Systems and methods for credentials distribution
A method by a management server is described. The method includes receiving a credentials request from a requesting management node. The credentials request includes a public key of the requesting management node. The method also includes determining whether the management server has credentials encrypted for the requesting management node in a local cache. The credentials are encrypted using the public key of the requesting management node and cannot be decrypted by the management server. The method further includes sending the encrypted credentials to the requesting management node when the management server has the encrypted credentials. The requesting management node can decrypt the encrypted credentials using a private key.
1. A system configured for secure distribution, replication, and recovery of credentials, the system comprising:
a memory; and
one or more processors associated with a management node and operatively coupled to the memory, the one or more processors configured to:
determine that a credential is required to perform a task;
send a credential identification (ID) request to a management server;
receive, from the management server, the credential ID for the required credential from the management server;
determine that the credential is not stored in the memory;
responsive to a determination that the credential is not stored in the memory, send, to the management server, a request for the required credential that corresponds to the credential ID, wherein:
the request includes a public key of the management node,
the request is formatted to trigger the management server to send an encrypted instance of the credential to the management node that is encrypted using the public key of the management node, and receive the encrypted instance of the credential;
decrypt the encrypted instance of the credential using a private key of the management node to obtain the credential; and
perform the task using the credential after the encrypted instance of the credential is decrypted.
2. The system of claim 1 , wherein:
the management node is a first management node in a network;
the network further includes a second management node; and
the encrypted instance of the credential is obtained by the management server from the second management node responsive to a request multicast by the management server prior to sending the encrypted instance of the credential to the first management node.
3. The system of claim 1 , wherein the one or more processors are further configured to receive, from a user interface, information indicating that performance of the task requires the credential.
4. The system of claim 1 , wherein:
the management node is a first management node;
the credential is a first credential;
the one or more processors are further configured to:
receive, from the management server, a multicast request including a public key of a second management node and requesting a second credential for the second management node;
in response to the memory including the second credential:
encrypt the second credential using the public key of the second management node to produce an encrypted instance of the second credential; and
send, via a unicast communication, the encrypted instance of the second credential to the management server; and
the first management node and the second management node are peer management nodes in a network having common tenancy.
5. The system of claim 1 , wherein:
the management node is a first management node;
the credential is a first credential; and
the one or more processors are further configured to:
receive, from the management server, a multicast request including a public key of a second management node and requesting a second credential for the second management node;
when the memory includes a first encrypted instance of the second credential encrypted using the public key of the first management node:
decrypt the first encrypted instance of the second credential using the private key of the first management node to obtain the second credential;
encrypt the second credential using the public key of the second management node to produce a second encrypted instance of the second credential; and
send the second encrypted instance of the second credential to the management server.
6. A method of secure distribution, replication, and recovery of credentials, the method comprising:
determining that a credential is required to perform a task;
sending a credential identification (ID) request to a management server;
receiving, from the management server, the credential ID for the required credential from the management server;
determining that the credential is not stored in the memory;
responsive to a determination that the credential is not stored in the memory, sending, to the management server, a request for the required credential that corresponds to the credential ID, wherein:
the request includes a public key of the management node,
the request is formatted to trigger the management server to send an encrypted instance of the credential to the management node that is encrypted using the public key of the management node, and
receiving the encrypted instance of the credential;
decrypting the encrypted instance of the credential using a private key of the management node to obtain the credential; and
performing the task using the credential after the encrypted instance of the credential is decrypted.
7. The method of claim 6 , wherein:
the management node is a first management node in a network;
the network further includes a second management node; and
the encrypted instance of the credential is obtained by the management server from the second management node responsive to a request multicast by the management server prior to sending the encrypted instance of the credential to the first management node.
8. The method of claim 6 , further comprising
receiving, from a user interface, information indicating that performance of a task requires the credential.
9. The method of claim 6 , wherein:
the management node is a first management node;
the credential is a first credential;
the one or more processors are further configured to:
receive, from the management server, a multicast request including a public key of a second management node and requesting a second credential for the second management node;
in response to the memory including the second credential:
encrypt the second credential using the public key of the second management node to produce an encrypted instance of the second credential; and
send, via a unicast communication, the encrypted instance of the second credential to the management server; and
the first management node and the second management node are peer management nodes in a network having common tenancy.
10. The method of claim 6 , wherein:
the management node is a first management node;
the credential is a first credential; and
the one or more processors are further configured to:
receive, from the management server, a multicast request including a public key of a second management node and requesting a second credential for the second management node;
when the memory includes a first encrypted instance of the second credential encrypted using the public key of the first management node:
decrypt the first encrypted instance of the second credential using the private key of the first management node to obtain the second credential;
encrypt the second credential using the public key of the second management node to produce a second encrypted instance of the second credential; and
send the second encrypted instance of the second credential to the management server.