Office Action 1: Notice of Allowance (2024-09-11)

CLAIMS:
What is claimed is:

1\. A method for implementing a smart secret rotator module configured to programmatically generate and rotate secrets or credentials for applications to read them to connect to various services by utilizing one or more processors along with allocated memory, the method comprising:
establishing a communication link between a plurality of service providers and one or more processors embedded within the smart secret rotator module via a communication interface, wherein each of said plurality of service providers generates corresponding secret or credential to be utilized by an application for connecting to said service;
running the smart secret rotator module in a preconfigured time interval to determine whether the secret or the credential corresponding to each service provider has been changed during the preconfigured time interval;
calling, by the smart secret rotator module, a first application programming interface (API), in response to determining that the secret or the credential corresponding to each service provider has been changed, to retrieve the changed secret or the credential from the corresponding service provider;
storing the changed secret or the credential to a corresponding predefined location;
calling, by the application, a second API to retrieve the changed secret or the credential from the corresponding predefined location; and
automatically establishing a connection between the application and the corresponding service provider based on a determination that the changed secret or the credential retrieved from the predefined location matches with the changed secret or the credential retrieved from the corresponding service provider during the preconfigured time interval. SVG {EMBED HERE} 0.28 1.50

2\. The method according to claim 1, wherein the plurality of services include one or more of the following: a private or a public cloud provider; an active directory federation service configured to provide a user with a single sign-on access to systems and applications located across organizational boundaries; and a password vault configured to store usernames and passwords for multiple applications securely, and in an encrypted format.

3\. The method according to claim 2, wherein the private cloud provider includes one or more of the following: private cloud secret manager and private cloud key vault.

4\. The method according to claim 1, wherein the preconfigured time interval includes five minutes, or ten minutes, or fifteen minutes, or twenty minutes.

5\. The method according to claim 1, wherein the predefined location includes one or more of the following: open source software management platform secret; configuration files;
a centralized memory; and a centralized database.

6\. The method according to claim 1, wherein the secret or the credential includes one or more of the following: secret keys, access codes, authorization tokens, and passwords.
7\. The method according to claim 6, wherein the smart secret rotator module is configured as a reusable component which can be deployed to any cloud platform to retrieve the secret keys, the access codes, the authorization tokens, and the passwords and write the secret keys, the access codes, the authorization tokens, and the passwords to a corresponding destination from where the application can read them to connect to the various services. SVG {EMBED HERE} 0.28 1.50

8\. The method according to claim 1, wherein, when a cloud service is enabled with secret rotation while provisioning, the method further comprising:
transmitting those rotation notifications to the smart secret rotator module via lambda functions; and
updating the corresponding predefined location with the secrets accordingly.

9\. A system for implementing a smart secret rotator module configured to programmatically generate and rotate secrets or credentials for applications to read them to connect to various services, the system comprising:
a processor; and
a memory operatively connected to the processor via a communication interface, the memory storing computer readable instructions, when executed, causes the processor to:
establish a communication link between a plurality of service providers and one or more processors embedded within the smart secret rotator module via a communication interface, wherein each of said plurality of service providers generates corresponding secret or credential to be utilized by an application for connecting to said service;
run the smart secret rotator module in a preconfigured time interval to determine whether the secret or the credential corresponding to each service provider has been changed during the preconfigured time interval;
call, by the smart secret rotator module, a first application programming interface (API), in response to determining that the secret or the credential corresponding to each service provider has been changed, to retrieve the changed secret or the credential from the corresponding service provider;
store the changed secret or the credential to a corresponding predefined location; SVG {EMBED HERE} 0.28 1.50 call, by the application, a second API to retrieve the changed secret or the credential from the corresponding predefined location; and
automatically establish a connection between the application and the corresponding service provider based on a determination that the changed secret or the credential retrieved from the predefined location matches with the changed secret or the credential retrieved from the corresponding service provider during the preconfigured time interval.

