US 12,463,959 B2
Cloud-based secrets management credential store
Michael J. Gaffney, Perry Hall, MD (US); Todd Knight, Tucson, AZ (US); James Lambert, Milford, MA (US); Jeff Mitchell, Boston, MA (US); and Louis Carl Ruch, Vashon, WA (US)
Assigned to HashiCorp, San Francisco, CA (US)
Filed by HashiCorp, San Francisco, CA (US)
Filed on Jun. 10, 2022, as Appl. No. 17/837,976.
Prior Publication US 2023/0403265 A1, Dec. 14, 2023
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01); H04L 67/141 (2022.01); H04L 67/143 (2022.01)
CPC H04L 63/083 (2013.01) [H04L 63/101 (2013.01); H04L 63/20 (2013.01); H04L 67/141 (2013.01); H04L 67/143 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A dynamic credentialing system for accessing and using one or more networked services of a cloud computing infrastructure by a user of a client computer, the accessing and using being enabled by one or more secrets accessed from a secrets management system, the dynamic credentialing system comprising:
an identity-based access management system accessible by the client computer via an application programming interface (API), the identity-based access management system comprising a non-transitory machine-readable medium storing instructions that, when executed by at least one processor, cause the processor to receive a request for a session via the API to use a specific service of the one or more networked services, the identity-based access management system having a target service configured to receive the request, the identity-based access management system further comprising a credential store that includes a credential library that receives and stores credentials for authorizing and enabling the session with the specific service of the one or more networked services via a lease generated by the secrets management system to one or more credentials based on the one or more secrets accessed from the secrets management system, the target service being further configured to receive the authorizing credentials and forward the credentials to the client computer via the API to enable the client computer to access and use the one or more networked services of the cloud computing infrastructure for the session,
wherein the identity-based access management system is further configured such that only lease metadata for the credential is retained by the identity-based access management system, and
wherein an internal scheduler of the identity-based access management system is configured to periodically renew the lease for the credential while the session is active, and wherein, upon termination of the session, the identity-based access management system is further configured to programmatically call the secrets management system to revoke the lease for the credential.