Client-side sharing of encryption keys

Abstract

Examples may involve determining that a first proxy server is to share a security credential with a set of one or more proxy servers, where the set of one or more proxy servers is associated with the security credential, and where the set of one or more proxy servers includes a second proxy server; generating a request to the second proxy server to enable the first proxy server to access the security credential; and receiving a credential key in encrypted form from the second proxy server, wherein the credential key is configured to decrypt the security credential.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to U.S. Patent Application No. 18 / 225,448, filed July 24, 2023, the entire contents of which are incorporated herein by reference. Background Technology

[0003] Currently, proxy servers are used to facilitate discovery and other processes within managed networks. These processes typically require the proxy server to access credentials to log in to or otherwise retrieve information from computing devices on the managed network, or to log in to or retrieve information from public cloud infrastructure used by the managed network. These credentials can be one or more of the following: user ID / password pairs, one-time passwords, certificates, application programming interface (API) keys, tokens, etc. Credentials are typically stored in encrypted format on a compute instance of a remote network management platform or in a separate online security vault. The association between credentials and the proxy servers that use those credentials is configured per proxy server, which leads to inefficiencies as the number of proxy servers per managed network increases. Summary of the Invention

[0004] The various implementations disclosed in this paper include techniques for sharing access to credentials across proxy servers. A proxy server can be configured to be one of a set of one or more proxy servers capable of accessing credentials. New proxy servers can be added to this set, or new shared credentials can be configured. The goal is to make credentials available to all proxy servers in the set in an efficient, secure manner without exposing any credentials or the encryption keys used to protect the credentials to third parties.

[0005] Therefore, the first example embodiment may involve: determining that a first proxy server wants to share security credentials with a set of one or more proxy servers, wherein the set of one or more proxy servers is associated with the security credentials, and wherein the set of one or more proxy servers includes a second proxy server; sending a request to the second proxy server to enable the first proxy server to access the security credentials; and receiving an encrypted credential key from the second proxy server, wherein the credential key is configured to decrypt the security credentials.

[0006] The second example embodiment may involve: receiving a request to enable a first proxy server to access security credentials, wherein the request is received by a second proxy server in a set of one or more proxy servers; verifying that the first proxy server is a member of the set and has the appropriate authorization to access the security credentials; encrypting the credential key into an encrypted form; and sending the encrypted credential key to a location accessible by the first proxy server.

[0007] The third example embodiment may relate to a non-transitory computer-readable medium having program instructions stored thereon that, when executed by a computing system, cause the computing system to perform operations according to the first and / or second example embodiments.

[0008] In a fourth example embodiment, the computing system may include at least one processor, as well as memory and program instructions. The program instructions may be stored in the memory and, when executed by the at least one processor, cause the computing system to perform operations according to the first and / or second example embodiments.

[0009] In the fifth example embodiment, the system may include various means for performing each operation of the first and / or second example embodiments.

[0010] These and other embodiments, aspects, advantages, and alternatives will become apparent to those skilled in the art from the following detailed description and in conjunction with the accompanying drawings (where appropriate). Furthermore, this overview, along with other descriptions and drawings provided herein, is intended to illustrate embodiments by way of example only, and therefore many variations are possible. For example, structural elements and process steps may be rearranged, combined, distributed, eliminated, or otherwise altered while remaining within the scope of the claimed embodiments. Attached Figure Description

[0011] Figure 1 A schematic diagram of a computing device according to an example embodiment is shown.

[0012] Figure 2 A schematic diagram of a server device cluster according to an example embodiment is shown.

[0013] Figure 3 A remote network management architecture according to an example embodiment is described.

[0014] Figure 4 A communication environment involving a remote network management architecture, according to an example embodiment, is described.

[0015] Figure 5 Another communication environment involving a remote network management architecture, according to an example embodiment, is described.

[0016] Figure 6 A credential management transaction according to an example embodiment is described.

[0017] Figure 7 This is a flowchart illustrating the sharing of access to credentials across proxy servers according to an example embodiment.

[0018] Figure 8This is a flowchart of a sample embodiment for sharing credentials and generating and sharing associated credential keys.

[0019] Figure 9 This is a flowchart based on an example embodiment.

[0020] Figure 10 This is a flowchart based on an exemplary embodiment. Detailed Implementation

[0021] This document describes example methods, devices, and systems. It should be understood that the terms "example" and "exemplary" as used herein mean "serving as an example, instance, or illustration." Unless specifically stated otherwise, any embodiment or feature described herein as "example" or "exemplary" is not necessarily to be construed as being more preferred or advantageous than other embodiments or features. Therefore, other embodiments and other changes may be utilized without departing from the scope of the subject matter presented herein.

[0022] Therefore, the exemplary embodiments described herein are not intended to be limiting. It will be readily understood that the various aspects of this disclosure described herein and illustrated in the accompanying drawings can be arranged, replaced, combined, separated, and designed in a variety of different configurations. For example, separating features into “client” and “server” components can occur in a variety of ways.

[0023] Furthermore, unless the context otherwise suggests, the features shown in each figure can be used in combination with each other. Therefore, these figures should generally be considered as aspects of one or more overall embodiments, and it should be understood that not every embodiment requires all the features shown in the figures.

[0024] Furthermore, any enumeration of elements, blocks, or steps in this specification or claims is for clarity. Therefore, such enumeration should not be construed as requiring or implying that these elements, blocks, or steps follow a particular arrangement or are performed in a particular order.

[0025] I. introduction

[0026] Large enterprises are complex entities with many interconnected operations. Some of these operations are present throughout the enterprise, such as human resources (HR), supply chain, information technology (IT), and finance. However, each enterprise also has its unique operations that provide essential capabilities and / or create a competitive advantage.

[0027] To support widespread implementation, businesses typically use off-the-shelf software applications, such as Customer Relationship Management (CRM) and Human Capital Management (HCM) packages. However, they may also require custom software applications to meet their unique needs. Large enterprises often have dozens or hundreds of such custom software applications. Nevertheless, the advantages provided by the embodiments in this article are not limited to large enterprises and may be applicable to businesses of any size or any other type of organization.

[0028] Many of these software applications are developed by various departments within an enterprise. These applications range from simple spreadsheets to custom-built software tools and databases. However, the proliferation of siloed, custom software applications has many drawbacks. It negatively impacts an enterprise's ability to operate and grow its operations, innovate, and meet regulatory requirements. Due to the lack of a single system unifying its subsystems and data, enterprises may find it difficult to integrate, streamline, and enhance their operations.

[0029] To efficiently create custom applications, businesses will benefit from remotely hosted application platforms that eliminate unnecessary development complexity. These platforms aim to reduce time-consuming, repetitive application development tasks, allowing software engineers and other personnel to focus on developing unique, high-value features.

[0030] To achieve this goal, the concept of Application Platform as a Service (aPaaS) has been introduced to intelligently automate workflows across the entire enterprise. an aPaaS system is remotely hosted from the enterprise but can be accessed via a secure connection, allowing access to data, applications, and services within the enterprise. Such an aPaaS system may possess many advantageous capabilities and features. These advantages and features can improve an enterprise's operations and workflows in areas such as information technology, human resources, customer relationship management, customer service, application development, and security. Nevertheless, the embodiments described herein are not limited to enterprise applications or environments and can be applied more broadly.

[0031] aPaaS systems can support the development and execution of Model-View-Controller (MVC) applications. MVC applications divide their functionality into three interconnected parts (Model, View, and Controller) to separate the way information is represented from how it is presented to the user, thereby enabling efficient code reuse and parallel development. These applications may be web-based and provide Create, Read, Update, and Delete (CRUD) functionality. This allows new applications to be built on a common application infrastructure. In some cases, applications with a different MVC structure can be used, such as applications using unidirectional data flow.

[0032] aPaaS systems can support standardized application components, such as standardized sets of widgets for graphical user interface (GUI) development. This allows applications built using an aPaaS system to have a common look and feel. Other software components and modules can also be standardized. In some cases, this look and feel can be branded or skinned using a company's custom logo and / or color scheme.

[0033] aPaaS systems support the ability to configure application behavior using metadata. This allows for rapid adjustments to application behavior to meet specific needs. This approach reduces development time and increases flexibility. Furthermore, aPaaS systems can support GUI tools that facilitate the creation and management of metadata, thereby reducing errors in metadata.

[0034] aPaaS systems can support well-defined interfaces between applications, allowing software developers to avoid unnecessary inter-application dependencies. Therefore, aPaaS systems can implement a service layer where persistent state information and other data are stored.

[0035] aPaaS systems can support a rich set of integration features, enabling applications built on top of them to interact with legacy and third-party applications. For example, an aPaaS system can support custom onboarding systems that integrate with legacy HR, IT, and accounting systems.

[0036] aPaaS systems can support enterprise-level security. Furthermore, because aPaaS systems can be remotely hosted, security procedures should also be used when they interact with systems within the enterprise or with third-party networks and services hosted outside the enterprise. For example, aPaaS systems can be configured to share data between the enterprise and other parties to detect and identify common security threats.

[0037] Other features, functionalities, and benefits of the aPaaS system may exist. This description is for illustrative purposes only and is not intended to be limiting.

[0038] As an example of the aPaaS development process, software developers might be assigned the task of using an aPaaS system to create a new application. First, the developer can define a data model that specifies the data types used by the application and the relationships between them. Then, through the aPaaS system's graphical user interface, the developer inputs (e.g., uploads) the data model. The aPaaS system automatically creates all the corresponding database tables, fields, and relationships, which can then be accessed through an object-oriented service layer.

