Break-Glass Credential Access via Ephemeral Key Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for accessing privileged break-glass accounts in emergency situations are either insecure, requiring tight control over vault access, or inefficient, requiring unique vendor-generated credentials and potential misuse risks.
Innovation Solution
A system that receives request data from a remote computer to access a computing resource, where the request data includes a concealed value containing a deployment public key encrypted with an ephemeral secret key. The system unlocks this value using a vendor secret key, enabling the remote computer to determine a data encryption key and decrypt break-glass credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vendor-generated credentials are stored in a vault with tight control, then security is improved, but administrative complexity and access control requirements increase
Solution Approach 1:
The patent extracts the encryption key from the vault environment and replaces it with a client-generated key pair. The private key never leaves the client device, and only the public key is stored in the vault, eliminating the need for complex vault access controls while maintaining security through cryptographic operations performed locally.
Solution Approach 2:
The client device autonomously generates its own key pair and performs cryptographic operations without requiring vendor-generated credentials or complex vault access procedures. The break-glass account can be accessed by the user themselves through local cryptographic operations, eliminating administrative overhead.
2Reliability
If unique vendor-generated credentials are used for each user, then security is improved, but credential management efficiency deteriorates
Solution Approach 1:
Each user independently generates their own key pair on their client device. The system automatically stores the public key in the vault and associates it with the user account. Users can access their own break-glass credentials without vendor intervention, eliminating the inefficiency of unique vendor-generated credentials while maintaining security through individualized cryptographic key pairs.
3Reliability
If encryption keys are stored securely, then security is improved, but key management complexity and potential single points of failure increase
Solution Approach 1:
The patent removes the encryption key from centralized storage and replaces it with client-generated key pairs. The private key remains exclusively on the client device, and only the public key is stored in the vault. This eliminates centralized key management complexity and single points of failure while maintaining security through distributed cryptographic operations.
Solution Approach 2:
The cryptographic functionality is segmented between client and server: the client generates and retains the private key locally, while the server only stores and processes the public key. This segmentation eliminates the need for complex centralized key management systems and removes single points of failure associated with centralized key storage.
Data Source
AI summary
A system can receive, from a remote computer, request data that identifies a request associated with a user account for credentials that are configured to access a computing resource, wherein the request data comprises a concealed value, and wherein the concealed value comprises a deployment public key that is concealed with an ephemeral secret key. The system can unlock the concealed value using a vendor secret key corresponding to the user account, to produce an unlocked concealed value. The system can send the unlocked concealed value to the remote computer, enabling the remote computer to determine a data encryption key based on processing the unlocked concealed value using the ephemeral secret key, enabling the remote computer to decrypt encrypted break-glass credentials using the data encryption key to produce break-glass credentials, and enabling the remote computer to access the computing resource using the break-glass credentials.