Granted Patent B2

US 12,224,997 · App. 17/420,156 · Granted Feb 11, 2025

Inventors: Andrew Todd (Cambridge, MA); Walter Wohler (Longmont, CO); Marty Kulma (Auburn, MA); Richard Bramante (Methuen, MA)

Assignee: HITACHI VANTARA LLC

H04L63/0823H04L63/0435H04L63/0876H04L63/20

Abstract

Claims (55)

1. A system comprising:

a first system including a plurality of first computing devices located at a first site, the first system in communication with a shared identity provider system that maintains user credential information for at least users of the first system and a second system, the second system including a plurality of second computing devices located at a second site that is different from the first site, at least one first computing device of the plurality of first computing devices in the first system including one or more processors configured by executable instructions to perform operations comprising:

receiving, by the at least one first computing device, a certificate of the second system including the plurality of second computing a devices located at the second site that is different from the first site, the certificate of the second system including a public cryptographic key of the second system and an identity of the second system;

in response to receiving the certificate of the second system, sending, by the at least one first computing device, to the second system, the certificate of the second system;

in response to sending the certificate of the second system to the second system, receiving, from the second system a response signed with the certificate of the second system indicating that the first system can trust communications from the second system;

obtaining, by the at least one first computing device, from the shared identity provider system, a credential of a user of the second system;

in response to receiving the response signed with the certificate of the second system indicating that the first system can trust the second system, sending, by the at least one first computing device, the credential of the user of the second system to the second system, the second system redirecting the credential to the shared identity provider system for authentication, wherein the authentication indicates that the second system can trust communications from the first system;

sending, by the at least one first computing device, to the second system, a certificate of the first system, the certificate of the first system including a public cryptographic key of the first system and an identity of the first system,

wherein, based at least on the at least one first computing device receiving the response signed with the certificate of the second system, and further based on authentication of the credential of the user of the second system, trusted communications are established between the first system and the second system.

2. The system as recited in claim 1 , wherein the second system has already established trusted communications with a third system comprising a plurality of third computing devices located at a third site that is different from the first site and the second site, the operations further comprising:

receiving, from the second system, based on the trusted communications established between the first system and the second system, a certificate of the third system; and

using, by the first system, the certificate of the third system for trusted communications with the third system.

3. The system as recited in claim 2 , wherein the second system provides the certificate of the first system to the third system based on the trusted communications established between the first system and the second system, and the trusted communications already established between the second system and the third system.

4. The system as recited in claim 2 , the operations further comprising:

receiving a revocation of the certificate of the first system;

obtaining a new certificate of the first system;

re-establishing trusted communications with the second system; and

sending the new certificate to the second system, wherein the second system provides the new certificate to the third system.

5. The system as recited in claim 2 , wherein the shared identity provider system is further shared with the third system and maintains user credential information for users of the third system.

6. The system as recited in claim 1 , further comprising, prior to receiving the certificate of the second system, initiating a transport layer security protocol connection with the second system to receive the certificate of the second system.

7. The system as recited in claim 1 , the operations further comprising:

sending the certificate of the second system to a user device for acceptance of the certificate of the second system; and

receiving, from the user device, an acknowledgement indicating an acceptance of the certificate of the second system.

8. The system as recited in claim 1 , wherein the credential of the user of the second system is a username and password of an administrator having authorized access to both the first system and the second system.

9. The system as recited in claim 1 , wherein the public cryptographic key of the certificate of the first system corresponds to a private cryptographic key maintained by the first system.

10. The system as recited in claim 1 , further comprising establishing, by the first system, trust in communications received from the second system based at least in part on receiving the response signed with the certificate of the second system; and

sending the credential of the user to the second system based at least on the trust established by the first system based at least in part on receiving the response signed with the certificate of the second system.

11. The system as recited in claim 10 , further comprising establishing the trusted communications between the first system and the second system based on the first system trusting communications from the second system based at least on receiving the response signed with the security certificate of the second system, and based on authentication of the credential of the second user by the shared identity provider system and receipt, by the second system, of the certificate of the first system.