[0039] Furthermore, the aPaaS system can build fully functional applications with client-side interfaces and server-side create, read, update, and delete (CRUD) logic. This generated application can serve as a foundation for further development by the user. Advantageously, developers do not need to spend a significant amount of time on basic application functionality. Moreover, since the application can be web-based, it can be accessed from any internet-enabled client device. Alternatively or additionally, for example, when internet service is unavailable, a local copy of the application can also be accessed.

[0040] aPaaS systems also support a rich set of predefined features that can be added to applications. These features include support for search, email, templates, workflow design, reporting, analytics, social media, scripting, mobile-friendly output, and custom graphical user interfaces.

[0041] Such an aPaaS system can represent a graphical user interface in various ways. For example, the server device of the aPaaS system can use a combination of Hypertext Markup Language (HTML) and JavaScript® to generate a representation of the graphical user interface. JavaScript® can include client-side executable code, server-side executable code, or both. The server device can transmit or otherwise provide this representation to the client device so that the client device can display it on the screen according to its locally defined look and feel. Alternatively, the representation of the graphical user interface can take other forms, such as intermediate forms (e.g., JavaScript® bytecode) that the client device can directly use to generate graphical output. Other possibilities also exist.

[0042] Furthermore, user interaction with graphical user interface elements (such as buttons, menus, tabs, sliders, checkboxes, switches, etc.) can be described as “selecting,” “activating,” or “activating” them. These terms can be used regardless of whether the graphical user interface elements are interacted with via a keyboard, pointing device, touchscreen, or other mechanism.

[0043] The aPaaS architecture is particularly powerful when integrated with and used to manage an enterprise's network. The following examples describe the architectural and functional aspects of an example aPaaS system, as well as its features and benefits.

[0044] II. Example computing devices and cloud-based computing environments

[0045] Figure 1This is a simplified block diagram illustrating computing device 100, showing some components that may be included in a computing device configured to operate according to embodiments herein. Computing device 100 may be a client device (e.g., a user-operated device), a server device (e.g., a device providing computing services to client devices), or some other type of computing platform. Some server devices may from time to time operate as client devices to perform specific operations, while some client devices may contain server functionality.

[0046] In this example, computing device 100 includes a processor 102, a memory 104, a network interface 106, and an input / output unit 108, all of which can be coupled via a system bus 110 or a similar mechanism. In some embodiments, computing device 100 may include other components and / or peripheral devices (e.g., removable storage devices, printers, etc.).

[0047] Processor 102 can be one or more of any type of computer processing element, such as a central processing unit (CPU), a coprocessor (e.g., a math, graphics, or cryptographic coprocessor), a digital signal processor (DSP), a network processor, and / or an integrated circuit or controller that performs processor operations. In some cases, processor 102 can be one or more single-core processors. In other cases, processor 102 can be one or more multi-core processors with multiple independent processing units. Processor 102 may also include register memory for temporarily storing instructions being executed and associated data, and cache memory for temporarily storing recently used instructions and data.

[0048] Memory 104 can be any form of computer-usable memory, including but not limited to random access memory (RAM), read-only memory (ROM), and non-volatile memory (e.g., flash memory, hard disk drive, solid-state drive, optical disc (CD), digital video disc (DVD), and / or magnetic tape storage devices). Therefore, memory 104 represents both a main memory unit and a long-term storage device. Other types of memory may include biological memory.

[0049] Memory 104 may store program instructions and / or program instruction operable data. For example, memory 104 may store such program instructions on a non-transitory computer-readable medium, such that processor 102 may execute such instructions to perform any method, process, or operation disclosed in this specification or the accompanying drawings.

[0050] like Figure 1As shown, memory 104 may include firmware 104A, kernel 104B, and / or application 104C. Firmware 104A may be some or all of the program code used to boot or otherwise start computing device 100. Kernel 104B may be an operating system, including modules for memory management, process scheduling and management, input / output, and communication. Kernel 104B may also include device drivers that allow the operating system to communicate with hardware modules of computing device 100, such as memory units, network interfaces, ports, and buses. Application 104C may be one or more user-space software programs, such as web browsers or email clients, and any software libraries used by these programs. Memory 104 may also store data used by these and other programs and applications.

[0051] Network interface 106 may take the form of one or more wired interfaces, such as Ethernet (e.g., Fast Ethernet, Gigabit Ethernet, etc.). Network interface 106 may also support communication via one or more non-Ethernet media (e.g., coaxial cable or power line) or via wide area media (e.g., Synchronous Optical Network (SONET) or Digital Subscriber Line (DSL) technology). Network interface 106 may also take the form of one or more wireless interfaces, such as IEEE 802.11 (Wi-Fi), BLUETOOTH® (Bluetooth), Global Positioning System (GPS), or wide area wireless interfaces. However, other forms of physical layer interfaces and other types of standard or proprietary communication protocols may be used on network interface 106. Furthermore, network interface 106 may include multiple physical interfaces. For example, some embodiments of computing device 100 may include Ethernet, BLUETOOTH®, and Wi-Fi interfaces.

[0052] Input / output unit 108 facilitates interaction between the user and peripheral devices and computing device 100. Input / output unit 108 may include one or more types of input devices, such as a keyboard, mouse, touchscreen, etc. Similarly, input / output unit 108 may include one or more types of output devices, such as a screen, monitor, printer, and / or one or more light-emitting diodes (LEDs). Additionally or alternatively, computing device 100 may communicate with other devices, for example, using a Universal Serial Bus (USB) or High-Definition Multimedia Interface (HDMI) port interface.

[0053] In some embodiments, one or more computing devices similar to computing device 100 may be deployed to support the aPaaS architecture. The exact physical location, connectivity, and configuration of these computing devices may be unknown and / or insignificant to the client devices. Therefore, these computing devices may be referred to as “cloud-based” devices, and they may be located in various remote data center locations.

[0054] Figure 2 A cloud-based server cluster 200 is depicted according to an example embodiment. Figure 2 In this system, the operation of computing devices (e.g., computing device 100) can be distributed among server devices 202, data storage 204, and routers 206, all of which can be connected via a local cluster network 208. The number of server devices 202, data storage 204, and routers 206 in the server cluster 200 can depend on one or more computing tasks and / or applications assigned to the server cluster 200.

[0055] For example, server device 202 can be configured to perform various computing tasks of computing device 100. Therefore, computing tasks can be distributed across one or more server devices 202. This task distribution can reduce the total time to complete these tasks and return results, provided that these computing tasks can be executed in parallel. For simplicity, both server cluster 200 and a single server device 202 can be referred to as a "server device." This nomenclature should be understood to mean that server device operation may involve one or more different server devices, data storage devices, and cluster routers.

[0056] Data storage 204 may be a data storage array, which includes drive array controllers configured to manage read and write access to groups of hard disk drives and / or solid-state drives. The drive array controllers may be used independently or in conjunction with server devices 202, and are also configured to manage backups or redundant copies of data stored in data storage 204 to prevent drive failures or other types of failures that prevent one or more server devices 202 from accessing units of data storage 204. Other types of storage may be used in addition to drives.

[0057] Router 206 may include network devices configured to provide internal and external communication for server cluster 200. For example, router 206 may include one or more packet switching and / or routing devices (including switches and / or gateways) configured to provide (i) network communication between server device 202 and data storage 204 via local cluster network 208, and / or (ii) network communication between server cluster 200 and other devices via communication link 210 to network 212.

[0058] In addition, the configuration of router 206 may be based at least in part on the data communication requirements of server device 202 and data storage 204, the latency and throughput of local cluster network 208, the latency, throughput and cost of communication link 210, and other factors that may contribute to the cost, speed, fault tolerance, resilience, efficiency and / or other design goals of the system architecture.

[0059] As a possible example, data storage 204 may include any form of database, such as a Structured Query Language (SQL) database. Information in such a database can be stored using various types of data structures, including but not limited to tables, arrays, lists, trees, and tuples. Furthermore, any database in data storage 204 can be monolithic or distributed across multiple physical devices.

[0060] Server device 202 can be configured to transmit data to and receive data from data storage 204. This transmission and retrieval can take the form of SQL queries or other types of database queries, and the output of these queries. Additional text, images, video, and / or audio may also be included. Furthermore, server device 202 can organize the received data into web pages or web application representations. This representation can take the form of markup languages ​​such as Hypertext Markup Language (HTML), Extensible Markup Language (XML), or other standardized or proprietary formats. Moreover, server device 202 may be able to execute various types of computer scripting languages, such as, but not limited to, Perl, Python, PHP Hypertext Preprocessor (PHP), Active Server Pages (ASP), JavaScript®, etc. Computer program code written in these languages ​​can facilitate the delivery of web pages to client devices and the interaction between client devices and web pages. Alternatively or additionally, JAVA® can be used to facilitate the generation of web pages and / or the provision of web application functionality.

[0061] III. Example Remote Network Management Architecture

[0062] Figure 3 A remote network management architecture according to an example embodiment is described. The architecture includes three main components—a managed network 300, a remote network management platform 320, and a public cloud network 340—all connected via the Internet 350.

[0063] A. Managed network

[0064] The managed network 300 can be an enterprise network used by an entity for computing and communication tasks and data storage. Therefore, the managed network 300 may include client devices 302, server devices 304, routers 306, virtual machines 308, firewalls 310, and / or proxy servers 312. Client devices 302 may be represented by computing device 100, server devices 304 may be represented by computing device 100 or server cluster 200, and routers 306 may be any type of router, switch, or gateway.

[0065] Virtual machine 308 can be embodied by one or more computing devices 100 or server clusters 200. Generally, a virtual machine is a simulation of a computing system and mimics the functionality of a physical computer (e.g., processor, memory, and communication resources). A physical computing system, such as server cluster 200, can support up to thousands of independent virtual machines. In some embodiments, virtual machine 308 can be managed by a centralized server device or application that facilitates the allocation of physical computing resources to individual virtual machines, as well as performance and error reporting. Enterprises frequently use virtual machines to efficiently allocate computing resources on demand. Vendors of virtualized computing systems include VMware® and Microsoft®.

