# US 2018/0324159 A1 · Efficient centralized credential storage for remotely managed networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324159 A1 - Document ID: US20180324159A1 - Status: Published application - Kind: A1 - Application number: 15/587,042 - Filed: 2017-05-04 - Published: 2018-11-08 - Earliest claimed: 2017-05-04 - Assignees: ServiceNow, Inc. - Applicants: ServiceNow, Inc. - Inventors: Venkata Kiran Kumar Koya; Rebecca Dias; Vincent Seguin; Hardik Modi; Gopalakrish Venkatachalam; Jun Zhou - Web page: https://patentgrep.com/patent/US20180324159A1 ## CPC - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - G06F 21/44: Program or device authentication - G06F 21/602: {Providing cryptographic facilities or services} - H04L 63/0281: {Proxies} - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/10: {for controlling access to devices or network resources} - G06F 2221/2115: Third party - G06F 2221/2129: Authenticate client device independently of the user - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An example embodiment may involve receiving, by a server device that stores a plurality of access credentials for computing devices that are disposed within a managed network, a request containing a label and an indication of an application service. The server device may be disposed within a remote network management platform that remotely manages the managed network. The example embodiment may further involve mapping, by the server device, the label and the application service to an endpoint identifier of a target computing device that is disposed within the managed network. The endpoint identifier may be associated with particular access credentials that are usable to access the application service executing on the target computing device. The example embodiment may further involve transmitting, by the server device, the endpoint identifier and the particular access credentials. ## Claims ### Claim 1 A system comprising: a proxy server application executing on a proxy server device that is disposed within a managed network; and a server device that is disposed within a remote network management platform that remotely manages the managed network, wherein the server device stores a plurality of access credentials for computing devices that are disposed within the managed network, and wherein the server device is configured to: receive, from the proxy server application, a request containing a label and an indication of an application service, map the label and the application service to an endpoint identifier of a target computing device that is disposed within the managed network, wherein the endpoint identifier is associated with particular access credentials of the plurality of access credentials that are usable to access the application service executing on the target computing device, and transmit, to the proxy server application, the endpoint identifier and the particular access credentials, wherein reception of the endpoint identifier and the particular access credentials causes the proxy server application to remotely access the application service executing on the target computing device. ### Claim 2 (depends on 1) The system of claim 1, wherein the endpoint identifier is an IP address or uniform resource locator. ### Claim 3 (depends on 1) The system of claim 1, wherein reception of the endpoint identifier and the particular access credentials also causes the proxy server application to store a record associating the label, the application service, and the particular access credentials. ### Claim 4 (depends on 1) The system of claim 1, wherein the application service is a remote login service. ### Claim 5 (depends on 1) The system of claim 1, wherein the server device is a first server device that is part of a first computing instance that is disposed within the remote network management platform, wherein the target computing device is a first target computing device, wherein the endpoint identifier is a first endpoint identifier, and wherein the plurality of access credentials are a first plurality of access credentials, the system further comprising: a second server device that stores a second plurality of access credentials for computing devices that are disposed within the managed network, wherein the second server device is part of a second computing instance that is disposed within the remote network management platform, wherein the second computing instance is logically isolated from the first computing instance, and wherein the second server device is configured to: receive, from the proxy server application, a second request containing the label and the indication of the application service, map the label and the application service to a second endpoint identifier of a second target computing device that is disposed within the managed network, wherein second particular access credentials of the second plurality of access credentials are usable to access the application service executing on the second target computing device, and transmit, to the proxy server application, the second endpoint identifier and the second particular access credentials. ### Claim 6 (depends on 1) The system of claim 1, wherein the particular access credentials include a userid and a password usable to log on to the application service executing on the target computing device. ### Claim 7 (depends on 6) The system of claim 6, wherein the password is stored, in the server device, in an encrypted manner. ### Claim 8 (depends on 7) The system of claim 7, wherein transmitting the particular access credentials comprises: decrypting the password with an instance key that is not available to the proxy server application; encrypting the password with a session key that is shared between the server device and the proxy