, intercepting, by the recovery agent, the call to thereby obtain access to the security token; accessing, by the recovery agent, the stored console certificate received from the recovery console; and verifying, by the recovery agent, the console certificate context obtained from the security token against the stored console certificate. ### Claim 12 (depends on 11) The method of claim 11, further comprising: installing, by the recovery console, a hook on a second function that is called by the client-side security support provider to accept a certificate context received from a server. ### Claim 13 (depends on 12) The method of claim 12, further comprising: in response to the client-side security support provider receiving a security token containing an agent certificate context and calling the second function, intercepting, by the recovery console, the call such that the recovery console obtains access to the security token containing the agent certificate context; obtaining, by the recovery console, an agent certificate stored on the client; and verifying, by the recovery console, the agent certificate context obtained from the security token against the agent certificate. ### Claim 14 (depends on 11) The method of claim 11, wherein verifying the console certificate context against the console certificate comprises performing a binary comparison. ### Claim 15 (depends on 11) The method of claim 11, wherein the recovery agent stores the console certificate in a virtual certificate store, the method further comprising: intercepting a call to a function to open a collection certificate store; and adding the virtual certificate store to the collection certificate store. ### Claim 16 (depends on 11) The method of claim 11, wherein the recovery agent executes on a domain controller in an Active Directory environment. ### Claim 17 (depends on 11) The method of claim 11, wherein the security support provider is Schannel. ### Claim 18 One or more non-transitory computer storage media storing computer executable instructions which implement a method for establishing a secure channel, the method comprising: receiving, by a recovery agent executing on a domain controller, a console certificate from a recovery console executing on a client; storing the console certificate on the domain controller to enable the recovery agent to access the console certificate during subsequent attempts to establish a secure connection with the recovery agent; installing a hook on a function that is called by a security support provider to accept a certificate context received from a client; intercepting a call to the function that is made as part of a particular client's attempt to establish a secure connection with the recovery agent; and as part of intercepting the call, verifying a certificate context obtained from the intercepted call against the console certificate that was previously received from the recovery console and stored, wherein when the certificate context is verified, the recovery agent allows the intercepted call to complete, whereas when the certificate context is not verified, the recovery agent causes the intercepted call to fail. ### Claim 19 (depends on 18) The non-transitory computer storage media of claim 18, wherein verifying the certificate context against the console certificate comprises performing a binary comparison. ### Claim 20 (depends on 18) The non-transitory computer storage media of claim 18, further comprising: storing the console certificate in a virtual certificate store; intercepting a call to a function to open a collection certificate store; and adding the virtual certificate store to the collection certificate store.