[0066] Firewall 310 can be one or more dedicated routers or server devices that protect the managed network 300 from unauthorized attempts to access its devices, applications, and services, while allowing authorized communication originating from within the managed network 300. Firewall 310 may also provide intrusion detection, network filtering, virus scanning, application-layer gatewaying, and other applications or services. Figure 3 In some embodiments not shown, the managed network 300 may include one or more virtual private network (VPN) gateways through which it communicates with the remote network management platform 320 (see below).

[0067] The managed network 300 may also include one or more proxy servers 312. Embodiments of the proxy server 312 may be server applications that facilitate communication and data movement between the managed network 300, the remote network management platform 320, and the public cloud network 340. Specifically, the proxy server 312 may be able to establish and maintain secure communication sessions with one or more computing instances of the remote network management platform 320. Through such sessions, the remote network management platform 320 may be able to discover and manage the architecture and configuration aspects of the managed network 300 and its components.

[0068] With the assistance of proxy server 312, remote network management platform 320 may also be able to discover and manage aspects of the public cloud network 340 used by managed network 300. Although Figure 3 As not shown, one or more proxy servers 312 can be deployed in any public cloud network 340 to facilitate this discovery and management.

[0069] Firewalls, such as firewall 310, typically reject all incoming communication sessions via the Internet 350 unless such sessions ultimately originate behind the firewall (i.e., from devices on the managed network 300) or the firewall is explicitly configured to support such sessions. By placing a proxy server 312 behind firewall 310 (e.g., within the managed network 300 and protected by firewall 310), proxy server 312 can be able to initiate these communication sessions through firewall 310. Therefore, firewall 310 may not need to be specifically configured to support incoming sessions from a remote network management platform 320, thus avoiding potential security risks to the managed network 300.

[0070] In some cases, a managed network 300 may consist of a small number of devices and a small number of networks. In other deployments, a managed network 300 can span multiple physical locations and include hundreds of networks and hundreds of thousands of devices. Therefore, Figure 3 The described architecture can be scaled up or down by orders of magnitude.

[0071] Furthermore, depending on the size, architecture, and connectivity of the managed network 300, a varying number of proxy servers 312 can be deployed within it. For example, each of the proxy servers 312 can be responsible for communicating with the remote network management platform 320 regarding a portion of the managed network 300. Alternatively or additionally, a set of two or more proxy servers can be allocated to this portion of the managed network 300 to achieve load balancing, redundancy, and / or high availability.

[0072] B. Remote Network Management Platform

[0073] The remote network management platform 320 is a hosted environment that provides aPaaS services to users, particularly the operators of the managed network 300. These services can take the form of a web-based portal, for example, using the aforementioned web-based technologies. Therefore, users can securely access the remote network management platform 320 from, for example, client device 302 (or possibly from client devices outside the managed network 300). Through these web-based portals, users can design, test, and deploy applications, generate reports, view analytics, and perform other tasks. The remote network management platform 320 can also be referred to as a multi-application platform.

[0074] like Figure 3As shown, the remote network management platform 320 includes four compute instances 322, 324, 326, and 328. Each of these compute instances can represent one or more server nodes and / or one or more database nodes running a dedicated copy of aPaaS software. The configuration of server and database nodes on physical server devices and / or virtual machines can be flexible and can vary based on enterprise needs. These nodes can be combined to provide a collection of web portals, services, and applications (e.g., a fully functional aPaaS system) available to a specific enterprise. In some cases, a single enterprise may use multiple compute instances.

[0075] For example, managed network 300 can be an enterprise customer of remote network management platform 320 and can use compute instances 322, 324, and 326. The reason for providing multiple compute instances to a customer is that the customer may want to independently develop, test, and deploy their applications and services. Therefore, compute instance 322 can be dedicated to application development related to managed network 300, compute instance 324 can be dedicated to testing these applications, and compute instance 326 can be dedicated to the live running of the tested applications and services. Compute instances can also be referred to as managed instances, remote instances, customer instances, or other names. Any application deployed to a compute instance can be a scoped application because its access to the database within the compute instance can be limited to certain elements within it (e.g., one or more specific database tables or specific rows in one or more database tables).

[0076] For clarity, this document will refer to the deployment of application nodes, database nodes, the aPaaS software running on them, and the underlying hardware as a "computation instance." It should be noted that users may colloquially refer to the graphical user interface provided by the instance as an "instance." However, unless otherwise defined herein, a "computation instance" is a computing system deployed within the remote network management platform 320.

[0077] The multi-instance architecture of the Remote Network Management Platform 320 contrasts with traditional multi-tenant architectures, offering advantages in several areas. In a multi-tenant architecture, data from different customers (e.g., enterprises) is mixed within a single database. While these customers' data is separated from each other, this separation is enforced by the software operating the single database. Therefore, security vulnerabilities in this system can affect the data of all customers, posing additional risks, especially for entities regulated by government, healthcare, and / or finance. Furthermore, any database operation affecting one customer can potentially affect all customers sharing that database. Thus, if a service interruption occurs due to hardware or software errors, such an interruption will affect all such customers. Similarly, if the database is upgraded to meet the needs of one customer, all customers will be unable to use the database during the upgrade process. Typically, such maintenance windows are long due to the size of the shared database.

[0078] In contrast, a multi-instance architecture provides each customer with their own database within a dedicated compute instance. This prevents the mixing of customer data and allows for independent management of each instance. For example, if one customer's instance experiences a service outage due to a bug or upgrade, other compute instances will not be affected. Because the database contains only one customer's data, maintenance downtime is limited. Furthermore, the simpler design of a multi-instance architecture allows redundant copies of each customer's database and instance to be deployed in a geographically distributed manner. This contributes to high availability, as a live version of the customer instance can be moved when a failure is detected or maintenance is in progress.

[0079] In some embodiments, the remote network management platform 320 may include one or more central instances controlled by the entity operating the platform. Similar to compute instances, the central instances may include several application and database nodes deployed on a number of physical server devices or virtual machines. Such a central instance can serve as a repository for specific configurations of compute instances and for data that can be shared among at least some of the compute instances. For example, definitions of common security threats that may occur on compute instances, software packages typically found on compute instances, and / or application stores for applications that can be deployed to compute instances can reside in the central instance. Compute instances can communicate with the central instance through well-defined interfaces to obtain this data.

[0080] To effectively support multiple compute instances, the remote network management platform 320 can implement multiple of these instances on a single hardware platform. For example, when an aPaaS system is implemented on a server cluster such as server cluster 200, it can operate virtual machines that allocate varying amounts of compute, storage, and communication resources to the instances. However, full virtualization of server cluster 200 may not be necessary, and other mechanisms can be used to decouple the instances. In some examples, each instance on server cluster 200 may have a dedicated account and one or more dedicated databases. Alternatively, compute instances such as compute instance 322 can span multiple physical devices.

[0081] In some cases, a single server cluster of the remote network management platform 320 can support multiple independent enterprises. Furthermore, as described below, the remote network management platform 320 can include multiple server clusters deployed in geographically dispersed data centers to facilitate load balancing, redundancy, and / or high availability.

[0082] C. Public cloud network

[0083] Public cloud network 340 can be remote server devices (e.g., multiple server clusters such as server cluster 200) that can be used for outsourced computing, data storage, communication, and service hosting operations. These servers may be virtualized (i.e., the servers may be virtual machines). Examples of public cloud network 340 may include Amazon AWS cloud, Microsoft Azure cloud, Google Cloud Platform (GCP), and IBM Cloud Platform. Similar to remote network management platform 320, multiple server clusters supporting public cloud network 340 can be deployed in geographically dispersed locations to achieve load balancing, redundancy, and / or high availability.

[0084] The managed network 300 can use one or more public cloud networks 340 to deploy applications and services to its customers and users. For example, if the managed network 300 provides an online music streaming service, the public cloud network 340 can store music files and provide network interfaces and streaming capabilities. In this way, the enterprise using the managed network 300 does not need to build and maintain its own servers for these operations.

[0085] The remote network management platform 320 may include modules integrated with the public cloud network 340 to expose its virtual machines and managed services to the managed network 300. These modules allow users to request virtual resources, discover allocated resources, and provide flexible reporting to the public cloud network 340. To establish this functionality, a user from the managed network 300 may first need to create an account on the public cloud network 340 and request the relevant resource set. The user can then input their account information into the corresponding modules of the remote network management platform 320. These modules can then automatically discover manageable resources within that account and provide reports related to usage, performance, and billing.

[0086] D. Communication support and other operations

[0087] Internet 350 can represent a portion of the global Internet. However, Internet 350 can also represent other types of networks, such as private wide area or local area packet-switched networks.

[0088] Figure 4 The communication environment between the managed network 300 and the computing instance 322 is further described, and other features and alternative embodiments are introduced. Figure 4 In this setup, compute instance 322 is replicated, either wholly or partially, in data centers 400A and 400B. These data centers may be geographically distant from each other, perhaps in different cities or countries. Each data center contains support equipment that facilitates communication with the managed network 300 and remote users.

[0089] In data center 400A, network traffic to and from external devices passes either through VPN gateway 402A or firewall 404A. VPN gateway 402A can establish a peering connection with VPN gateway 412 of managed network 300 via security protocols such as Internet Protocol Security (IPSEC) or Transport Layer Security (TLS). Firewall 404A can be configured to allow access from authorized users (such as user 414 and remote user 416) and deny access from unauthorized users. With the help of firewall 404A, these users can access compute instance 322 and potentially other compute instances. Load balancer 406A can be used to distribute traffic among one or more physical or virtual server devices hosting compute instance 322. Load balancer 406A can simplify user access by hiding the internal configuration of data center 400A (such as compute instance 322) from client devices. For example, if compute instance 322 includes multiple physical or virtual compute devices that share access to multiple databases, load balancer 406A can distribute network traffic and processing tasks among these compute devices and databases so that no one compute device or database is significantly busier than the others. In some embodiments, compute instance 322 may include VPN gateway 402A, firewall 404A, and load balancer 406A.

