Securely accessing a break-glass account

1 . A system, comprising:

at least one processor; and

at least one memory that stores executable instructions that, when executed by the at least one processor, facilitate performance of operations, comprising:

based on receiving first request data that identifies a first request associated with a user account to generate break-glass credentials associated with the user account,

generating a deployment key-pair comprising a deployment secret key and a corresponding deployment public key,

determining a data encryption key based on the deployment secret key and a vendor public key, and

encrypting the break-glass credentials with the data encryption key, to produce encrypted break-glass credentials;

receiving, from a remote computer, log in credentials to log into the system, and second request data that identifies a second request associated with the user account for credentials that are configured to access a computing resource, wherein the second request data comprises a concealed value, and wherein the concealed value comprises the corresponding deployment public key that is concealed with an ephemeral secret key;

based on logging the user account into the system using the log in credentials, unlocking the concealed value using a vendor secret key corresponding to the user account, to produce an unlocked concealed value; and

sending the unlocked concealed value to the remote computer, enabling the remote computer to determine the data encryption key based on processing the unlocked concealed value using the ephemeral secret key, enabling the remote computer to decrypt the encrypted break-glass credentials using the data encryption key to produce the break-glass credentials, and enabling the remote computer to access the computing resource using the break-glass credentials.

2 . The system of claim 1 , wherein the operations further comprise:

obtaining the vendor secret key from a key management store based on receiving the request data.

3 . The system of claim 1 , wherein the operations further comprise:

initializing cryptographic parameters for the user account, wherein the cryptographic parameters comprise a first number that is a primitive root modulo of a second number, and wherein the second number is a prime number.

4 . The system of claim 3 , wherein the initializing is performed for a group of user accounts that comprises the user account, and wherein respective user accounts of the group of user accounts are configured to access the computing resource.

5 . The system of claim 3 , wherein the initializing is performed on a per user account basis.

6 . The system of claim 3 , wherein the initializing is performed on a per site basis, wherein a site comprises a group of at least one computer, and wherein the user account is associated with multiple sites.

7 . The system of claim 3 , wherein the cryptographic parameters are initialized for a group of user accounts that comprises the user account, and wherein the vendor secret key is specific to the user account.

8 . The system of claim 1 , wherein the operations further comprise:

generating a vendor key-pair comprising the vendor secret key and the vendor public key; and

enabling access to the vendor public key via the user account before receiving the request data.

9 . The system of claim 8 , wherein enabling the access to the vendor public key via the user account comprises:

adding the vendor public key to a certificate signing request;

processing the certificate signing request with a certificate authority that is associated with the system, to produce a signed certificate; and

enabling access to the signed certificate via the user account.

10 . A method, comprising:

based on receiving first request data that identifies a first request associated with a user account to generate credentials associated with the user account,

generating, by a system comprising at least one processor, a deployment key-pair comprising a deployment secret key and a corresponding deployment public key,

determining, by the system, a data encryption key based on the deployment secret key and a vendor public key, and

encrypting, by the system, the credentials with the data encryption key, to produce encrypted credentials;

receiving, by the system and from a remote computer, log in credentials to log into the system, and second request data that identifies a second request from the user account for the credentials that are configured to access a computing resource, wherein the second request data comprises a first value, and wherein the first value comprises the corresponding deployment public key that is concealed with an ephemeral secret key;

based on logging the user account into the system using the log in credentials, unlocking, by the system, the first value with a vendor secret key, to produce a second value; and

sending, by the system, the second value to the remote computer, as a result of which the remote computer is able to determine the data encryption key based on processing the second value with the ephemeral secret key, decrypt the encrypted credentials with the data encryption key to produce the credentials, and access the computing resource using the credentials.

11 . The method of claim 10 , further comprising:

in response to receiving the request data, accessing, by the system, the vendor secret key that is stored in a key management store.

12 . The method of claim 10 , further comprising:

initializing, by the system, cryptographic parameters for the user account, wherein the cryptographic parameters comprise a first number and a second number, wherein the first number comprises a primitive root modulo of the second number, and wherein the second number comprises a prime number.

13 . The method of claim 12 , wherein the user account is a first user account, and wherein the cryptographic parameters are configured to be used for the first user account and a second user account.

14 . The method of claim 12 , wherein the user account is a first user account, wherein the cryptographic parameters are first cryptographic parameters, and further comprising:

initializing, by the system, second cryptographic parameters for a second user account.

15 . The method of claim 12 , wherein the user account is associated with a first site that comprises a first group of at least one computer and a second site that comprises a second group of at least one computer, wherein the cryptographic parameters are first cryptographic parameters, and further comprising:

initializing, by the system, second cryptographic parameters for the user account for the second site.

16 . The method of claim 12 , wherein the user account is a first user account, wherein the cryptographic parameters are configured to be used for the first user account and a second user account, wherein the vendor secret key is a first vendor secret key, wherein the vendor public key is a first vendor public key, and further comprising:

generating, by the system, a second vendor key-pair for the second user account comprising a second vendor secret key and a second vendor public key.

17 . A non-transitory computer-readable medium comprising instructions that, in response to execution, cause at least one system comprising a processor to perform operations, comprising:

based on receiving first request data that identifies a first request associated with a user account to generate credentials associated with the user account,

generating a deployment key-pair comprising a first secret key and a corresponding first public key,

determining a data encryption key based on the first secret key and a vendor public key, and

encrypting the credentials with the data encryption key, to produce encrypted credentials;

receiving, from a remote computer, log in credentials to log into the system, and second request data that identifies a second request from the user account for credentials that are configured to access a computing resource, wherein the second request data comprises a value, and wherein the value comprises a first public key that is encoded with a second secret key;

based on logging the user account into the system using the log in credentials, unlocking the value with a third secret key, to produce a second value; and

sending the second value to the remote computer, the remote computer determining a data encryption key based on processing the second value with the second secret key, the remote computer decrypting encrypted credentials with the data encryption key to produce the credentials, and the remote computer accessing the computing resource using the credentials.

18 . The non-transitory computer-readable medium of claim 17 , wherein the operations further comprise:

generating a key-pair comprising the third secret key and a corresponding third public key; and

sending the third public key to the user account before receiving the request data.

19 . The non-transitory computer-readable medium of claim 18 , wherein sending the third public key to the user account before receiving the request data comprises:

adding the third public key to a certificate signing request;

processing the certificate signing request with a certificate authority that is associated with the system, to produce a signed certificate; and

sending the signed certificate to the user account.

20 . The non-transitory computer-readable medium of claim 17 , wherein the operations further comprise:

initializing cryptographic parameters for the user account.