10\. The system according to claim 9, wherein the plurality of services include one or more of the following: a private or a public cloud provider; an active directory federation service configured to provide a user with a single sign-on access to systems and applications located across organizational boundaries; and a password vault configured to store usernames and passwords for multiple applications securely, and in an encrypted format.

11\. The system according to claim 10, wherein the private cloud provider includes one or more of the following: private cloud secret manager and private cloud key vault.

12\. The system according to claim 9, wherein the preconfigured time interval includes five minutes, or ten minutes, or fifteen minutes, or twenty minutes.

13\. The system according to claim 9, wherein the predefined location includes one or more of the following: open source software management platform secret; configuration files;
a centralized memory; and a centralized database.
14\. The system according to claim 9, wherein the secret or the credential includes one or more of the following: secret keys, access codes, authorization tokens, and passwords. SVG {EMBED HERE} 0.28 1.50

15\. The system according to claim 14, wherein the smart secret rotator module is configured as a reusable component which can be deployed to any cloud platform to retrieve the secret keys, the access codes, the authorization tokens, and the passwords and write the secret keys, the access codes, the authorization tokens, and the passwords to a corresponding destination from where the application can read them to connect to the various services.

16\. The system according to claim 9, wherein, when a cloud service is enabled with secret rotation while provisioning, the processor is further configured to:
transmit those rotation notifications to the smart secret rotator module via lambda functions; and
update the corresponding predefined location with the secrets accordingly.

17\. A non-transitory computer readable medium configured to store instructions for implementing a smart secret rotator module configured to programmatically generate and rotate secrets or credentials for applications to read them to connect to various services, the instructions, when executed, cause a processor to perform the following:
establishing a communication link between a plurality of service providers and one or more processors embedded within the smart secret rotator module via a communication interface, wherein each of said plurality of service providers generates corresponding secret or credential to be utilized by an application for connecting to said service;
running the smart secret rotator module in a preconfigured time interval to determine whether the secret or the credential corresponding to each service provider has been changed during the preconfigured time interval; SVG {EMBED HERE} 0.28 1.50 calling, by the smart secret rotator module, a first application programming interface (API), in response to determining that the secret or the credential corresponding to each service provider has been changed, to retrieve the changed secret or the credential from the corresponding service provider;
storing the changed secret or the credential to a corresponding predefined location;
calling, by the application, a second API to retrieve the changed secret or the credential from the corresponding predefined location; and
automatically establishing a connection between the application and the corresponding service provider based on a determination that the changed secret or the credential retrieved from the predefined location matches with the changed secret or the credential retrieved from the corresponding service provider during the preconfigured time interval.

18\. The non-transitory computer readable medium according to claim 17, wherein the plurality of services include one or more of the following: a private or a public cloud provider;
an active directory federation service configured to provide a user with a single sign-on access to systems and applications located across organizational boundaries; and a password vault configured to store usernames and passwords for multiple applications securely, and in an encrypted format.
19\. The non-transitory computer readable medium according to claim 17, wherein the preconfigured time interval includes five minutes, or ten minutes, or fifteen minutes, or twenty minutes. SVG {EMBED HERE} 0.28 1.50

20\. The non-transitory computer readable medium according to claim 17, wherein, when a cloud service is enabled with secret rotation while provisioning, the instructions, when executed, further cause the processor to perform the following:
transmitting those rotation notifications to the smart secret rotator module via lambda functions; and
updating the corresponding predefined location with the secrets accordingly. {P67208 05479833.DOCX} 46

OFFICE ACTION:
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Allowable Subject Matter
Claims 1-20 are allowed.
The following is an examiner’s statement of reasons for allowance: The closest prior art of record being “Spitz” (US 7950051), “Asher” (US 2021/0334343), “Mathew” (US 2017/0118202), “Kundu” (US 2016/0191477), and “Livingston” (US 2009/0320108) fail to teach or suggest, either individually or in combination, the subject matter recited within claims 1, 9, and 17. Therefore claims 1, 9, and 17 are deemed allowable over the prior art of record. The dependent claims which further limit claims 1, 9, and 17 are also deemed allowable by virtue of their dependency.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Contact Information