[0090] Data center 400B may contain components from its own version of data center 400A. Therefore, VPN gateway 402B, firewall 404B, and load balancer 406B can perform the same or similar operations as VPN gateway 402A, firewall 404A, and load balancer 406A, respectively. Furthermore, through real-time or near real-time database replication and / or other operations, compute instance 322 can coexist in both data centers 400A and 400B.

[0091] like Figure 4 The data center 400A and 400B shown can contribute to redundancy and high availability. Figure 4 In this configuration, data center 400A is active, while data center 400B is passive. Therefore, data center 400A is serving all traffic entering and leaving managed network 300, while compute instance 322 in data center 400B is being updated in near real-time. Other configurations, such as both data centers being active, may also be supported.

[0092] If data center 400A fails in some way or becomes unavailable to users in other ways, data center 400B can take over as the active data center. For example, the Domain Name System (DNS) server that associates the domain name of compute instance 322 with one or more Internet Protocol (IP) addresses of data center 400A can re-associate that domain name with one or more IP addresses of data center 400B. After this re-association is complete (which may take less than a second or a few seconds), users can access compute instance 322 via data center 400B.

[0093] Figure 4 The possible configurations for managed network 300 are also described. As mentioned above, proxy server 312 and user 414 can access compute instance 322 through firewall 310. Proxy server 312 can also access configuration item 410. Figure 4 In this context, configuration item 410 can refer to any or all of client device 302, server device 304, router 306, and virtual machine 308, any of their components, any applications or services running on them, and the relationships between devices, components, applications, and services. Therefore, the term "configuration item" can be an abbreviation for any physical or virtual device, or any application or service that can be remotely discovered or managed by compute instance 322, or the relationships between discovered devices, applications, and services. Configuration items can be represented in the configuration management database (CMDB) of compute instance 322.

[0094] When stored or transmitted, a configuration item can be a list of attributes characterizing the hardware or software it represents. These attributes may include manufacturer, supplier, location, owner, unique identifier, description, network address, operating status, serial number, last update time, etc. The category of a configuration item can determine which subsets of attributes exist for that configuration item (for example, software and hardware configuration items may have different lists of attributes).

[0095] As described above, VPN gateway 412 can provide a private VPN to VPN gateway 402A. Such a VPN may be helpful when there is a large amount of traffic between managed network 300 and compute instance 322, or when security policies otherwise recommend or require the use of a VPN between these sites. In some embodiments, any device in managed network 300 and / or compute instance 322 that communicates directly via VPN will be assigned a public IP address. Other devices in managed network 300 and / or compute instance 322 may be assigned private IP addresses (e.g., IP addresses selected from 10.0.0.0 – 10.255.255.255 or 192.168.0.0 – 192.168.255.255, shorthand for subnets 10.0.0.0 / 8 and 192.168.0.0 / 16). In various alternatives, devices in the managed network 300 (such as proxy server 312) can communicate directly with one or more data centers using security protocols such as Transport Layer Security (TLS).

[0096] IV. Example discovery

[0097] To enable the remote network management platform 320 to manage the devices, applications, and services of the managed network 300, the remote network management platform 320 can first determine which devices exist in the managed network 300, their configurations, components, and operational status, as well as the applications and services provided by these devices. The remote network management platform 320 can also determine the relationships between discovered devices, their components, applications, and services. Each device, component, application, and service can be represented as a configuration item. The process of determining configuration items and relationships within the managed network 300 is called discovery, and this process can be facilitated at least in part by the proxy server 312. The representation of configuration items and relationships is stored in a configuration management database.

[0098] While this section describes the discovery process performed on managed network 300, the same or similar discovery procedures can be applied to public cloud network 340. Therefore, in some environments, “discovery” can refer to the discovery of configuration items and relationships on managed network and / or one or more public cloud networks.

[0099] For the purposes of this embodiment, "application" can refer to one or more processes, threads, programs, client software modules, server software modules, or any other software that execute on a device or collection of devices. "Service" can refer to advanced capabilities provided by one or more applications working together on one or more devices. For example, a web service may involve multiple web application server threads executing on one device and accessing information from a database application executing on another device.

[0100] Figure 5 It provides a logical representation of how configuration items and relationships are discovered and how related information is stored. For simplicity, the remote network management platform 320, the public cloud network 340, and the Internet 350 are not shown.

[0101] exist Figure 5 In this configuration, the configuration management database CMDB500, task list 502, and identification and coordination engine (IRE) 514 are located within and / or run within compute instance 322. Task list 502 represents the connection point between compute instance 322 and agent server 312. Task list 502 may be referred to as a queue, or more specifically as an external communication channel (ECC) queue. Task list 502 represents not only the queue itself, but also any associated processing, such as adding, deleting, and / or manipulating information within the queue.

[0102] As discovery progresses, compute instance 322 can store discovery tasks (jobs) to be performed by agent server 312 in task list 502 until agent server 312 requests these tasks in one or more batches. Adding tasks to task list 502 can trigger or otherwise cause agent server 312 to begin its discovery operation. For example, agent server 312 may periodically or occasionally poll task list 502 or otherwise become aware of discovery commands in task list 502. Alternatively or concurrently, discovery can be triggered manually or automatically based on triggering events (e.g., discovery may automatically begin once a day at a specific time).

[0103] Regardless, computing instance 322 can send these discovery commands to proxy server 312 upon request. For example, proxy server 312 can repeatedly query task list 502, retrieve the next task, and execute that task until task list 502 is empty or another stopping condition has been met. In response to receiving a discovery command, proxy server 312 can query various devices, components, applications, and / or services in managed network 300 (for simplicity, ... Figure 5 (Represented by devices 504, 506, 508, 510, and 512). These devices, components, applications, and / or services can provide responses to the agent server 312 regarding their configuration, operation, and / or status. The agent server 312 can then provide this discovery information to the task list 502 (i.e., the task list 502 may have an outgoing queue for storing discovery commands until requested by the agent server 312, and an incoming queue for storing discovery information until it is read).

[0104] The Identification and Coordination Engine (IRE) 514, which may be a software module, removes discovery information from the task list 502 and organizes this discovery information into configuration items (e.g., representing devices, components, applications, and / or services discovered on the managed network 300) and the relationships between them. The IRE 514 can then provide these configuration items and relationships to the Configuration Management Database (CMDB) 500 for storage. The operation of the IRE 514 is described in more detail below.

[0105] In this way, configuration items stored in the configuration management database CMDB 500 represent the environment of the managed network 300. For example, these configuration items can represent a collection of physical and / or virtual devices (e.g., client devices, server devices, routers, or virtual machines), applications running on them (e.g., web servers, email servers, databases, or storage arrays), and services involving multiple independent configuration items. Relationships can be pairwise arrangements or dependency definitions between configuration items.

[0106] To perform discovery in the manner described above, proxy server 312, configuration management database CMDB 500, and / or one or more credential repositories may be configured with credentials for the devices to be discovered. Credentials may include any type of information required to access the device. This information may include user ID / password pairs, certificates, etc. In some embodiments, these credentials may be stored in encrypted fields of the configuration management database CMDB 500. Proxy server 312 may contain decryption keys for the credentials so that proxy server 312 can use these credentials to log in or otherwise access the devices to be discovered.

[0107] There are two general types of findings—horizontal and vertical (top-down). These will be discussed separately below.

[0108] A. Horizontal Discovery

[0109] Lateral discovery is used to scan the managed network 300 to find devices, components, and / or applications, and then populate the Configuration Management Database (CMDB) 500 with configuration items representing these devices, components, and / or applications. Lateral discovery also creates relationships between configuration items. For example, this might be a "run on" relationship between a configuration item representing a software application and a configuration item representing the server device running that application. Typically, lateral discovery is not service-aware and does not create relationships between configuration items based on the services that the configuration item runs on.

[0110] Lateral discovery has two versions. One relies on detectors and sensors, while the other also employs a pattern. Detectors and sensors can be scripts (e.g., written in JavaScript®) used to collect and process discovery information on the devices, then update the configuration management database CMDB 500 accordingly. More specifically, detectors explore or investigate devices on the managed network 300, while sensors parse the discovery information returned from the detectors.

[0111] Patterns are also scripts used to collect data from one or more devices, process that data, and update the configuration management database. Patterns differ from detectors and sensors in that they are written in a specific discovery programming language and are used to perform detailed discovery processes on specific devices, components, and / or applications that are typically not reliably discoverable (or cannot be discovered at all) by more general detectors and sensors. Specifically, patterns can specify a series of operations that define how to discover specific device, component, and / or application settings, which credentials to use, and which configuration management database tables to populate with the configuration items discovered thereby.

[0112] Both versions can be performed in four logical phases: scanning, classifying, identifying, and exploring. Similarly, both versions may require specifying a range of one or more IP addresses on the managed network 300 to be discovered. Each phase may involve communication between devices on the managed network 300 and the agent server 312, and between the agent server 312 and the task list 502. Some phases may involve storing partial or preliminary configuration items in the configuration management database CMDB 500, which may be updated in subsequent phases.

