Generating and changing credentials of a service account

Technologies are described herein for generating and changing credentials of a service account. In one method, a credential schedule is retrieved. The credential schedule specifies when a plurality of credentials are scheduled to be changed. A determination is made whether a current credential associated with the service account is scheduled to be changed according to the credential schedule. Upon determining that the current credential is scheduled to be changed, at least part of a new credential is generated. The current credential is replaced with the new credential for the service account.

BACKGROUND

Multiple services operating on a single or multiple computer environment may access a shared resource. In order to control access to the shared resource, credentials (e.g., a username and password) may be provided to each of the services. The credentials may be used to identify a service, thereby enabling a central manager to grant and/or limit access to the shared resource. For example, a first service may be provided with credentials that enable the first service to read and modify data in a database, while a second service may be provided with different credentials that enable the second service to only read data in the database. That is, the credentials provided to the second service may prohibit the second service from modifying data in the database.

One of the larger concerns with implementing a credential-based access system is the strength of the credential. In particular, over a period of time, a credential may be discovered using brute force and other forms of attack. In order to decrease the likelihood that such attacks are successful, at least part of the credential, such as the password, may be changed before a security breach can occur. For example, if a known hacking technique typically takes three months to discover a given credential, the password may be changed every two months as a defensive mechanism in response to the hacking technique.

In a typical implementation, a human administrator manually changes the password for each of the services. However, giving an administrator the responsibility of managing and changing the passwords can raise a number of security issues. In one example, in order for an administrator to recall the password, the administrator may record the password on a piece of paper or some other medium. In this case, a nefarious party with access to the medium can obtain the password. In another example, the administrator who prefers to remember the password instead of recording it may choose a weaker password that can be more easily memorized. In this case, the weaker password can be more easily attacked than a stronger password. As a result, removing the responsibility from the administrator to manage and change the passwords can significantly improve the security of the computing environment.

SUMMARY

Technologies are described herein for generating and changing credentials of a service account. In particular, a timer service is provided herein for generating and distributing new credentials across a single or a multiple computer environment. The timer service may operate according to a predefined schedule without human administrator intervention or with substantially reduced administrator intervention.

According to one aspect presented herein, a computer program is provided herein for generating and changing a credential for a service account. The computer program retrieves a credential schedule specifying when a plurality of credentials are scheduled to be changed. The computer program determines whether a current credential associated with the service account is scheduled to be changed according to the credential schedule. Upon determining that the current credential is scheduled to be changed, the computer program generates at least part of a new credential and replaces the current credential with the new credential for the service account.

DETAILED DESCRIPTION

The following detailed description is directed to technologies for changing credentials of a service account. In particular, a timer service is provided for generating and distributing credentials across a single or a multiple computer environment. The timer service may operate according to a predefined schedule without human administrator intervention or with substantially reduced administrator intervention.

As used herein, the term “service account” refers to an account that a server may use when it hosts a web service (hereinafter referred to as a service). In particular, the service account may grant and/or limit access to shared resources (e.g., shared data) according to the service that is provided. These services are usually hosted in a process managed by an application server that performs operations using the identity of a service account. Examples of application servers include, but are not limited to, INTERNET INFORMATION SERVICES (“IIS”) and WINDOWS SHAREPOINT SERVICES (“WSS”), both from MICROSOFT CORPORATION. According to embodiments, a service account may be identified by a credential containing a username and a password.

In the following detailed description, references are made to the accompanying drawings that form a part hereof, and which are shown by way of illustration specific embodiments or examples. Referring now to the drawings, in which like numerals represent like elements through the several figures, aspects of a computing system and methodology for changing credentials of a service account will be described.FIG. 1illustrates a network architecture100operative to generate a credential, store the credential, and distribute the credential as necessary across multiple server computers. The network architecture100includes a service manager102and multiple server computers104A-104B (collectively referred to as server computers104), each of which is operatively coupled through a network106. The server computers104may be part of a server farm or cluster maintained by an enterprise. For the sake of simplicity, only two server computers are illustrated inFIG. 1. However, it should be appreciated that the network architecture100may include any number of server computers in any suitable configuration as contemplated by those skilled in the art. In another embodiment, aspects of the service manager102and the server computers104A-104B described herein may be included in a single computer.

In one embodiment, the service manager102includes a configuration database108, which is adapted to store a current credential110A. The configuration database108provides a central repository for storing service account credentials as well as additional service account configuration information, such as a credential schedule111for changing the current credential110A. The current credential110A includes a username112A and a password114A. As illustrated inFIG. 1, the current credential110A has previously been distributed across the server computers104.