CITED REFERENCE SUMMARIES: Ref US20090320108A1: Claims:
A method for generating and changing a credential for a service account, comprising: retrieving a credential schedule specifying when a plurality of credentials are scheduled to be changed; determining whether a current credential associated with the service account is scheduled to be changed according to the credential schedule; upon determining that the current credential is scheduled to be changed, generating at least part of a new credential; and replacing the current credential with the at least part of the new credential for the service account.
retrieving a credential schedule specifying when a plurality of credentials are scheduled to be changed;
determining whether a current credential associated with the service account is scheduled to be changed according to the credential schedule;
upon determining that the current credential is scheduled to be changed, generating at least part of a new credential; and
replacing the current credential with the at least part of the new credential for the service account.
The method of claim 1 , wherein replacing the current credential with the new credential for the service account comprises resetting a service associated with the service account, and wherein resetting the service causes the service to utilize the new credential instead of the current credential.
The method of claim 1 , wherein the service comprises a hosted service provided through an enterprise server computer application.
The method of claim 1 , wherein replacing the current credential with the new credential for the service account comprises: replacing the current credential with the new credential at a first server computer hosting the service associated with the service account; and transmitting the new credential to a second server computer for storage in a configuration database, the configuration database containing a plurality of credentials associated with a plurality of service accounts.
replacing the current credential with the new credential at a first server computer hosting the service associated with the service account; and
transmitting the new credential to a second server computer for storage in a configuration database, the configuration database containing a plurality of credentials associated with a plurality of service accounts.
The method of claim 4 , further comprising: generating a timer job specifying when a second server computer is scheduled to retrieve the new credential from the configuration database, the new credential for replacing the current credential at the second server computer; and transmitting the timer job to the second server computer.
generating a timer job specifying when a second server computer is scheduled to retrieve the new credential from the configuration database, the new credential for replacing the current credential at the second server computer; and
transmitting the timer job to the second server computer.
The method of claim 1 , wherein the current credential and the new credential each comprise a username and a password.
The method of claim 1 , wherein generating at least part of a new credential comprises generating a password through a random password generator.
The method of claim 1 , wherein replacing the current credential with the at least part of the new credential for the service account comprises: transitioning a service from a first server computer utilizing the current credential to a second server computer utilizing an alternate credential; upon transitioning the service hosted at a first server computer to the second server computer, replacing the current credential with the new credential at the first server computer; resetting the service at the first server computer causing the service to utilize the new credential instead of the current credential; upon resetting the service, testing whether the service is properly operating utilizing the new credential; and upon determining that the service is properly operating utilizing the new credential, transitioning the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.
transitioning a service from a first server computer utilizing the current credential to a second server computer utilizing an alternate credential;
upon transitioning the service hosted at a first server computer to the second server computer, replacing the current credential with the new credential at the first server computer;
resetting the service at the first server computer causing the service to utilize the new credential instead of the current credential;
upon resetting the service, testing whether the service is properly operating utilizing the new credential; and
upon determining that the service is properly operating utilizing the new credential, transitioning the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.
The method of claim 8 , further comprising upon determining that the service is not properly operating utilizing the new credential, replacing the new credential with the current credential at the first server computer.
A method for generating and changing a credential for a service account, the service account being associated with a service hosted at a first server computer, the service utilizing a current credential to access shared data, the method comprising: retrieving, from a configuration database over a network, a credential schedule specifying when a plurality of credentials are scheduled to be changed; determining whether the current credential is scheduled to be changed according to the credential schedule; upon determining that the current credential is scheduled to be changed, generating at least part of a new credential; replacing the current credential with the at least part of the new credential at the first server computer; and transmitting the new credential over the network to the configuration database, the configuration database adapted to store the plurality of credentials for a plurality of service accounts.
retrieving, from a configuration database over a network, a credential schedule specifying when a plurality of credentials are scheduled to be changed;
determining whether the current credential is scheduled to be changed according to the credential schedule;
upon determining that the current credential is scheduled to be changed, generating at least part of a new credential;
replacing the current credential with the at least part of the new credential at the first server computer; and