[0113] During the scanning phase, the proxy server 312 can probe open Transmission Control Protocol (TCP) and / or User Datagram Protocol (UDP) ports on each IP address within one or more specified IP address ranges to determine the general type of the device and its operating system. The presence of such open ports at a given IP address can indicate that a specific application is running on the device assigned that IP address, which in turn can identify the operating system used by the device. For example, if TCP port 135 is open, the device is likely running the Windows® operating system. Similarly, if TCP port 22 is open, the device is likely running a UNIX® operating system, such as Linux®. If UDP port 161 is open, the device can be further identified via Simple Network Management Protocol (SNMP). Other possibilities also exist.

[0114] During the classification phase, the proxy server 312 can also probe each discovered device to determine its operating system type. The probes used for a specific device are based on information about the device collected during the scanning phase. For example, if TCP port 22 of a discovered device is open, a UNIX®-specific probe set can be used. Similarly, if TCP port 135 of a discovered device is open, a WINDOWS®-specific probe set can be used. In either case, an appropriate set of tasks can be arranged in the task list 502 for the proxy server 312 to execute. These tasks can enable the proxy server 312 to log in or otherwise access information from the specific device. For example, if TCP port 22 is open, the proxy server 312 can be instructed to initiate a Secure Shell (SSH) connection to the specific device and retrieve information about the specific type of operating system running on it from a specific location in the file system. Based on this information, the operating system can be determined. As an example, a UNIX® device with an open TCP port 22 can be classified as AIX®, HPUX, LINUX®, MACOS®, or SOLARIS®. This classification information can be stored as one or more configuration items in the configuration management database CMDB 500.

[0115] During the identification phase, the agent server 312 can determine specific details about the classified device. The detectors used in this phase can be based on information about the specific device collected during the classification phase. For example, if the device is classified as LINUX®, a LINUX®-specific detector set can be used. Similarly, if the device is classified as WINDOWS® 10, a WINDOWS® 10-specific detector set can be used. Similar to the classification phase, an appropriate set of tasks can be arranged in the task list 502 for the agent server 312 to execute. These tasks allow the agent server 312 to read information from the specific device, such as Basic Input / Output System (BIOS) information, serial number, network interface information, one or more Media Access Control addresses assigned to these one or more network interfaces, one or more IP addresses used by the specific device, and so on. This identification information can be stored as one or more configuration items along with any related relationships in the configuration management database CMDB 500. This may involve having the identification information processed by the Identification and Coordination Engine IRE 514 to avoid generating duplicate configuration items, to disambiguate, and / or to determine which tables(s) in the Configuration Management Database CMDB 500 should be written to the discovery information.

[0116] During the exploration phase, agent server 312 can determine more details about the operational status of the classified devices. The probes used in this phase can be based on information about the specific devices collected during the classification and / or identification phases. Similarly, an appropriate set of tasks can be arranged in task list 502 for agent server 312 to execute. These tasks can cause agent server 312 to read additional information from the specific devices, such as processor information, memory information, a list of running processes (software applications), etc. Likewise, the discovered information can be stored as one or more configuration items and relationships in configuration management database CMDB 500.

[0117] Lateral discovery on certain devices, such as switches and routers, can utilize the Simple Network Management Protocol (SNMP). Besides identifying a list of running processes or other application-related information, discovery can also determine other subnets known to the router and the operational status of the router's network interfaces (e.g., active, inactive, queue length, number of dropped packets, etc.). The IP addresses of these additional subnets may be candidate targets for other discovery processes. Therefore, lateral discovery can be performed iteratively or recursively.

[0118] Patterns are used only in the identification and exploration phases—under pattern-based discovery, the scanning and classification phases operate in the same way as when using detectors and sensors. After the classification phase is complete, the pattern detector is designated as the detector to be used in the identification phase. The pattern detector and its designated pattern are then activated.

[0119] By leveraging discovery programming languages, patterns enable numerous functionalities that are unavailable or difficult to implement when using detectors and sensors for discovery. For example, pattern-based discovery makes it much easier to discover devices, components, and / or applications in public cloud networks, as well as to track profiles. Furthermore, these patterns are more easily customized by users than detectors and sensors. Additionally, patterns are more focused on specific devices, components, and / or applications, and therefore can be executed much faster than the more general approaches used by detectors and sensors.

[0120] Once lateral discovery is complete, the configuration entries for each discovered device, component, and / or application are available in the Configuration Management Database (CMDB) 500. For example, after discovery, the operating system versions, hardware configurations, and network configuration details of client devices, server devices, and routers in the managed network 300, as well as the applications running on them, can be stored as configuration entries. This collected information can be presented to the user in various ways, allowing the user to view the hardware composition and operational status of the devices.

[0121] Furthermore, the Configuration Management Database 500 can contain entries about the relationships between configuration items. More specifically, suppose a server device contains many hardware components (e.g., processor, memory, network interface, storage, and file system) and multiple software applications are installed on or running on it. The relationships between components and the server device (e.g., "contains in" relationships) and the relationships between software applications and the server device (e.g., "runs on" relationships) can be represented in the Configuration Management Database CMDB 500.

[0122] More generally, the relationships between software configuration items installed on or running on hardware configuration items can take many forms, such as "hosted on," "running on," or "dependent on." Therefore, a database application installed on a server device can have a "hosted on" relationship with the server device, indicating that the database application is hosted on the server device. In some embodiments, the server device can have a "used by" relationship with the database application, indicating that the server device is used by the database application. These relationships can be found automatically using the discovery process described above, although they can also be set manually.

[0123] In this way, the network management remote platform 320 can discover and inventory the hardware and software deployed and provided on the managed network 300.

[0124] B. Vertical Discovery

[0125] Vertical discovery is a technique used to find and map configuration items that are part of a whole service, such as a web service. For example, vertical discovery can map a web service by showing the relationships between a web server application, a Linux® server appliance, and a database that stores web service data. Typically, lateral discovery is run first to find configuration items and their basic relationships, and then vertical discovery is run to establish the relationships between the configuration items that make up the service.

[0126] Patterns can be used to discover certain types of services because they can be programmed to find specific arrangements of hardware and software that match a service deployment description. Alternatively, traffic analysis (e.g., examining network traffic between devices) can be used to aid in longitudinal discovery. In some cases, service parameters can be manually configured to assist in longitudinal discovery.

[0127] Generally, longitudinal discovery aims to discover specific types of relationships between devices, components, and / or applications. Some of these relationships can be inferred from configuration files. For example, a web server application's configuration file might reference the IP address and port number of the databases it depends on. Longitudinal discovery patterns can be programmed to look for such references and infer relationships from them. Relationships can also be inferred from traffic between devices—for example, if there is a large amount of web traffic (e.g., TCP port 80 or 8080) between a load balancer and the device hosting the web server, then a relationship likely exists between the load balancer and the web server.

[0128] Relationships discovered through vertical discovery can take various forms. For example, an email service may include email server software configuration items and database application software configuration items, each installed on different hardware device configuration items. The email service may have a "dependency" relationship with both of these software configuration items, while the software configuration items and the email service may have a "being used" relationship. Such services may not be fully identified through lateral discovery procedures and may require reliance on vertical discovery, along with, possibly, some degree of manual configuration.

[0129] C. Advantages of Discovery

[0130] Regardless of how the discovery information is obtained, it is of significant value to the operation of a managed network. Notably, IT professionals can quickly determine where certain software applications are deployed and which configuration items constitute a service. This enables the rapid identification of the root cause of service outages or performance degradation. For example, if two different services are responding slowly, the configuration management database can be queried (perhaps in conjunction with other activities) to determine that the root cause is excessive processor utilization by the database application used by both services. Therefore, IT professionals can focus on the database application rather than wasting time considering the health and performance of other configuration items that make up the service.

[0131] In another example, suppose a database application is running on a server device, and this application is used by employee onboarding and payroll services. Therefore, if the server device goes down for maintenance, it's obvious that the employee onboarding and payroll services will be affected. Similarly, dependencies and relationships between configuration items can represent the services affected when a specific hardware device fails.

[0132] Typically, configuration items and / or relationships between them can be displayed on a web-based interface in a hierarchical manner. This interface allows modification of such configuration items and / or relationships within the configuration management database.

[0133] Furthermore, managed network 300 users can develop workflows that allow certain coordinated activities to be performed across multiple discovered devices. For example, an IT workflow could allow a user to change the public administrator password for all discovered LINUX® devices in a single operation.

[0134] V. Configuration management database identification rules and coordination

[0135] Configuration management databases, such as CMDB500, provide a repository of configuration items and relationships. When properly configured, they can play a critical role in applications deployed within compute instances or involving higher-level applications. These applications may be related to IT service management, operations management, asset management, configuration management, compliance, and more.

[0136] For example, IT service management applications can use information from the configuration management database to identify applications and services that may be affected by a component failure, crash, or overload. Similarly, asset management applications can use information from the configuration management database to determine which hardware and / or software components are being used to support specific enterprise applications. Given the importance of configuration management databases, it is expected that the information stored within them is accurate, consistent, and up-to-date.

[0137] The configuration management database can be populated in several ways. As mentioned above, the discovery process can automatically store information including configuration items and relationships in the configuration management database. However, it can also be populated (entirely or partially) through manual input, configuration files, and third-party data sources. Given that multiple data sources can update the configuration management database at any time, one data source may overwrite entries from another. Furthermore, two data sources may each create slightly different entries for the same configuration item, resulting in duplicate data in the configuration management database. Either of these situations reduces the health and usability of the configuration management database.

[0138] To mitigate this situation, these data sources may not write configuration items directly to the configuration management database. Instead, they may write them to the Identification and Coordination Application Programming Interface (API) of the Identification and Coordination Engine IRE 514. The Identification and Coordination Engine IRE 514 can then use a configurable set of identification rules to uniquely identify the configuration items and determine whether and how to write them to the configuration management database.

