Method and apparatus for securely managing computer process access to network resources through delegated system credentials

A system comprising:

• a network resource server including an administration module, an authentication service, a token management module and an enrollment and policy module;
• a plurality of machines communicatively coupled to said network resource server, each said machine including a plurality of autonomous computer processes configured to request resource access from said network resource server, a token module, and an agent;
• wherein each of said network resource server and said plurality of machines comprising one or more processors, and executable code stored on a non-transitory computer-readable storage media and executed by the one or more processors;
• wherein said agent in each of said plurality of machines is configured to enroll a corresponding one of said plurality of machines with said network resource server, and accept machine policies and login credentials from said enrollment and policy module, and after one of said plurality of machines is enrolled with said network resource server, if said token module does not know what resource scopes are available on the one machine, the token module issues a request to said agent on the one machine for available resource scopes and the agent returns a list of available resource scopes to the token module;
• wherein the token module determines an available one of said resource scopes that contains a resource for which access is requested by one of said autonomous computer processes running on said one of said plurality of machines;
• wherein said agent is configured to enroll said corresponding one of said plurality of machines with said network resource server by presenting an enrollment code to the enrollment and policy module along with information specific to said one machine;
• wherein the enrollment and policy module finds an enrollment definition that matches the presented enrollment code and verifies the enrollment request is legitimate by checking the provided machine-specific information against enrollment qualifications specified in said enrollment definition;
• wherein if the enrollment request is legitimate, the enrollment and policy module requests a machine account from the authentication service for the one machine and the authentication service returns a created machine account along with login credentials for the created machine account and stores a record that the one machine is enrolled under the enrollment qualifications specified in the enrollment definition;
• and
• wherein said enrollment and policy module returns to the agent the machine policies specified by a machine policies list in the enrollment definition and returns to the agent said login credentials necessary to use the created machine account.