Secure credential store
View Patent ↗A credential store provides for secure storage of credentials. A credential stored in the credential store is encrypted with the public key of a user owning the credential. A first user may provide a credential owned by the first user to a second user. The first user may add credentials owned by the first user to the credential store. An administrator may manage users of the credential store without having the ability to provide credentials to those users.
1. A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable medium and including instructions that, when executed by at least one processor, are configured to:
insert a credential in a credential store of a credential server computer, the credential encrypted with a public key corresponding to a first user of the credential store;
receive an instruction to provide the credential;
decrypt the first credential with a private key of the first user;
encrypt the first credential with a single-use key;
store the single-use key-encrypted credential at a location;
make the single use key-encrypted credential available at the location during a time window;
allow access to the stored single-use key-encrypted credential at the location during the time window including a time scheduled for an automated action, wherein the size of the time window and the time scheduled for the automated action have been specified by the first user; and
remove the single use key-encrypted credential from the location upon expiration of the time window.
2. The computer program product of claim 1 , further comprising instructions that, when executed by the at least one processor, are configured to:
provide the single use key to the first user;
receive the single use key during the time window;
decrypt the single use key encrypted credential with the single use key; and
provide the decrypted credential for an automated action.
3. The computer program product of claim 1 , further comprising instructions that, when executed by the at least one processor, are configured to:
configure the time window as instructed by the first user.
4. The computer program product of claim 1 , further comprising instructions that, when executed by the at least one processor, are configured to:
schedule access to the credential within the time window based on information provided by the first user.
5. The computer program product of claim 1 , further comprising instructions that, when executed by the at least one processor, are configured to:
generate the single-use key after decrypting the first credential with the private key of the first user, the single-use key including a single-use encryption key generated by using a symmetric encryption technique.
6. The computer program product of claim 1 , further comprising instructions that, when executed by the at least one processor, are configured to:
generate an encrypted copy of the single-use key-encrypted credential; and
store the encrypted copy at a location specified by the user.
7. The computer program product of claim 1 , wherein the location includes an address specified by the user.
8. The computer program product of claim 1 , further comprising instructions that, when executed by the at least one processor, are configured to:
return the single-use key to the first user.
9. The computer program product of claim 1 , wherein removing the single use key-encrypted credential from the location upon expiration of the time window includes permanently discarding or deleting the single-use key-encrypted credential at the location.
10. A computer system including instructions recorded on a non-transitory computer-readable medium and executable by at least one processor, the system comprising:
a credential server configured to cause the at least one processor to:
insert a credential in a credential store of a credential server computer, the credential encrypted with a public key corresponding to a first user of the credential store;
receive an instruction to provide the credential;
decrypt the first credential with a private key of the first user;
encrypt the first credential with a single-use key;
store the single-use key-encrypted credential at a location;
make the single use key-encrypted credential available at the location during a time window;
allow access to the stored single-use key-encrypted credential at the location during the time window, the time window including a time scheduled for an automated action, wherein the size of the time window and the time scheduled for the automated action have been specified by the first user; and
remove the single use key-encrypted credential from the location upon expiration of the time window.
11. The system of claim 10 , wherein the credential server is further configured to cause the at least one processor to:
provide the single use key to the first user;
receive the single use key during the time window;
decrypt the single use key encrypted credential with the single use key; and
provide the decrypted credential for an automated action.
12. The system of claim 10 , wherein the credential server is further configured to cause the at least one processor to:
configure the time window as instructed by the first user;
schedule access to the credential within the time window based on information provided by the user; and
return the single-use key to the first user.
13. The system of claim 10 , wherein the credential server is further configured to cause the at least one processor to:
generate the single-use key after decrypting the first credential with the private key of the first user, the single-use key including a single-use encryption key generated by using a symmetric encryption technique.
14. The system of claim 10 , wherein the location includes an address specified by the first user.
15. The system of claim 10 , wherein the credential server is further configured to cause the at least one processor to:
generate an encrypted copy of the single-use key-encrypted credential; and
store the encrypted copy at a location specified by the first user.
16. The system of claim 10 , wherein removing the single use key-encrypted credential from the location upon expiration of the time window includes permanently discarding or deleting the single-use key-encrypted credential at the location.
17. A computer-implemented method comprising:
inserting a credential in a credential store of a credential server computer, the credential encrypted with a public key corresponding to a first user of the credential store;
receiving an instruction to provide the credential;
decrypting the first credential with a private key of the first user;
encrypting the first credential with a single-use key;
storing the single-use key-encrypted credential at a location;
making the single use key-encrypted credential available at the location during a time window;
allowing access to the stored single-use key-encrypted credential at the location during the time window including a time scheduled for an automated action, wherein the size of the time window and the time scheduled for the automated action have been specified by the first user; and
removing the single use key-encrypted credential from the location upon expiration of the time window.
18. The method of claim 17 , further comprising:
providing the single use key to the first user;
receiving he single use key during the time window;
decrypting the single use key encrypted credential with the single use key; and
providing the decrypted credential for an automated action.
19. The method of claim 17 , further comprising:
configuring the time window as instructed by the first user;
scheduling access to the credential within the time window based on information provided by the user; and
returning the single-use key to the first user.