[0139] Typically, an identification rule specifies the set of configuration item attributes that can be used for this unique identification. Identification rules can also have priorities, so that rules with higher priorities are considered before rules with lower priorities. Additionally, a rule can be independent, meaning it identifies a configuration item independently of other configuration items. Alternatively, a rule can be dependent, meaning it first uses metadata rules to identify dependent configuration items.

[0140] Metadata rules describe which other configuration items are included in a specific configuration item, or on which host a specific configuration item is deployed. For example, a network directory service configuration item may contain domain controller configuration items, while a web server application configuration item may be hosted on a server device configuration item.

[0141] The goal of each identification rule is to use a combination of attributes that can clearly distinguish one configuration item from all other configuration items, and that this combination is expected to remain unchanged throughout the configuration item's lifecycle. Some possible attributes for example server devices include serial number, location, operating system, operating system version, memory capacity, etc. If the attributes specified by a rule cannot uniquely identify a configuration item, multiple components can be represented as the same configuration item in the configuration management database. Furthermore, if the attributes specified by a rule change for a specific configuration item, duplicate configuration items can be created.

[0142] Therefore, when a data source provides information about a configuration item to the Identification and Coordination Engine (IRE 514), the IRE 514 can attempt to match that information against one or more rules. If a match is found, the configuration item is written to the configuration management database, or updated if it already exists in the database. If no match is found, the configuration item can be retained for further analysis.

[0143] The configuration item reconciliation process can be used to ensure that only authoritative data sources are allowed to overwrite configuration item data in the configuration management database. This reconciliation can also be rule-based. For example, a reconciliation rule can specify that a particular data source is authoritative for a specific configuration item type and property set. The IRE 514 reconciliation engine can then identify and reconcile only this authoritative data source to write to that specific configuration item, preventing writes from unauthorized data sources. Thus, the authoritative data source becomes the single source of truth regarding that specific configuration item. In some cases, writing to a configuration item may be allowed if an unauthorized data source is creating the configuration item or if the property it is writing to is empty.

[0144] Furthermore, multiple data sources can have authority over the same configuration item or its properties. To avoid ambiguity, precedents can be assigned to these data sources when writing to the configuration item. For example, a secondary authorization data source might be able to write to a certain property of a configuration item until the primary authorization data source writes to that property. Afterward, the secondary authorization data source can be prevented from writing to that property further.

[0145] In some cases, duplicate configuration items can be identified automatically by the Harmonization Engine IRE 514 or otherwise. These configuration items can be deleted or marked for manual deduplication.

[0146] VI. Proxy server usage and key management

[0147] As described above, the proxy server 312 may store and / or authorize access to the device to be discovered. Here, credentials may contain any type of information required to access the device. These may include user ID / password pairs, one-time passwords, certificates, application programming interface keys, tokens, etc. Generally, the terms "credentials," "security credentials," "keys," and "secrets" are used interchangeably in this document to refer to one or more of these types of information.

[0148] In some implementations, credentials may be stored in proxy server 312. In other implementations, credentials may be stored in encrypted fields of one or more tables in the configuration management database CMDB 500, or stored as encrypted data in an external security vault (e.g., on managed network 300 or a server device accessible to proxy server 312). In these deployments, proxy server 312 may contain credential keys for the credentials so that proxy server 312 can request encrypted credentials and use these credentials to log in to or otherwise access discoverable devices on managed network 300 or public cloud network 340. It is important to note that entities running configuration management database CMDB 500 and / or external security vaults cannot view unencrypted credentials because they do not have access to the credential keys. In some cases, these entities may have access to an encrypted version of the credential keys but cannot derive the credential keys from it.

[0149] A credential key can be a symmetric key, meaning it can only decrypt credentials encrypted with the same key. Alternatively, a credential key can be an asymmetric key, for example, the private key of a public / private key pair. In the latter case, the credential key can be used to decrypt credentials encrypted with the associated public key (e.g., the private and public keys are mathematically related, making this possible in a secure manner).

[0150] This setup enhances security because it involves a zero-trust framework. From the perspective of the managed network 300, the entity running the configuration management database CMDB 500 and / or an external security vault transparently stores encrypted credentials and delivers them to the proxy server 312 on demand. Only the proxy server 312, possessing the correct credential keys, can decrypt and use these credentials. This prevents the entity running the configuration management database CMDB 500 and / or the external security vault from knowing user ID / password pairs, one-time passwords, certificates, application programming interface keys, tokens, etc., used internally by the managed network 300 or used by the managed network 300 to access the public cloud network 340.

[0151] Therefore, a mapping exists between encrypted credentials and proxy servers 312 that are allowed to request and receive these credentials (e.g., from the configuration management database CMDB500 and / or an external security library). If such a proxy server is configured with the correct credential key, it can decrypt the encrypted credentials and use the resulting plaintext version of the credentials to access devices on the managed network 300 or the public cloud network 340.

[0152] Throughout this discussion, the term "proxy server" can refer to what is commonly known as a management, monitoring, and discovery server, or a MID server. As mentioned above, a proxy server facilitates communication and data exchange between compute instances and external systems or resources located in a managed network or on-premises environment. A proxy server allows compute instances to interact with devices, applications, databases, and other systems that may not be directly accessible from the public internet.

[0153] Figure 6 An example of a credential management transaction is depicted. This transaction involves a proxy server 602 (e.g., deployed within a managed network 300), an instance / configuration management database CMDB 604 (e.g., deployed within a network management remote platform 320), and a computing device 600. For simplicity and without loss of generality, it is assumed that only one proxy server 602 is involved in this transaction. Furthermore, the computing device 600 may be located within the managed network 300 or a public cloud network 340 and is assumed to be the target of discovery or other processes.

[0154] In step 610, the discovery process is initiated. This may occur because the proxy server 602 receives a command from the remote network management platform 320 or otherwise. For example, step 610 may be initiated by receiving a message or command from the instance / configuration management database CMDB 604.

[0155] In step 612, proxy server 602 may determine that credentials are needed from instance / configuration management database CMDB 604. For example, proxy server 602 may determine that credentials are needed to access computing device 600 based on command content.

[0156] In step 614, the proxy server 602 may send a credential request to the instance / configuration management database CMDB 604. This credential request may identify the required credentials, for example, by specifying the network address or other identifier of the computing device 600.

[0157] In step 616, the instance / configuration management database 604 can determine that the proxy server 602 is permitted to obtain credentials. As previously mentioned, access to certain credentials can be restricted to specific proxy servers.

[0158] In step 618, the instance / configuration management database CMDB 604 can send the requested credentials in encrypted form to the proxy server 602. It is worth noting that the instance / configuration management database CMDB 604 may not be able to access the requested credentials in any unencrypted form.

[0159] In step 620, the proxy server 602 can decrypt the encrypted credentials using an appropriate credential key. The proxy server 602 may be configured with more than one credential key, and the key used can be identified by, for example, the network address of the computing device 600 or other identifiers.

[0160] In step 622, a discovery process between the proxy server 602 and the computing device 600 is performed using the decrypted credentials. This process may involve multiple steps, at least some of which utilize credentials to access the computing device 600, such as probing the port number of device 600 and / or remotely logging into the device. Alternatively, other non-discovery processes may be performed.

[0161] Because managed networks can be geographically widespread and contain millions of computing devices, software applications, and other discoverable objects as configurable items, they can deploy dozens, hundreds, or thousands of proxy servers. Each proxy server must be able to obtain the credentials required to perform any process (discovery or other) it is commanded to execute. In other words, the instance / configuration management database CMDB 604 should be configured to specify which proxy servers can access which credentials. However, this association between credentials and the proxy servers that use those credentials is currently configured per proxy server, resulting in significant inefficiencies as the number of proxy servers per managed network grows.

[0162] In particular, for purposes such as performance, load balancing, and redundancy, managed networks may wish to group two or more proxy servers into sets. These sets can be configured based on geographical location (e.g., all proxy servers in the set are in the same approximate location) or the type of computing devices or services the proxy servers are expected to access (e.g., the same approximate location may contain multiple sets of proxy servers for different functions). Therefore, it would be advantageous to be able to share access to credentials (and the credentials themselves) across multiple proxy servers in an efficient, scalable manner with minimal configuration overhead. For example, such sets could be configured to associate a list of unique identifiers constituting the proxy servers (e.g., their network addresses) with indications of the corresponding credentials.

[0163] Figure 7 A flowchart illustrating shared access to credentials across proxy servers is provided. Here, it is assumed that proxy server 602 is configured to be one of a set of one or more proxy servers capable of accessing certain credentials, and new proxy servers are being added to this set. The goal is to achieve this efficiently, securely, and without exposing any credentials or credential keys to the instance / configuration management database CMDB 604.

[0164] In step 700, the Instance / Configuration Management Database (CMDB) 604 can determine that a new proxy server needs to be added to the collection, or that some credential policies for that collection have been changed. This could be due to manual configuration on the Instance / Configuration Management Database (CMDB) 604, a planned key replacement process, or other reasons.

[0165] In step 702, the Instance / Configuration Management Database (CMDB) 604 can identify the proxy servers within this set. There may be one or more such proxy servers.

[0166] In step 704, the instance / configuration management database CMDB 604 can select a proxy server from this set. Although any proxy server in this set can be selected, for simplicity, it is assumed that proxy server 602 is selected. This selection can be random or based on some pre-established order of the proxy servers.

[0167] In step 706, the instance / configuration management database CMDB 604 can send a request to the proxy server 602 to enable the new proxy server to access the credential key.

[0168] In step 708, proxy server 602 can verify that the new proxy server is in the set of servers with credentialed access rights. This means that proxy server 602 is configured with or has access to the list of proxy servers in the set.