transmitting the new credential over the network to the configuration database, the configuration database adapted to store the plurality of credentials for a plurality of service accounts.
The method of claim 10 , further comprising: adjusting global settings associated with a plurality of server computers utilizing the new credential; and adjusting local settings associated with the first server computer utilizing the new credential.
adjusting global settings associated with a plurality of server computers utilizing the new credential; and
adjusting local settings associated with the first server computer utilizing the new credential.
The method of claim 10 , further comprising: generating a timer job specifying when a second server computer is scheduled to retrieve the new credential from the configuration database, the new credential for replacing the current credential at the second server computer; and transmitting the timer job to the second server computer.
The method of claim 10 , wherein generating at least part of a new credential comprises generating a username and a password.
The method of claim 10 , wherein replacing the current credential with the at least part of the new credential at the first server computer comprises: transitioning a service from the first server computer utilizing the current credential to a second server computer utilizing an alternate credential; upon transitioning the service hosted at the first server computer to the second server computer, replacing the current credential with the new credential at the first server computer; resetting the service at the first server computer causing the service to utilize the new credential instead of the current credential; upon resetting the service, testing whether service is properly operating utilizing the new credential; and upon determining that the service is properly operating utilizing the new credential, transitioning the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.
transitioning a service from the first server computer utilizing the current credential to a second server computer utilizing an alternate credential;
upon transitioning the service hosted at the first server computer to the second server computer, replacing the current credential with the new credential at the first server computer;
upon resetting the service, testing whether service is properly operating utilizing the new credential; and
The method of claim 14 , further comprising upon determining that the service is not properly operating utilizing the new credential, replacing the new credential with the current credential at the first server computer.
A computer-readable medium having computer-executable instructions stored thereon which, when executed by a computer, cause the computer to: retrieve a credential schedule specifying when a plurality of credentials are scheduled to be changed, the plurality of credentials being associated with a plurality of service accounts; determine whether a current credential associated with a service account is scheduled to be changed according to the credential schedule; upon determining that the current credential is scheduled to be changed, generate at least part of a new credential; replace the current credential with the at least part of the new credential for the service account; and resetting a service associated with the service account, wherein resetting the service causes the service to utilize the new credential instead of the current credential.
retrieve a credential schedule specifying when a plurality of credentials are scheduled to be changed, the plurality of credentials being associated with a plurality of service accounts;
determine whether a current credential associated with a service account is scheduled to be changed according to the credential schedule;
upon determining that the current credential is scheduled to be changed, generate at least part of a new credential;
replace the current credential with the at least part of the new credential for the service account; and
resetting a service associated with the service account, wherein resetting the service causes the service to utilize the new credential instead of the current credential.
The computer-readable medium of claim 16 , wherein to replace the current credential with the new credential for the service account, the computer-executable instructions stored thereon which, when executed by a computer, cause the computer to: replace the current credential with the new credential at a first server computer hosting the service associated with the service account; and transmit the new credential to a configuration database, the configuration database containing the plurality of credentials associated with the plurality of service accounts.
replace the current credential with the new credential at a first server computer hosting the service associated with the service account; and
transmit the new credential to a configuration database, the configuration database containing the plurality of credentials associated with the plurality of service accounts.
The computer-readable medium of claim 16 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to: generate a timer job specifying when a second server computer is scheduled to retrieve the new credential from the a configuration database, the new credential for replacing the current credential at the second server computer; and transmit the timer job to the second server computer.
generate a timer job specifying when a second server computer is scheduled to retrieve the new credential from the a configuration database, the new credential for replacing the current credential at the second server computer; and
transmit the timer job to the second server computer.
The computer-readable medium of claim 16 , wherein to replace the current credential with the at least part of the new credential for the service account, the computer-executable instructions stored thereon which, when executed by a computer, cause the computer to: transition a service from a first server computer utilizing the current credential to a second server computer utilizing an alternate credential; upon transitioning the service hosted at a first server computer to the second server computer, replace the current credential with the new credential at the first server computer; reset the service at the first server computer causing the service to utilize the new credential instead of the current credential; upon resetting the service, test whether service is properly operating utilizing the new credential; and upon determining that the service is properly operating utilizing the new credential, transition the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.
