Providing secure access to a set of credentials within a data security mechanism of a data storage system

A method of providing secure access to a set of credentials within a data storage system, the method comprising:

• obtaining a unique identifier and a set of stable values;
• in response to a storage request from a client application, storing a set of credentials of the client application within a data security mechanism of the data storage system, the set of credentials being in encrypted form when stored within the data security mechanism of the data storage system;
• and
• configuring the data security mechanism of the data storage system to provide the set of credentials in non-encrypted form in response to new fingerprints matching a system fingerprint which is formed at least in part from the unique identifier and the set of stable values;
• wherein obtaining the unique identifier and the set of stable values includes:
• reading, as the unique identifier, a hostname from a hostname parameter stored in the data storage system, and
• reading, as the set of stable values, a set of machine-generated codes from a set of code storage locations within the data storage system, each machine-generated code being a sequence of symbols including at least one lower case character, at least one upper case character, at least one digit, and at least one special character to prevent a fraudster from easily duplicating a storage location environment of the data storage system;
• and
• wherein configuring the data security mechanism of the data storage system to provide the set of credentials in non-encrypted form in response to new fingerprints includes:
• setting the data security mechanism to (i) expose the set of credentials in non-encrypted form when at least a certain number of the read hostname and the read machine-generated codes matches an expected hostname and expected machine-generated codes, and (ii) not expose the set of credentials in non-encrypted form when less than the certain number of the read hostname and the read machine-generated codes matches the expected hostname and the expected machine-generated codes, the certain number being less than all of the read hostname and the read machine-generated codes matching the expected hostname and expected machine-generated codes.

A computer program product which comprises a non-transitory computer readable storage medium having instructions stored thereon which, when executed by a computer, cause the computer to provide secure access to a set of credentials on behalf of a client application by:

• obtaining a unique identifier and a set of stable values;
• in response to a storage request from the client application, storing the set of credentials within a data security mechanism, the set of credentials being in encrypted form when stored within the data security mechanism;
• and
• configuring the data security mechanism to provide the set of credentials in non-encrypted form in response to new fingerprints matching a system fingerprint which is formed at least in part from the unique identifier and the set of stable values;
• wherein obtaining the unique identifier and the set of stable values includes:
• reading, as the unique identifier, a hostname from a hostname parameter stored in the data storage system, and
• reading, as the set of stable values, a set of machine-generated codes from a set of code storage locations within the data storage system, each machine-generated code being a sequence of symbols including at least one lower case character, at least one upper case character, at least one digit, and at least one special character to prevent a fraudster from easily duplicating a storage location environment of the data storage system;
• and
• wherein configuring the data security mechanism of the data storage system to provide the set of credentials in non-encrypted form in response to new fingerprints includes:
• setting the data security mechanism to (i) expose the set of credentials in non-encrypted form when at least a certain number of the read hostname and the read machine-generated codes matches an expected hostname and expected machine-generated codes, and (ii) not expose the set of credentials in non-encrypted form when less than the certain number of the read hostname and the read machine-generated codes matches the expected hostname and the expected machine-generated codes, the certain number being less than all of the read hostname and the read machine-generated codes matching the expected hostname and expected machine-generated codes.