[0169] In step 710, proxy server 602 can verify the certificate of the new proxy server. This step verifies the identity of the new proxy server and prevents granting access to credentials to unknown or malicious proxy servers.

[0170] In step 712, the proxy server 602 can encapsulate the credential key with another layer of encryption (e.g., another layer of symmetric or asymmetric encryption). This encryption should be usable by the new proxy server (e.g., using the new proxy server's public key to encrypt the credential key so that the new proxy server's private key can decrypt the credential key).

[0171] In step 714, the proxy server 602 can transmit the encapsulated credential key to the instance / configuration management database CMDB 604.

[0172] In step 716, the instance / configuration management database CMDB 604 can store the encapsulated credential key, associating it with the new proxy server. Then, at a later point in time, the new proxy server can request and receive the encapsulated credential key, decrypt it, and store it locally for at least a period of time. The new proxy server can then... Figure 6 The credential key is used in the transaction to obtain the credential.

[0173] The data transfer between the proxy server 602 and the instance / configuration management database CMDB 604 can take various forms, such as Extensible Markup Language, JavaScript Object Notation (JSON), plaintext, binary encoded values, etc. These interfaces between the proxy server 602 and the instance / configuration management database CMDB 604 can be based on, for example, Representational State Transfer (REST), Simple Object Access Protocol (SOAP), WebSocket, etc. Any of these transfers can be encrypted and / or authenticated, for example, through transport layer security, virtual private networks, etc.

[0174] As stated above, the term "encapsulation" is used herein to refer to encrypting a unit of information (e.g., a credential). Therefore, an "encapsulated credential" is an encrypted credential, and its plaintext form cannot be obtained without access to the encryption / decryption key (e.g., the credential key).

[0175] In some implementations, the instance / configuration management database CMDB 604 is configured to support a dedicated credential key for each proxy server. However, if multiple proxy servers are grouped into a set and have the same or similar functionality (e.g., discovering configuration items on a specific segment of a managed network), configuring the instance / configuration management database CMDB 604 to support a more flexible approach may be beneficial. This flexible approach has already been assumed in the above discussion (e.g., Figure 6 and Figure 7 However, it will be defined more clearly below.

[0176] Figure 8 This is a flowchart for generating and sharing credentials and associated credential keys. The flowchart illustrates two scenarios: one where a set of reusable credential keys already exists for the proxy server set, and another where no such set of reusable credential keys exists yet. Both scenarios are discussed from the perspective of the instance / configuration management database (CMDB).

[0177] In step 800, obtain the new credentials. For example, this credential can be manually entered into the instance / configuration management database (CMDB).

[0178] In step 802, the Instance / Configuration Management Database (CMDB) can create a temporary key to encrypt the credential. Temporary keys can be used to provide temporary encryption of the credential. They are typically generated for short-term purposes and are discarded once that purpose is achieved. Temporary keys enhance security by reducing the risk of key leakage and ensuring forward security, meaning that even if a temporary key is leaked in the future, it cannot be used to decrypt the credential once it is re-encrypted (e.g., with a different key).

[0179] In step 804, the instance / configuration management database CMDB can encapsulate (encrypt) new credentials using a temporary key.

[0180] In step 806, the Instance / Configuration Management Database (CMDB) can determine that the set of proxy servers should share the new credentials.

[0181] In step 808, the instance / configuration management database can determine whether a reusable credential key exists for the set of proxy servers. For example, the credential key may have already been established for these proxy servers using previous configuration. If such a credential key exists, steps 810, 812, and 814 are executed.

[0182] In step 810, the instance / configuration management database (CMDB) can obtain the credential key from any proxy server that has a copy of the key. For example... Figure 7 As discussed in the discussion, at least one proxy server in the set will have a copy of the credential key.

[0183] In step 812, the instance / configuration management database (CMDB) can re-encrypt (replace the key) the credential using the credential key. This may involve first decrypting the credential using a temporary key. The temporary key can then be deleted.

[0184] In step 814, the instance / configuration management database CMDB may store the re-encrypted credentials (e.g., in a table in the configuration management database CMDB or in another database).

[0185] If the instance / configuration management database CMDB determines at step 808 that the credential key does not exist, then proceed to steps 816, 818, 820, 822, and 824.

[0186] In step 816, the Instance / Configuration Management Database (CMDB) can generate a credential key. Such a key can be generated using a random number generator (RNG) or a pseudo-random number generator (PRNG). These generators produce seemingly random sequences of numbers based on an initial seed value. The generated key is typically of a fixed length required for the encryption process. For asymmetric encryption processes, such as RSA (Rivest-Shamir-Adleman), specific techniques can be used to select prime number pairs and derive mathematically related public and private keys.

[0187] In step 818, the Instance / Configuration Management Database (CMDB) can send the generated credential key to the proxy server. This may involve encapsulating the credential key with an additional layer of encryption that can be decrypted by the proxy server.

[0188] In step 820, the Instance / Configuration Management Database (CMDB) can receive a packaged version of the credential key from each proxy server. These packaged versions can be encrypted in a different way by each proxy server.

[0189] Steps 822 and 824 are similar in function to steps 812 and 814. Additionally, the instance / configuration management database (CMDB) can re-encrypt other (previously configured) shared credentials for the proxy server using the credential key.

[0190] With regard to any computing device using a plaintext version of any credential or key, these objects can be stored in plaintext only when needed and deleted when no longer needed or after a fixed period of time. Furthermore, such plaintext versions can be stored only in volatile memory (e.g., random access memory) and not persistently stored in non-volatile memory. This reduces the likelihood of credentials or keys being leaked or accidentally exposed.

[0191] VII. Example technology improvement

[0192] These embodiments provide technical solutions to technical problems. One technical problem being addressed is the secure distribution of shared credentials among multiple client devices (e.g., proxy servers). In practice, this is problematic because there are numerous such client-side devices, which can be grouped into sets with the same or similar functionalities. Equipping each proxy server with dedicated credentials requires significant memory to store these credentials. Existing technologies have largely failed to address these issues, resulting in wasted storage capacity and increased system complexity.

[0193] The embodiments described in this paper overcome these limitations by providing a mechanism for securely allocating and distributing access to shared credentials across a set of two or more proxy servers. This brings several advantages. First, less memory is required for credential storage because the number of credentials can be reduced by an order of magnitude in some cases. Second, proxy servers can be easily added to the set with minimal configuration overhead. Third, key replacement of encrypted credentials can be performed efficiently when new shared credentials are introduced. Fourth, all of this can occur in a zero-trust manner, and unencrypted credentials cannot be accessed even when they are stored on a remote server (e.g., an instance / configuration management database CMDB of a remote network management platform).

[0194] Other technical improvements may also be derived from these embodiments, and other technical problems may also be solved. Therefore, this description of technical improvements is not limiting, but rather constitutes examples of advantages that can be implemented from the embodiments.

[0195] VIII. Example Operation

[0196] Figure 9 and Figure 10 This is a flowchart illustrating an example embodiment. Figure 9 and Figure 10 The processes shown can be performed by computing devices (e.g., computing device 100) and / or clusters of computing devices (e.g., server cluster 200). However, these processes can also be performed by other types of devices or device subsystems. For example, these processes can be performed by a proxy server, a computing instance of a remote network management platform, or a portable computer (e.g., a laptop or tablet device).

[0197] By removing Figure 9 and Figure 10 Any one or more features shown may simplify these embodiments. Furthermore, these embodiments may be combined with features, aspects, and / or implementations described or otherwise depicted in any of the foregoing figures. Figure 9 This implementation can be executed by a computing instance of a remote network management platform. Figure 10 This implementation can be performed by a proxy server. However, other possibilities also exist.

[0198] Figure 9 Box 900 may involve: determining that a first proxy server is to share security credentials with a set of one or more proxy servers, wherein the set of one or more proxy servers is associated with full credentials, and wherein the set of one or more proxy servers includes a second proxy server.

[0199] Box 902 may involve sending a request to the second proxy server to enable the first proxy server to access the security credentials.

[0200] Box 904 may involve: receiving a credential key in encrypted form from a second proxy server, wherein the credential key is configured to decrypt security credentials.

[0201] Some examples may also involve: receiving a request for a credential key from a first proxy server; and sending the credential key in encrypted form to the first proxy server.

[0202] Some examples may also involve: receiving a request for security credentials from a first proxy server; and sending security credentials in encrypted form to the first proxy server.

[0203] In some examples, the first proxy server is set up on the managed network, and the first proxy server is configured to: decrypt security credentials using the credential key; and remotely access computing devices on the managed network using the security credentials.

[0204] In some examples, a set of one or more proxy servers is represented by a list of their respective unique identifiers, wherein determining that the first proxy server is to share security credentials with the set of one or more proxy servers includes determining that the unique identifier of the first proxy server has been added to the list.

[0205] In some examples, determining that the first proxy server should share security credentials with a set of one or more proxy servers includes determining that security credentials have been newly configured for the set of one or more proxy servers.

[0206] Some examples may also involve, before determining that the first proxy server will share security credentials with a set of one or more proxy servers: generating a temporary key, encrypting the security credentials using the temporary key, and storing the encrypted security credentials.

[0207] Some examples may also involve: determining that a credential key exists; obtaining the credential key from a proxy server in a set of one or more proxy servers; decrypting a security credential using a temporary key; and re-encrypting a security credential using the credential key.

[0208] Some examples may also involve: determining that the credential key does not exist; generating the credential key; sending the credential key to a proxy server in a set of one or more proxy servers; receiving the encrypted credential key from a proxy server; decrypting the security credential using a temporary key; and re-encrypting the security credential using the credential key.

[0209] Some examples may also involve identifying a second proxy server from a set of one or more proxy servers based on random selection or sorting of the set of one or more proxy servers before sending a request.

