Decentralization of last resort recovery using secrets
Reinstating access to a system of an admin whose certificate is invalid or expired is disclosed. A requestor may send a request for reinstatement to tenant admins. Only some of the tenant admins are authorized. If the request is received by an authorized tenant admin, the voting operation may be performed. If the request is received by an unauthorized tenant admin, the requestor is blocked and the identity of the requestor is stored such that the requestor does not repeat the attack with a different tenant admin. The tenant admins authorized to initiate the voting operation are changed periodically or in another manner.
1 . A method comprising:
receiving a request, from a requestor, to perform a voting operation to reinstate the requestor as an admin of a computing system;
determining whether a recipient of the request is authorized to initiate the voting operation;
performing the voting operation when the recipient is authorized to initiate the voting operation, wherein the requestor is reinstated as the admin if the voting operation is affirmative and the requestor is not reinstated if the voting operation is not affirmative; and
blocking the requestor when the recipient is not authorized to initiate the voting operation.
2 . The method of claim 1 , wherein the recipient is a tenant admin, and wherein and wherein authorized recipients are known to admins of the computing system, wherein a number of authorized recipients is less than a number of total recipients.
3 . The method of claim 1 , further comprising storing an identity of the requestor in a repository when the recipient is unauthorized.
4 . The method of claim 1 , wherein the recipient is included in first set of authorized recipients, further comprising establishing a second set of authorized recipients, wherein at least some of the recipients in the second set of authorized recipients are different from the recipients in the first set of authorized recipients.
5 . The method of claim 4 , wherein the first set of recipients are not authorized after the second set of authorized recipients are determined.
6 . The method of claim 1 , further comprising periodically changing which recipients are authorized to initiate the voting operation, wherein identities of the authorized recipients are known only to admins of the computing system, wherein the authorized recipients are tenant admins.
7 . The method of claim 1 , further comprising performing the voting operation, wherein the voting operation includes collecting votes from other voters, wherein the voters include tenant admins and/or applications associated with the computing system.
8 . The method of claim 7 , further comprising reinstating the requestor as the admin when the voting operation is affirmative.
9 . The method of claim 1 , further comprising distributing a token to each of the authorized recipients, wherein each of the recipients is unaware of which of the recipients are authorized.
10 . The method of claim 9 , further comprising invalidating the token when selecting a new authorized recipient and distributing a new token to the new authorized recipient.
11 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving a request, from a requestor, to perform a voting operation to reinstate the requestor as an admin of a computing system;
determining whether a recipient of the request is authorized to initiate the voting operation;
performing the voting operation when the recipient is authorized to initiate the voting operation, wherein the requestor is reinstated as the admin if the voting operation is affirmative and the requestor is not reinstated if the voting operation is not affirmative; and
blocking the requestor when the recipient is not authorized to initiate the voting operation.
12 . The non-transitory storage medium of claim 11 , wherein the recipient is a tenant admin, and wherein and wherein authorized recipients are known to admins of the computing system, wherein a number of authorized recipients is less than a number of total recipients.
13 . The non-transitory storage medium of claim 11 , further comprising storing an identity of the requestor in a repository when the recipient is unauthorized.
14 . The non-transitory storage medium of claim 11 , wherein the recipient is included in first set of authorized recipients, further comprising establishing a second set of authorized recipients, wherein at least some of the recipients in the second set of authorized recipients are different from the recipients in the first set of authorized recipients.
15 . The non-transitory storage medium of claim 14 , wherein the first set of recipients are not authorized after the second set of authorized recipients are determined.
16 . The non-transitory storage medium of claim 11 , further comprising periodically changing which recipients are authorized to initiate the voting operation, wherein identities of the authorized recipients are known only to admins of the computing system, wherein the authorized recipients are tenant admins.
17 . The non-transitory storage medium of claim 11 , further comprising performing the voting operation, wherein the voting operation includes collecting votes from other voters, wherein the voters include tenant admins and/or applications associated with the computing system.
18 . The non-transitory storage medium of claim 17 , further comprising reinstating the requestor as the admin when the voting operation is affirmative.
19 . The non-transitory storage medium of claim 11 , further comprising distributing a token to each of the authorized recipients, wherein each of the recipients is unaware of which of the recipients are authorized.
20 . The non-transitory storage medium of claim 19 , further comprising invalidating the token when selecting a new authorized recipient and distributing a new token to the new authorized recipient.