transition a service from a first server computer utilizing the current credential to a second server computer utilizing an alternate credential;
upon transitioning the service hosted at a first server computer to the second server computer, replace the current credential with the new credential at the first server computer;
reset the service at the first server computer causing the service to utilize the new credential instead of the current credential;
upon resetting the service, test whether service is properly operating utilizing the new credential; and
upon determining that the service is properly operating utilizing the new credential, transition the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.
The computer-readable medium of claim 19 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to upon determining that the service is not properly operating utilizing the new credential, replace the new credential with the current credential at the first server computer.
Ref US7950051B1: Claims:
A password management system for a communication network having a plurality of network elements having a plurality of applications wherein the applications allow access to a plurality of users in response to passwords and wherein the applications automatically expire the passwords after time periods, the password management system comprising: a password processing system configured to generate first ones of the passwords for the users, generate first registration messages to register the first passwords with the applications in the network elements in the communication network, generate first user messages to indicate the first passwords to the users, wherein the users use the first passwords to access the applications in the network elements in the communication network, generate second ones of the passwords for the users before the first passwords expire, generate second registration messages to register the second passwords with the applications in the network elements in the communication network before the first passwords expire, generate second user messages to indicate the second passwords to the users before the first passwords expire, wherein the users use the second passwords to access the applications in the network elements in the communication network; a communication interface configured to transfer the first registration messages to the applications in the network elements in the communication network, transfer the first user messages to the users, transfer the second registration messages to the applications in the network elements in the communication network before the first passwords expire, and transfer the second user messages to the users before the first passwords expire; and wherein a first set of the applications use a first registration process to register the passwords, wherein a second set of the applications use a second registration process to register the passwords, and wherein the first registration process and the second registration process are different.
a password processing system configured to generate first ones of the passwords for the users, generate first registration messages to register the first passwords with the applications in the network elements in the communication network, generate first user messages to indicate the first passwords to the users, wherein the users use the first passwords to access the applications in the network elements in the communication network, generate second ones of the passwords for the users before the first passwords expire, generate second registration messages to register the second passwords with the applications in the network elements in the communication network before the first passwords expire, generate second user messages to indicate the second passwords to the users before the first passwords expire, wherein the users use the second passwords to access the applications in the network elements in the communication network;
a communication interface configured to transfer the first registration messages to the applications in the network elements in the communication network, transfer the first user messages to the users, transfer the second registration messages to the applications in the network elements in the communication network before the first passwords expire, and transfer the second user messages to the users before the first passwords expire; and
wherein a first set of the applications use a first registration process to register the passwords, wherein a second set of the applications use a second registration process to register the passwords, and wherein the first registration process and the second registration process are different.
The password management system of claim 1 wherein the applications comprise software applications in mobile communication switching systems.
The password management system of claim 1 wherein a first set of the applications expire the passwords after a first one of the time periods, wherein a second set of the applications expire the passwords after a second one of the time periods, and wherein the first time period and the second time period are different.
The password management system of claim 1 wherein a first set of the applications is supplied by a first communication network element supplier, wherein a second set of the applications is supplied by a second communication network element supplier, and wherein the first communication network element supplier and the second communication network element supplier are different.
The password management system of claim 1 wherein a first set of the applications use a first password format, wherein a second set of the applications use a second password format, and wherein the first password format and the second password format are different.
The password management system of claim 1 wherein the users comprise over 20 users and the applications comprise over 100 applications in over 50 of the communication network elements.
The password management system of claim 1 wherein the applications allow access to the users in response to the users using user network addresses that change over time: the password processing system i
[Truncated to input limit]