12. A method comprising:

receiving, by a first computing device of a plurality of first computing devices included in a first system and located at a first site, a certificate of a second system, the second system comprising a plurality of second computing devices located at a second site that is different from the first site, the certificate of the second system including a public cryptographic key of the second system and an identity of the second system, wherein the first system and the second system are in communication with a shared identity provider system that maintains user credential information for at least users of the first system and the second system;

in response to receiving the certificate of the second system, sending, by the first computing device, to the second system, the certificate of the second system;

in response to sending the certificate of the second system to the second system, receiving, by the first computing device, from the second system, a response signed with the certificate of the second system indicating that the first system can trust communications from the second system;

obtaining, by the first computing device, from the shared identity provider system, a credential of a user of the second system;

in response to receiving the response signed with the certificate of the second system, sending, by the first computing device, to the second system, the credential of the user of the second system, the second system redirecting the credential to the shared identity provider system for authentication, wherein the authentication indicates that the second system can trust communications from the first system; and

sending, by the first computing device, to the second system, a certificate of the first system, a certificate of the first system including a public cryptographic key of the first system and an identity of the first system,

wherein, based at least on the first computing device receiving the response signed with the certificate of the second system, and further based on authentication of the credential of the user of the second system, trusted communications are established between the first system and the second system.

13. The method as recited in claim 12 , wherein the second system has already established trusted communications with a third system including a plurality of third computing devices located at a third site, the method further comprising:

receiving, from the second system, based on the trusted communications established between the first system and the second system, a certificate of the third system; and

using, by the first system, the certificate of the third system for trusted communications with the third system.

14. The method as recited in claim 13 , wherein the second system provides the certificate of the first system to the third system based on the trusted communications established between the first system and the second system, and the trusted communications already established between the second system and the third system.

15. The method as recited in claim 12 , further comprising, prior to receiving the certificate of the second system, initiating, by the first computing device, a transport layer security protocol connection with the second system to receive the certificate of the second system.

16. The method as recited in claim 12 , wherein the credential of the user of the second system is a username and password of an administrator having authorized access to both the first system and the second system.

17. One or more non-transitory computer-readable media storing instructions that, when executed by a first computing device of a plurality of computing devices included in a first system and located at a first site, configure the first computing device to perform operations comprising:

receiving, by the first computing device, a certificate of a second system, the second system comprising a plurality of second computing devices located at a second site that is different from the first site, the certificate of the second system including a public cryptographic key of the second system and an identity of the second system, wherein the first system and the second system are in communication with a shared identity provider system that maintains user credential information for at least users of the first system and the second system;

in response to receiving the certificate of the second system, sending, by the first computing device, to the second system, the certificate of the second system;

in response to sending the certificate of the second system to the second system, receiving, by the first computing device, from the second system, a response signed with the certificate of the second system indicating that the first system can trust communications from the second system;

obtaining, by the first computing device, from the shared identity provider system, a credential of a user of the second system;

in response to receiving the response signed with the certificate of the second system, the credential of the user of the second system, the second system redirecting the credential to the shared identity provider system for authentication, wherein the authentication indicates that the second system can trust communications from the first system; and

sending, by the first computing device, to the second system a certificate of the first system, the certificate of the first system including a public cryptographic key of the first system and an identity of the first system,

wherein, based at least on the first system receiving the response signed with the certificate of the second system, and further based on authentication of the credential of the user of the second system, trusted communications are established between the first system and the second system.

18. The one or more non-transitory computer-readable media as recited in claim 17 , wherein the second system has already established trusted communications with a third system including a plurality of third computing devices located at a third site, the operations further comprising:

receiving, from the second system, based on the trusted communications established between the first system and the second system, a certificate of the third system; and

using, by the first system, the certificate of the third system for trusted communications with the third system.

19. The one or more non-transitory computer-readable media as recited in claim 18 , wherein the second system provides the certificate of the first system to the third system based on the trusted communications established between the first system and the second system, and the trusted communications already established between the second system and the third system.

20. The one or more non-transitory computer-readable media as recited in claim 17 , wherein the credential of the user of the second system is a username and password of an administrator having authorized access to both the first system and the second system.

Assignments (1)

Continuity (1)

References Cited (16)