In one embodiment, the current credential110A enables the server computers104to access a shared resource (not shown), such as shared data in a database. In other embodiments, the current credential110A may enable the server computers104to perform other suitable actions. In an example, the current credential110A may enable the server computers104to read and modify data in a database. In another example, the current credential110A may enable the server computers104to read by not modify data in a database.

InFIG. 1, the first server computer104A and the second server computer104B each host the same service and, as such, utilize the same service account and the current credential110A. In other embodiments, the server computers104may each provide different services through different service accounts. For example, the first server computer104A may be assigned a server farm account, and the second server computer104B may be assigned a search account. The server farm account may enable administrative access to various configuration options, and the search account may enable a content search of one or more databases.

As illustrated inFIG. 1, the server computers104include timer services116A-116B (collectively referred to as timer services116). The first timer service116A is associated with the first server computer104A, and the second timer service116B is associated with the second server computer104B. The timer services116each include a credential generation module118A-118B (collectively referred to as credential generation modules118). As described in greater detail below, the credential generation modules118are operative to generate an entirely new credential or a part of a credential, such as the password.

According to the embodiments, one of the timer services116, such as the first timer service116A, accesses the configuration database108to retrieve the credential schedule111. In one embodiment, the timer service116periodically (e.g., about every fifteen seconds) polls the configuration database108and retrieves all objects that have been changed, created, or modified. If the credential schedule111indicates that the duration for the current credential110A has expired or is near expiring, then the first timer service116A instructs the first credential generation module118A to generate a new credential110B. In other embodiments, a human administrator may initiate or prevent the generation of the new credential110B.

In one embodiment, the first credential generation module118A generates the new credential110B to replace the current credential110A. The new credential110B includes a username112B and a password114B. In another embodiment, the first credential generation module118A generates only the password114B to replace the password114A in the current credential110A. In this case, the username112A in the current credential110A is not replaced and remains the same.

The first credential generation module118A may select the new credential110B from a list of previously generated credentials. Alternatively, the first credential generation module118A may randomly or pseudo-randomly generate the new credential110B using suitable username and password generation techniques. Various approaches for randomly and pseudo-randomly generating usernames and passwords are well known in the art and are not described herein.

Once the first credential generation module118A generates the new credential110B, the first timer service116A replaces the current credential110A with the new credential110B within the first server computer104A. The first timer service116A then transmits the new credential110B to the service manager102, which replaces the current credential110A with the new credential110B within the configuration database108.

Once the new credential110B replaces the current credential110A in the configuration database108, the first timer service116A generates a timer schedule120and transmits the timer schedule120to other relevant server computers, such as the second server computer104B, that are scheduled to change expiring credentials to the new credential110B. According to embodiments, the timer schedule120specifies when the second server computer104B retrieves the retrieves new credential110B from the configuration database108. The timer schedule120may be based, at least in part, on the credential schedule111. Upon receiving the timer schedule120, the second timer service116B retrieves the new credential110B from the configuration database108according to the timer schedule120and replaces the current credential110A with the new credential110B within the second server computer104B.

Once the new credential110B replaces the current credential110A in the configuration database108, a number of global security settings may be updated to ensure that the new credential110B is operational across the server computers104. The global security settings generally refer to security settings that apply across each of the server computers104. An example of a global security setting includes security settings for accessing remote databases and other resources not associated with the service manager102.

Further, once the new credential110B replaces the current credential110A in the server computers104, a number of local security settings and local services credential settings may also be updated to ensure that the new credential110B is operational across the server computers104. The local security settings generally refer to security settings associated with a given server. Examples of a local security setting may include security settings for accessing specific registry settings or file system locations. The local services credential settings generally refer to settings that ensure the services hosted by the server computers104correctly operate under the new credential110B.

Upon completing the credential generation and distribution process as described above, the configuration database108and each of the server computers104have replaced the current credential110A with the new credential110B. Since no human intervention was involved or necessary through the process, the operation of the operation of the timer services116may be entirely automated, thereby reducing the responsibility of a human administrator. Further, while a human administrator may trigger the credential generation modules118, the human administrator has no ability to view the new credential110B. As a result, the security of the new credential110B is significantly enhanced over conventional implementations where the human administrator can view the new credentials.