server application; and transmitting the password as encrypted with the session key. ### Claim 9 (depends on 1) The system of claim 1, wherein the server device stores, in a single database table, all access credentials that are managed by the remote network management platform on behalf of the managed network. ### Claim 10 A method comprising: receiving, by a server device that stores a plurality of access credentials for computing devices that are disposed within a managed network, a request containing a label and an indication of an application service, wherein the server device is disposed within a remote network management platform that remotely manages the managed network, and wherein the request is received from a requesting device; mapping, by the server device, the label and the application service to an endpoint identifier of a target computing device that is disposed within the managed network, wherein the endpoint identifier is associated with particular access credentials of the plurality of access credentials that are usable to access the application service executing on the target computing device; and transmitting, by the server device and to the requesting device, the endpoint identifier and the particular access credentials, wherein reception of the endpoint identifier and the particular access credentials causes the requesting device to remotely access the application service executing on the target computing device. ### Claim 11 (depends on 10) The method of claim 10, wherein the requesting device is a proxy server device that is disposed within the managed network. ### Claim 12 (depends on 10) The method of claim 10, wherein the endpoint identifier is an IP address or uniform resource locator. ### Claim 13 (depends on 10) The method of claim 10, wherein reception of the endpoint identifier and the particular access credentials also causes the requesting device to store a record associating the label, the application service, and the particular access credentials. ### Claim 14 (depends on 10) The method of claim 10, wherein the application service is a remote login service. ### Claim 15 (depends on 10) The method of claim 10, wherein the server device is a first server device that is part of a first computing instance that is disposed within the remote network management platform, wherein the target computing device is a first target computing device, wherein the endpoint identifier is a first endpoint identifier, and wherein the plurality of access credentials are a first plurality of access credentials, the method further comprising: receiving, by a second server device that stores a second plurality of access credentials for computing devices that are disposed within the managed network, a second request containing the label and the application service, wherein the second server device is part of a second computing instance that is disposed within the remote network management platform, wherein second particular access credentials of the second plurality of access credentials are usable to access the application service executing on a second target computing device that is disposed within the managed network, and wherein the second request is received from the requesting device; mapping, by the second server device, the label and the application service to a second endpoint identifier of the second target computing device, wherein the second endpoint identifier is associated with the second particular access credentials that are usable to access the application service executing on the second target computing device; and transmitting, by the server device and to the requesting device, the second endpoint identifier and the second particular access credentials. ### Claim 16 (depends on 10) The method of claim 10, wherein the particular access credentials include a userid and password usable to log on to the application service of the target computing device. ### Claim 17 (depends on 16) The method of claim 16, wherein the password is stored, in the server device, in an encrypted manner. ### Claim 18 (depends on 17) The method of claim 17, wherein transmitting the particular access credentials comprises: decrypting the password with an instance key that is not available to the requesting device; encrypting the password with a session key that is shared between the server device and the requesting device; and transmitting the password as encrypted with the session key. ### Claim 19 (depends on 10) The method of claim 10, wherein the server device stores, in a single database table, all access credentials that are managed by the remote network management platform on behalf of the managed network. ### Claim 20 An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a server computing system that is disposed within a remote network management platform that remotely manages a managed network, cause the server computing system to perform operations comprising: receiving, from a proxy server application executing on a proxy server device that is disposed within the managed network, a request containing a label and an indication of an application service; mapping the label and the application service to an endpoint identifier of a target computing device that is disposed within the managed network, wherein the endpoint identifier is associated with particular access credentials of a plurality of access credentials that are usable to access the application service executing on the target computing device; and transmitting, to the proxy server application, the endpoint identifier and the particular access credentials, wherein reception of the endpoint identifier and the particular access credentials causes the proxy server application to remotely access the application service executing on the target computing device.