# US 11,444,765 B2 · Methods and apparatus to manage credentials in hyper-converged infrastructures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,765 B2 - Document ID: US11444765B2 - Status: Granted - Kind: B2 - Application number: 17/107,884 - Filed: 2020-11-30 - Published: 2021-05-13 - Granted: 2022-09-13 - Earliest claimed: 2017-04-07 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Vishesh Kumar Nirwal - Web page: https://patentgrep.com/patent/US11444765B2 ## CPC - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 63/067: {using one-time keys (cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863)} - H04L 2463/062: applying encryption of the keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, apparatus, systems and articles of manufacture manage credentials in hyper-converged infrastructure s are disclosed. An example method includes establishing, by executing an instruction with at least one processor, a communication between a software defined data center manager of the hyper-converged infrastructure and a component of the hyper-converged infrastructure using first credentials included in a known hosts file. The example method also includes generating, by executing an instruction with the at least one processor, second credentials at the component in response to a power-on event detected by the software defined data center manager. The example method also includes recording, by executing an instruction with the at least one processor, the second credentials at the known host file. ## Claims ### Claim 1 A system to manage credentials in a hyper-converged infrastructure, the system comprising: a credentials manager to establish a communication between a software defined data center manager of the hyper-converged infrastructure and components of the hyper-converged infrastructure using a first public-private key pair, the credentials manager including, at least: a status monitor to: determine a status of the components of the hyper-converged infrastructure; and provide an identifier associated with the software defined data center manager to a keys monitor, the keys monitor to monitor and synchronize at least one of data or tasks corresponding to the software defined data center manager across the components of the hyper-converged infrastructure; and a keys manager in communication with the status monitor and the keys monitor, the keys manager to: generate a second public-private key pair at the components in response to a power-on event detected by the status monitor; record a public key portion of the second public-private key pair; and encrypt the public key portion of the second public-private key pair using a shared key stored in the credentials manager, a private key portion of the second public-private key pair stored at the components. ### Claim 2 (depends on 1) The system of claim 1, wherein the status monitor is to prevent synchronization of a known host file during a startup operation. ### Claim 3 (depends on 1) The system of claim 1, wherein the status monitor is to provide an alert to the keys monitor in response to recording the public key portion of the second public-private key pair. ### Claim 4 (depends on 1) The system of claim 1, wherein the credentials manager is to delete entries in a known host file in response to the status monitor determining an initialized status of the components of the hyper-converged infrastructure. ### Claim 5 (depends on 4) The system of claim 4, wherein the credentials manager is to restart the software defined data center manager in response to the status monitor determining the initialized status of the components of the hyper-converged infrastructure. ### Claim 6 (depends on 1) The system of claim 1, wherein providing the identifier associated with the software defined data center manager to the keys monitor registers the software defined data center manager with the keys monitor. ### Claim 7 (depends on 1) The system of claim 1, wherein the keys manager is to retrieve and decrypt the encrypted public key portion of the second public-private key pair. ### Claim 8 An apparatus to manage credentials in a hyper-converged infrastructure, the apparatus comprising: memory; one or more processors to execute instructions to cause the one or more processors to: establish a communication between a software defined data center manager of the hyper-converged infrastructure and components of the hyper-converged infrastructure using a first public-private key pair; determine a status of the components of the hyper-converged infrastructure; provide an identifier associated with the software defined data center manager to a keys monitor, the keys monitor to monitor and synchronize at least one of data or tasks corresponding to the software defined data center manager across the components of the hyper-converged infrastructure; generate a second public-private key pair at the components in response to the status of the component indicating a power-on event; record a public key portion of the second public-private key pair; and encrypt the public key portion of the second public-private key pair using a shared key stored in a credentials manager, a private key portion of the second public-private key pair stored at the components. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein the one or more processors is to prevent synchronization of a known host file during a startup operation. ### Claim 10 (depends on 8) The apparatus of claim 8, wherein the one or more processors is to provide an alert to the keys monitor in response to recording the public key portion of the second public-private key pair. ### Claim 11 (depends on 8) The apparatus of claim 8, wherein the one or more processors is to delete entries in a known host file in response to determining an initialized status of the components of the hyper-converged infrastructure. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the one or more processors is to restart the software defined data center manager in response to determining the initialized status of the components of the hyper-converged infrastructure. ### Claim 13 (depends on 8) The apparatus of claim 8, wherein providing the identifier associated with the software defined data center manager to the keys monitor registers the software defined data center manager with the keys monitor. ### Claim 14 (depends on 8) The apparatus of claim 8, wherein the one or more processors is to retrieve and decrypt the encrypted public key portion of the second public-private key pair. ### Claim 15 A non-transitory computer readable medium comprising instructions that, when executed, cause a machine to at least: establish a communication between a software defined data center manager of a hyper-converged infrastructure and components of the hyper-converged infrastructure using a first public-private key pair; determine a status of the components of the hyper-converged infrastructure; provide an identifier associated with the software defined data center manager to a keys monitor, the keys monitor to monitor and synchronize at least one of data or tasks corresponding to the software defined data center manager across the components of the hyper-converged infrastructure; generate a second public-private key pair at the components in response to the status of the components indicating a power-on event; record a public key portion of the second public-private key pair; and encrypt the public key portion of the second public-private key pair using a shared key stored in a credentials manager, a private key portion of the second public-private key pair stored at the components. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the instructions, when executed, cause the machine to prevent synchronization of a known host file during a startup operation. ### Claim 17 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the instructions, when executed, cause the machine to provide an alert to the keys monitor in response to recording the public key portion of the second public-private key pair. ### Claim 18 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the instructions, when executed, cause the machine to delete entries in a known host file in response to determining an initialized status of the components of the hyper-converged infrastructure. ### Claim 19 (depends on 18) The non-transitory computer readable medium of claim 18, wherein the instructions, when executed, cause the machine to restart the software defined data center manager in response to determining the initialized status of the components of the hyper-converged infrastructure. ### Claim 20 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the instructions, when executed, cause the machine to provide the identifier associated with the software defined data center manager to the keys monitor by registering the software defined data center manager with the keys monitor.