As the server computers104replace the current credential110A with the new credential110B, the server computers104typically reset any services utilizing the new credential110B. During this reset operations, the services may be unavailable for a limited period of time. This period of downtime can be problematic for highly available services where minimal downtime is expected. One illustrative approach for reducing or eliminating such downtime when changing credentials of a service account.

Referring now toFIG. 2additional details will be provided regarding a service account switching process for reducing or eliminating any downtime when resetting services to operate with new credentials. In particular,FIG. 2illustrates a network architecture200including the service manager102, the first server computer104A, and a third server computer104C, each of which is coupled to a network106. The third server computer104C includes an alternate credential110C and a third timer service116C. The alternate credential110C is also stored in the configuration database108. The alternate credential110C includes a username112C and a password114C. The alternate credential110C enables the third server computer104C to access a shared resource in order to provide a service. The third timer service116C also includes a credential generation module118C, which is similar to the credential generation modules118A-118B previously described.

According to embodiments, the service manager102may amend the service account associated with the alternate credential110C to include access to the same shared resources that was available to the current credential110A. Once the alternate credential110C has been amended, the services provided by the first server computer104A are transferred to the third server computer104C. The first server computer104A is then removed from operation for handling its associated services.

Once the first server computer104A is removed from operation, the first server computer104A can replace the current credential110A with the new credential110B. Since the first server computer104A is removed from operation, the first server computer104A can reset any services using the current credential110A. The reset operation transitions the services to operate under the new credential110B. Further, since the first server computer104A is removed from operation, the services using the new credential110B can be tested in order to determine whether the new credential110B, as well as the global security settings, local security settings, and local services credential settings, are properly configured. If the new credential110B is not properly configured, then appropriate corrections can be made without any downtime to services. Further, the new credential110B can be rolled back to the current credential110A if necessary. The ability for the first server computer104A to test the new credential110B and to roll back the current credential110A provides a significant enhancement over conventional approaches where the ability to test new credentials or to roll back previous credentials is not available.

In one embodiment, the alternate credential110C is provided for the same class of services as the current credential110A. The alternate credential110C may also be associated with the same or a similar service account as the current credential110A. The alternate credential110C may also be set to expire at a later date than the current credential110A. For example, the alternate credential110C and the current credential110A may each be set to expire every ninety days. If the alternate credential110C is forty-five days out of phase with the current credential110A, then the alternate credential110C may be used as a transitional credential while the current credential110A is replaced. Similarly, when the alternate credential110C is replaced, the new credential110B, assuming it successfully replaced the current credential110A, may be used as a transitional credential.

Turning now toFIGS. 3A and 3B, additional details will be provided regarding the operation of the timer services116. In particular,FIGS. 3A and 3Bare flow diagrams illustrating aspects of methods provided herein for generating, storing, and distributing credentials of a service account. It should be appreciated that the logical operations described herein are implemented (1) as a sequence of computer implemented acts or program modules running on a computing system and/or (2) as interconnected machine logic circuits or circuit modules within the computing system. The implementation is a matter of choice dependent on the performance and other requirements of the computing system. Accordingly, the logical operations described herein are referred to variously as states, operations, structural devices, acts, or modules. These operations, structural devices, acts, and modules may be implemented in software, in firmware, in special purpose digital logic, and any combination thereof. It should be appreciated that more or fewer operations may be performed than shown in the figures and described herein. These operations may also be performed in a different order than those described herein.

Referring toFIGS. 1 and 3A, a routine300begins at operation302, where the first timer service116A retrieves the credential schedule111from the configuration database108. In one embodiment, the credential schedule111specifies when credentials, such as the current credential110A, are scheduled to be changed. For example, the credentials may be scheduled to change at periodic intervals as a defensive measure to prevent any potentials hackers from discovering the credentials. In this case, the amount of time between the periodic intervals may be determined by the strength of the credentials and the technology available for discovering the credentials. Upon retrieving the credential schedule111, the routine300proceeds to operation304.

At operation304, the first timer service116A determines whether the current credential110A is scheduled to be changed according to the credential schedule111. If the current credential110A is not scheduled to be changed, then the routine300ends. If the current credential110A is schedule to be changed, then the routine300proceeds to operation306, where the first timer service116A replaces the current credential110A with the new credential110B. In particular, the new credential110B may replace the current credential110A at the first server computer104A. The first timer service116A may also transmit the new credential110B to the service manager102, where the new credential110B also replaces the current credential110A at the configuration database108. The new credential110B may be generated by the first credential generation module118A. Upon replacing the current credential110A with the new credential110B, the routine300proceeds to operation308.

