Dynamic key management
AssigneeNovell, Inc.
InventorsJason Allen Sabin, Michael John Jorgensen
Life of this patent
Estimating the term…
Abstract
Apparatus, systems, and methods may operate to receive a public key associated with a public/private key pair at a key distribution handler, after a new workload and an associated key agent are created within a network of nodes. The associated key agent may be used to generate the key pair. Additional activity may include distributing, by the key distribution handler, the public key to other key agents associated with permitted workloads operating in the network. The public key may be used to overwrite or delete prior public keys for an authenticated workload identity associated with the new workload. Additional apparatus, systems, and methods are disclosed.
Claims18
An apparatus that is a key distribution handler, the apparatus comprising:
- a network interface to communicatively couple to a network, the network including a plurality of nodes respectively including workloads, each of the workloads including respective key agents, the respective key agents having generated respective key pairs for the respective workloads, the respective key agents having lifetimes substantially the same as the respective workloads;
- a processor implemented reception module arranged to:
- receive a notification from a new respective key agent on a new workload that key generation and application configuration to make use of a generated public/private key pair is complete, the new respective key agent having generated the public/private key pair, the generated key pair including a public key, the newly created workload being created by and assigned to a user in accordance with a policy:
- receive the public key in response to the notification from the new respective key agent;
- and
- assign the public key to the user, and
- a processor implemented distribution module arranged to distribute the public key, via the network interface, to a plurality of the respective key agents associated with a plurality of permitted workloads from the workloads operating on nodes in the network, wherein the public key is used to overwrite or delete prior public keys for an authenticated workload identity associated with the new workload, wherein the permitted workloads are assigned to the user and governed by the policy, and wherein the apparatus is a separate and distinct node from a node with the new respective key agent and nodes with the respective key agents.
A system, comprising:
- a plurality of first nodes operating within a network, each of the first nodes comprising respective key agent to generate respective public/private key pairs in conjunction with creation of respective workloads operating on the network the respective key agents having lifetimes substantially the same as the respective workloads;
- and
- a second node that is separate and distinct from the plurality of first nodes, the second node being a key distribution handler, the second node comprising:
- a network interface to communicatively couple to the network;
- a processor implemented reception module, the reception module arranged to:
- receive a notification from a new respective key agent on a new workload that key generation and application configuration to make use of a generated public/private key pair are complete, the new respective key agent having generated the public/private key pair, the generated key pair including a public key, the newly created workload being created by and assigned to a user in accordance with a policy;
- receive the public key in response to the notification from the new respective key agent;
- and
- assign the public key to the user, and
- a processor implemented distribution module arranged to distribute the public key, via the network interface, to the associated key agents of the plurality of first nodes when distribution is permitted by a policy and whether the user is assigned to a respective workload of the plurality of first nodes, wherein the public key is used to overwrite or delete prior public keys for an authenticated workload identity that identifies the new workload.
A processor-implemented method for a key distribution handler to execute on one or more processors that perform the method in a the network including a plurality of nodes respectively including workloads, each of the workloads including respective key agents, the respective key agents having generated respective key pairs for the respective workloads, the respective key agents having lifetimes substantially the same as the respective workloads, the method comprising:
- receiving a notification from a new respective key agent on a new workload that key generation and application configuration to make use of a generated public/private key pair are complete, the new respective key agent having generated the public/private key pair, the generated key pair including a public key, the newly created workload being created by and assigned to a user in accordance with a policy;
- receiving the public key in response to the notification from the new respective key agent;
- assigning the public key to the user;
- and
- distributing the public key to a plurality of respective key agents associated with a plurality of permitted workloads from the workloads operating on nodes in the network, wherein the public key is used to overwrite or delete prior public keys for an authenticated workload identity associated with the new workload, wherein the permitted workloads are assigned to the user and governed by the policy, and wherein the apparatus is a separate and distinct node from a node with the new respective key agent and nodes with the respective key agents.
A processor-implemented method to execute on one or more processors that perform the method, comprising:
- receiving, from a key distribution handler, a newer public key associated with a public/private key pair assigned to a user by the key distribution handler, by an older key agent, of a plurality of older key agents, associated with an older workload, of a plurality of older workloads, operating within a network of nodes, the older key agent having a lifetime substantially the same as the older workload, the receiving to occur when transmission is permitted by a first policy governing key distribution for a newer workload in response to creation of the newer workload and an associated newer key agent within the network, the newer workload key agent having:
- generated the public/private key pair including the newer public key;
- notified the key distribution handler that application configuration to make use of a generated public/private key pair is complete;
- and
- communicated the newer public key the key distribution handler;
- and
- deleting, by the older key agent, an older public key associated with a prior workload identity that matches an authenticated workload identity associated with the newer workload, wherein the other key agent is separate and distinct from other members of the plurality of older key agents and the newer key agent.
Dependencies are inferred from the claim text.