Back to results
US 12,587,365 B2Granted
Secret management in distributed systems
AssigneeDell Products L.P.
InventorsBradley K. Goodman, Joseph Caisse, Eric Joseph Bruno
Life of this patent
Estimating the term…
Abstract
Methods and systems for managing secrets are disclosed. To manage secrets, backups of the secrets may be obtained to facilitate future recoveries of the secrets. While backed up, the secrets may be secured with a security model. The security model may prescribe how entities that manage the backups are to operate, how encryption and decryption keys are maintained, and how various copies of the backed up secrets are to be distributed to manage potential loss of various backups of the secrets. When access to a secret is lost, a recovery may be performed using a corresponding backup of the secret.
Claims20
A method for managing a secret in a distributed system, the method comprising:
- initiating performance of a first decryption process for a multiply encrypted copy of the secret to obtain a first singly encrypted copy of the secret, the first decryption process being performed with a first decryption key, the multiply encrypted copy of the secret is obtained through encryption using at least two encryption keys, the at least two encryption keys being public keys for at least two endpoint devices, and the at least two endpoint devices each meeting security posture requirements for serving as escrow agents for the secret;
- initiating performance of a second decryption process for the first singly encrypted copy of the secret to obtain the copy of the secret, the second decryption process being performed with a second decryption key;
- initiating performance of a first encryption process for the copy of the secret to obtain a second singly encrypted copy of the secret;
- providing the second singly encrypted copy of the secret to a new endpoint device;
- decrypting, by the new endpoint device, the second singly encrypted copy of the secret to obtain the copy of the secret;
- using, by the new endpoint device, the copy of the secret to access data secured by the copy of the secret;
- and
- using, by the new endpoint device, the data to continue provisioning of computer implemented services provided by an original endpoint device that secured the data using the secret.
5 more elements
A non-transitory machine-readable medium having instructions stored therein, which when executed by at least one processor, cause a system to perform system first operations for managing a secret in a distributed system, the system first operations comprising:
- initiating performance of a first decryption process for a multiply encrypted copy of the secret to obtain a first singly encrypted copy of the secret, the first decryption process being performed with a first decryption key, the multiply encrypted copy of the secret is obtained through encryption using at least two encryption keys, the at least two encryption keys being public keys for at least two endpoint devices, and the at least two endpoint devices each meeting security posture requirements for serving as escrow agents for the secret;
- initiating performance of a second decryption process for the first singly encrypted copy of the secret to obtain the copy of the secret, the second decryption process being performed with a second decryption key;
- initiating performance of a first encryption process for the copy of the secret to obtain a second singly encrypted copy of the secret;
- initiating providing the second singly encrypted copy of the secret to a new endpoint device;
- initiating decryption, by the new endpoint device, the second singly encrypted copy of the secret to obtain the copy of the secret;
- initiating using, by the new endpoint device, the copy of the secret to access data secured by the copy of the secret;
- and
- initiating using, by the new endpoint device, the data to continue provisioning of computer implemented services provided by an original endpoint device that secured the data using the secret.
5 more elements
A data processing system, comprising:
- a processor;
- and
- a memory coupled to the processor to store instructions, which when executed by the processor, cause the data processing system to perform operations for managing a secret in a distributed system, the operations comprising:
- initiating performance of a first decryption process for a multiply encrypted copy of the secret to obtain a first singly encrypted copy of the secret, the first decryption process being performed with a first decryption key, the multiply encrypted copy of the secret is obtained through encryption using at least two encryption keys, the at least two encryption keys being public keys for at least two endpoint devices, and the at least two endpoint devices each meeting security posture requirements for serving as escrow agents for the secret;
- initiating performance of a second decryption process for the first singly encrypted copy of the secret to obtain the copy of the secret, the second decryption process being performed with a second decryption key;
- initiating performance of a first encryption process for the copy of the secret to obtain a second singly encrypted copy of the secret;
- initiating providing the second singly encrypted copy of the secret to a new endpoint device;
- initiating decryption, by the new endpoint device, the second singly encrypted copy of the secret to obtain the copy of the secret;
- initiating using, by the new endpoint device, the copy of the secret to access data secured by the copy of the secret;
- and
- initiating using, by the new endpoint device, the data to continue provisioning of computer implemented services provided by an original endpoint device that secured the data using the secret.
8 more elements
Dependencies are inferred from the claim text.