US 12,224,997 B2
Multi-way trust formation in a distributed system
Andrew Todd, Cambridge, MA (US); Walter Wohler, Longmont, CO (US); Marty Kulma, Auburn, MA (US); and Richard Bramante, Methuen, MA (US)
Assigned to HITACHI VANTARA LLC, Santa Clara, CA (US)
Appl. No. 17/420,156
Filed by HITACHI VANTARA LLC, Santa Clara, CA (US)
PCT Filed Mar. 4, 2019, PCT No. PCT/US2019/020503
§ 371(c)(1), (2) Date Jul. 1, 2021,
PCT Pub. No. WO2020/180292, PCT Pub. Date Sep. 10, 2020.
Prior Publication US 2022/0070161 A1, Mar. 3, 2022
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/0823 (2013.01) [H04L 63/0435 (2013.01); H04L 63/0876 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system comprising:
a first system including a plurality of first computing devices located at a first site, the first system in communication with a shared identity provider system that maintains user credential information for at least users of the first system and a second system, the second system including a plurality of second computing devices located at a second site that is different from the first site, at least one first computing device of the plurality of first computing devices in the first system including one or more processors configured by executable instructions to perform operations comprising:
receiving, by the at least one first computing device, a certificate of the second system including the plurality of second computing a devices located at the second site that is different from the first site, the certificate of the second system including a public cryptographic key of the second system and an identity of the second system;
in response to receiving the certificate of the second system, sending, by the at least one first computing device, to the second system, the certificate of the second system;
in response to sending the certificate of the second system to the second system, receiving, from the second system a response signed with the certificate of the second system indicating that the first system can trust communications from the second system;
obtaining, by the at least one first computing device, from the shared identity provider system, a credential of a user of the second system;
in response to receiving the response signed with the certificate of the second system indicating that the first system can trust the second system, sending, by the at least one first computing device, the credential of the user of the second system to the second system, the second system redirecting the credential to the shared identity provider system for authentication, wherein the authentication indicates that the second system can trust communications from the first system;
sending, by the at least one first computing device, to the second system, a certificate of the first system, the certificate of the first system including a public cryptographic key of the first system and an identity of the first system,
wherein, based at least on the at least one first computing device receiving the response signed with the certificate of the second system, and further based on authentication of the credential of the user of the second system, trusted communications are established between the first system and the second system.