At operation308, the first timer service116A adjusts any global and local settings, ensuring that the new credential110B operates with the same settings as the current credential110A. The global settings may include global security settings, as previously described. The local settings may include local security settings and local services credential settings, also as previously described. Upon adjusting the global and local settings, the routine300proceeds to operations310and312.

At operation310, the first timer service116A resets any services that utilize the new credential110B to access shared resources. As the services are reset, the services transition from utilizing the current credential110A to utilizing the new credential110B instead. At operation312, the first timer service116A also generates the timer schedule120for other server computers, such as the second server computer104B, hosting services that utilize the current credential110A. The timer schedule120may be based, at least in part, on the credential schedule111. The first timer service110may transmit the timer schedule120to the appropriate server computers, such as the second server computer104B. The second server computer104B may then utilize the timer schedule120to retrieve the new credential110B from the configuration database108and to replace the current credential110A at the second server computer104B with the new credential110B.

Referring toFIGS. 2 and 3B, a routine320begins at operation322, where the first timer service116A retrieves the credential schedule111from the configuration database108. The routine proceeds to operation324, where the first timer service116A determines whether the current credential110A is scheduled to be changed according to the credential schedule111. If the current credential110A is not scheduled to be changed, then the routine320ends. If the current credential110A is scheduled to be changed, then the routine320proceeds to operation326.

At operation326, the first timer service116A transitions any services associated with the current credential110A to the alternate credential110C at the third server computer104C. The alternate credential110C may be selected because it is associated with the same classes of services as those provided under the current credential110A. The alternate credential110C may be updated in order to include security settings enabling the alternate credential110C to provide access to the same resources provided by the current credential110A. Upon transitioning the services from the current credential110A to the alternate credential110C, the routine320proceeds to operation328.

At operation328, the first timer service116A replaces the current credential110A with the new credential110B. The new credential110B may be generated by the first credential generation module118A. The routine320then proceeds to operation330, where the first timer service116A resets any services that utilize the new credential110B to access shared resources. As the services are reset, the services transition from utilizing the current credential110A to utilizing the new credential110B instead. Upon resetting the services, the routine320proceeds to operation332.

At operation332, the first timer service116A tests the new credential110B to determine whether it is operational. In particular, the first timer service116A may test the services operating under the new credential110B to ensure that the services can access the same resources that were accessible under the current credential110A. If the new credential110B is operational, then the routine320proceeds top operation334where the first timer service116A transitions the service from the alternate credential110C at the third server computer104C to the new credential110B. If the new credential110B is not operational, then the routine320proceeds to operation336, where the first timer service116A may roll back to the new credential110B to the current credential110A

Referring now toFIG. 4, an exemplary computer architecture diagram showing aspects of a computer400is illustrated. Examples of the computer400include the service manager102and the server computers104A-104C. The computer400includes a processing unit402(“CPU”), a system memory404, and a system bus406that couples the memory404to the CPU402. The computer400further includes a mass storage device412for storing one or more program modules414and one or more databases416. Examples of the program modules414may include the timer services116A-116C and the credential generation modules118A-118C. An example of the databases416includes the configuration database108. The mass storage device412is connected to the CPU402through a mass storage controller (not shown) connected to the bus406. The mass storage device412and its associated computer-readable media provide non-volatile storage for the computer400. Although the description of computer-readable media contained herein refers to a mass storage device, such as a hard disk or CD-ROM drive, it should be appreciated by those skilled in the art that computer-readable media can be any available computer storage media that can be accessed by the computer400.

According to various embodiments, the computer400may operate in a networked environment using logical connections to remote computers through a network418. The computer400may connect to the network418through a network interface unit410connected to the bus406. It should be appreciated that the network interface unit410may also be utilized to connect to other types of networks and remote computer systems. The computer400may also include an input/output controller408for receiving and processing input from a number of input devices (not shown), including a keyboard, a mouse, a microphone, and a game controller. Similarly, the input/output controller408may provide output to a display or other type of output device (not shown).

Based on the foregoing, it should be appreciated that technologies for providing generating, storing, and distributing changed credentials of service accounts are presented herein. Although the subject matter presented herein has been described in language specific to computer structural features, methodological acts, and computer readable media, it is to be understood that the invention defined in the appended claims is not necessarily limited to the specific features, acts, or media described herein. Rather, the specific features, acts and mediums are disclosed as example forms of implementing the claims.