[0210] In some examples, the server device: stores security credentials in encrypted form, sends requests to a second proxy server, receives encrypted credential keys from the second proxy server, and stores the encrypted credential keys.

[0211] Some examples may also involve: determining that a third proxy server wants to share security credentials with a set of one or more proxy servers, one or more of which includes a fourth proxy server; sending a request to the fourth proxy server to enable the third proxy server to access the security credentials; and receiving the credential key in encrypted form from the fourth proxy server.

[0212] In some examples, the credential key is a symmetric or asymmetric encryption key.

[0213] Figure 10 Box 1000 may involve: receiving a request that enables a first proxy server to access security credentials, wherein the request is received by a second proxy server in a set of one or more proxy servers.

[0214] Box 1002 may involve: verifying that the first proxy server is a member of the set and has the appropriate authorization to access security credentials.

[0215] Box 1004 may involve: encrypting the credential key into an encrypted form.

[0216] Box 1006 may involve sending an encrypted credential key to a location accessible by the first proxy server.

[0217] In some examples, a first proxy server and a second proxy server are set up on a managed network, wherein the first proxy server receives requests from computing devices that are not set up on the managed network, and wherein the first proxy server sends the credential key in encrypted form to the computing device.

[0218] In some examples, a set of one or more proxy servers is represented by a list of their respective unique identifiers, and a request to enable the first proxy server to access security credentials is based on determining that the first proxy server's unique identifier has been added to the list.

[0219] In some examples, the request to enable the first proxy server to access the security credentials is based on the determination that security credentials have been newly configured for a set of one or more proxy servers.

[0220] Some examples may also involve: the first proxy server sending a request for a credential key; and the first proxy server receiving the credential key in encrypted form; the first proxy server sending a request for a security credential; and the first proxy server receiving the security credential in encrypted form.

[0221] In some examples, the first proxy server is set up on the managed network. These examples may involve: the first proxy server decrypting security credentials using a credential key; and the first proxy server using the security credentials to remotely access computing devices on the managed network.

[0222] IX. End

[0223] This disclosure should not be limited to the specific embodiments described herein, which are intended to illustrate various aspects. Many modifications and variations can be made without departing from its scope, as will be apparent to those skilled in the art. In addition to those described herein, functionally equivalent methods and apparatuses falling within the scope of this disclosure will also become apparent to those skilled in the art from the foregoing description. Such modifications and variations are intended to fall within the scope of the appended claims.

[0224] The above detailed description, with reference to the accompanying drawings, illustrates various features and operations of the disclosed systems, devices, and methods. The exemplary embodiments described herein and in the accompanying drawings are not intended to be limiting. Other embodiments and modifications may be utilized without departing from the scope of the subject matter presented herein. It will be readily understood that the various aspects of this disclosure described herein and illustrated in the accompanying drawings can be arranged, substituted, combined, separated, and designed in a variety of different configurations.

[0225] For any or all message flow diagrams, scenarios, and flowcharts shown in the accompanying drawings and discussed herein, each step, block, and / or communication may represent information processing and / or information transmission according to exemplary embodiments. Alternative embodiments are included within the scope of these exemplary embodiments. In these alternative embodiments, for example, operations described as steps, blocks, transmissions, communications, requests, responses, and / or messages may be performed in a different order than shown or discussed, including substantially simultaneously or in reverse order, depending on the functionality involved. Furthermore, more or fewer blocks and / or operations may be combined with any message flow diagrams, scenarios, and flowcharts discussed herein, and these message flow diagrams, scenarios, and flowcharts may be partially or wholly combined with each other.

[0226] A step or block representing information processing may correspond to a circuit that can be configured to perform a specific logical function of the method or technique described herein. Alternatively or additionally, a step or block representing information processing may correspond to a module, segment, or portion of program code (including associated data). This program code may include one or more processor-executable instructions for implementing a specific logical operation or action in the method or technique. This program code and / or associated data may be stored on any type of computer-readable medium, such as a storage device including random access memory, a disk drive, a solid-state drive, or another storage medium.

[0227] Computer-readable media may also include non-transitory computer-readable media, such as non-transitory computer-readable media that store short-term data (e.g., register memory and processor cache). Non-transitory computer-readable media may also include non-transitory computer-readable media that store program code and / or long-term data. Therefore, non-transitory computer-readable media may include secondary or persistent long-term storage, such as read-only memory, optical discs or disks, solid-state drives, or optical disc read-only memory. Non-transitory computer-readable media may also be any other volatile or non-volatile storage system. For example, a non-transitory computer-readable medium may be considered a computer-readable storage medium or a tangible storage device.

[0228] Furthermore, a step or block representing one or more information transfers may correspond to information transfers between software and / or hardware modules within the same physical device. However, other information transfers may occur between software and / or hardware modules in different physical devices.

[0229] The specific arrangement shown in the figures should not be considered limiting. It should be understood that other embodiments may include more or fewer elements shown in a given figure. Furthermore, some illustrated elements may be combined or omitted. Moreover, the example embodiments may include elements not shown in the figures.

[0230] While various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for illustrative purposes only and are not intended to be limiting; the true scope is indicated by the following claims.

Claims

1. A method comprising: A first proxy server is determined to share security credentials with a set of one or more proxy servers, wherein the set of one or more proxy servers is associated with the security credentials, and wherein the set of one or more proxy servers includes a second proxy server. Send a request to the second proxy server to enable the first proxy server to access the security credentials; as well as Receive an encrypted credential key from the second proxy server, wherein the credential key is configured to decrypt the security credential.

2. The method according to claim 1, further comprising: Receive a request for the credential key from the first proxy server; as well as Send the encrypted credential key to the first proxy server.

3. The method according to claim 2, further comprising: Receive a request for the security credentials from the first proxy server; as well as Send the security credentials in encrypted form to the first proxy server.

4. The method of claim 3, wherein the first proxy server is located on a managed network, and wherein the first proxy server is configured to: Decrypt the security credential using the credential key; and Use the security credentials to remotely access computing devices on the managed network.

5. The method of claim 1, wherein the set of one or more proxy servers is represented by a list of their respective unique identifiers, and wherein determining that a first proxy server is to share security credentials with the set of one or more proxy servers includes determining that the unique identifier of the first proxy server has been added to the list.

6. The method of claim 1, wherein determining that the first proxy server is to share security credentials with a set of one or more proxy servers includes determining that the security credentials have been newly configured for the set of one or more proxy servers.

7. The method of claim 6, further comprising, before determining that the first proxy server intends to share the security credentials with the set of one or more proxy servers: Generate a temporary key, encrypt the security credential using the temporary key, and store the encrypted security credential.

8. The method according to claim 7, further comprising: It is confirmed that the credential key exists; The credential key is obtained from a proxy server in the set of one or more proxy servers; The security credential is decrypted using the temporary key; as well as The security credential is re-encrypted using the credential key.

9. The method according to claim 7, further comprising: It has been determined that the credential key does not exist; Generate the credential key; Send the credential key to one of the proxy servers in the set of one or more proxy servers; Receive the encrypted credential key from the proxy server; The security credential is decrypted using the temporary key; as well as The security credential is re-encrypted using the credential key.

10. The method according to claim 1, further comprising: Before sending the request, the second proxy server is identified from the set of one or more proxy servers based on random selection or sorting of the set of one or more proxy servers.

11. The method of claim 1, wherein the server device: The security credentials are stored in encrypted form. The request is sent to the second proxy server. Receive the encrypted credential key from the second proxy server, and The credential key is stored in encrypted form.

12. The method according to claim 1, further comprising: It is determined that the third proxy server needs to share the security credentials with the set of one or more proxy servers, wherein the set of one or more proxy servers includes a fourth proxy server; Send a request to the fourth proxy server to enable the third proxy server to access the security credentials; as well as Receive the encrypted credential key from the fourth proxy server.

13. The method according to claim 1, wherein the credential key is a symmetric or asymmetric encryption key.

14. A method comprising: Receive a request that enables a first proxy server to access security credentials, wherein the request is received by a second proxy server in a set of one or more proxy servers; Verify that the first proxy server is a member of the set and has the appropriate authorization to access the security credentials; Encrypt the credential key into an encrypted form; and Send the encrypted credential key to a location accessible by the first proxy server.

15. The method of claim 14, wherein the first proxy server and the second proxy server are located on a managed network, wherein the first proxy server receives the request from a computing device not located on the managed network, and wherein the first proxy server sends the encrypted credential key to the computing device.

16. The method of claim 14, wherein the set of one or more proxy servers is represented by a list of their respective unique identifiers, and wherein a request to enable the first proxy server to access the security credentials is based on determining that the unique identifier of the first proxy server has been added to the list.

17. The method of claim 14, wherein the request to enable the first proxy server to access the security credentials is based on determining that the security credentials have been newly configured for the set of one or more proxy servers.

18. The method of claim 14, further comprising: The first proxy server sends a request for the credential key; The first proxy server receives the encrypted credential key; The first proxy server sends a request for the security credentials; and The first proxy server receives the security credentials in encrypted form.

19. The method of claim 18, wherein the first proxy server is configured on a managed network, the method further comprising: The first proxy server uses the credential key to decrypt the security credential; as well as The first proxy server uses the security credentials to remotely access computing devices on the managed network.

20. A non-transitory computer-readable medium having stored thereon program instructions, which, when executed by a computing system, cause the computing system to perform operations including: A first proxy server is determined to share security credentials with a set of one or more proxy servers, wherein the set of one or more proxy servers is associated with the security credentials, and wherein the set of one or more proxy servers includes a second proxy server. Send a request to the second proxy server to enable the first proxy server to access the security credentials; as well as Receive an encrypted credential key from the second proxy server, wherein the credential key is configured to decrypt the security credential.

Images