US 11,057,381 B1Granted

Using remotely stored credentials to access external resources

AssigneeSnowflake Inc.

InventorsDerek Denny-Brown, Tyler Jones, Isaac Kunen

Life of this patent

Estimating the term…

Loading patent…

Abstract

A credentials store definition identifying a remote credential store is received. The credential store definition includes access information to enable access to the remote credentials store. A credentials object is created in an internal database based on a credentials object definition. The credentials object identifies a security credential to retrieve from the remote credentials store to access an external resource. At runtime, a request to access the external resource is received, and based on receiving the request, the security credentials identified by the credentials object are retrieved from the remote credential store using the access information. The retrieved security credential is provided to a processing component to access the external resource.

Claims25

Dependent claims

A system comprising:

at least one hardware processor;
and
a memory storing instructions that cause the at least one hardware processor to perform operations comprising:
receiving a credential store definition identifying a remote credential store in a cloud credential store provider system that is external to the system, the credential store definition further including access information to enable the system to access the remote credential store;
receiving a credential object definition comprising an identifier of a security credential to retrieve from the remote credential store, the security credential being associated with an external resource;
creating, in a database of the system that is external to the remote credential store, a credential object based on the credential object definition, the credential object identifying the security credential to retrieve from the remote credential store;
receiving a request to access the external resource associated with the security credential;
in response to receiving the request, retrieving, from the remote credential store in the cloud credential store provider system, the security credential identified by the credential object by using the access information to assume a proxy identity within the cloud credential store provider system that has associated permissions to retrieve the security credential from the remote credential store;
providing the security credential retrieved from the remote credential store to a processing component for use in accessing the external resource;
and
generating a record, in the database of the system that is external to the remote credential store, based on use of the security credential by the processing component to access the external resource, the record including:
an identifier of a cloud credential store provider that maintains the remote credential store from which the security credential was retrieved, and
an identifier of an entity associated with the request.

10 more elements

A method comprising:

receiving a credential store definition identifying a remote credential store in an external system and including access information to enable access to the remote credential store;
receiving a credential object definition comprising an identifier of security credential to retrieve from the remote credential store, the security credential being associated with an external resource;
creating, in a database that is distinct from the external system, by one or more processors, a credential object based on the credential object definition, the credential object identifying the security credential to retrieve from the remote credential store;
receiving a request to access the external resource associated with the security credential;
in response to receiving the request, retrieving, from the remote credential store in the external system, the security credential identified by the credential object by using the access information to assume a proxy identity within the external system that has associated permissions to retrieve the security credential from the remote credential store;
providing the security credential retrieved from the remote credential store to a processing component for use in accessing the external resource;
and
generating a record, in the database is distinct from the external system, based on use of the security credential by the processing component to access the external resource, the record including:
an identifier of a cloud credential store provider that maintains the remote credential store from which the security credential was retrieved, and
an identifier of an entity associated with the request.

7 more elements

A computer-storage medium comprising instructions that, when executed by one or more processors of a machine, configure the machine to perform operations comprising:

receiving a credential store definition identifying a remote credential store in an external system and including access information to enable access to the remote credential store;
receiving a credential object definition comprising an identifier of security credential to retrieve from the remote credential store, the security credential being associated with an external resource;
creating, in a database that is distinct from the external system, a credential object based on the credential object definition, the credential object identifying the security credential to retrieve from the remote credential store;
receiving a request to access the external resource associated with the security credential;
in response to on receiving the request, retrieving, from the remote credential store, the security credential identified by the credential object by using the access information to assume a proxy identity within the external system that has associated permissions to retrieve the security credential from the remote credential store;
providing the security credential retrieved from the remote credential store to a processing component for use in accessing the external resource;
and
generating a record, in the database is distinct from the external system, based on use of the security credential by the processing component to access the external resource, the record including:
an identifier of a cloud credential store provider that maintains the remote credential store from which the security credential was retrieved, and
an identifier of an entity associated with the request.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/861,739Filed 29 Apr 2020
Granted: 6 Jul 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 63/0884
For authentication of entities: by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity…
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
H04L 63/083
For authentication of entities: using passwords