On demand client authentication
AssigneeBeyondTrust Corporation
InventorsChris Payson, Matthew Hillman, Sebastian Mankowski, Davy Durham
Life of this patent
Estimating the term…
Abstract
A secure client authentication system may generate short-term x509 end-entity certificates and short-term private keys based on client-specific parameters and an expiration time. An x509 Certificate Authority (CA) may issue the short-term x509 certificates upon receiving a client request to access a secure endpoint. Each issued certificate may include a Time-To-Live (TTL) value that defines a limited validity period, facilitating ephemeral access to the secure endpoint. Automatic expiration of these access credentials may restrict to the secure endpoint beyond the limited validity period, enhancing security by mitigating risks associated with long-term static credentials.
Claims20
One or more computing devices, comprising one or more processors, configured to:
- store, in a vault, an x509 Certificate Authority (CA) associated with at least one private key and a public certificate;
- receive a request comprising at least one client identification parameter and an expiration time;
- determine a Time-To-Live (TTL) value based on the expiration time;
- generate, based on the x509 CA and the TTL value, a short-term private key and a corresponding short-term x509 end-entity certificate comprising the TTL value and the at least one client identification parameter;
- and
- transmit the short-term private key and the short-term x509 end-entity certificate to the client, wherein the short-term x509 end-entity certificate is associated with authenticating the client to a secure endpoint for a duration associated with the TTL value.
A method performed by one or more computing devices, the method comprising:
- storing, in a vault, an x509 Certificate Authority (CA) associated with at least one private key and a public certificate;
- receiving a request comprising at least one client identification parameter and an expiration time;
- determining a Time-To-Live (TTL) value based on the expiration time;
- generating, based on the x509 CA and the TTL value, a short-term private key and a corresponding short-term x509 end-entity certificate comprising the TTL value and the at least one client identification parameter;
- and
- transmitting the short-term private key and the short-term x509 end-entity certificate to the client, wherein the short-term x509 end-entity certificate is associated with authenticating the client to a secure endpoint for a duration associated with the TTL value.
A system comprising:
- one or more processors;
- and
- a memory coupled with the one or more processors, the memory storing executable instructions that when executed by the one or more processors cause the one or more processors to effectuate operations comprising:
- storing, in a vault, an x509 Certificate Authority (CA) associated with at least one private key and a public certificate;
- receiving a request comprising at least one client identification parameter and an expiration time;
- determining a Time-To-Live (TTL) value based on the expiration time;
- generating, based on the x509 CA and the TTL value, a short-term private key and a corresponding short-term x509 end-entity certificate comprising the TTL value and the at least one client identification parameter;
- and
- transmitting the short-term private key and the short-term x509 end-entity certificate to the client, wherein the short-term x509 end-entity certificate is associated with authenticating the client to a secure endpoint for a duration associated with the TTL value.
Dependencies are inferred from the claim text.