CONTROLLING ELECTRONIC DEVICE DATA CONNECTION CREDENTIALS

A method, computer program product, and computer system for controlling connection credentials for uninterrupted connection between a target data source and a data ingestor. The method includes providing at least two credential sets for access to resources of the target data source by the data ingestor, each credential set having a credential and a common expiry period and interleaved expiry times. The method allocates a credential set as a current credential set with the one or more other credential sets as one or more backup credential sets. The method automatically swaps the current credential set and a backup credential set before the expiry of the current credential set and updates a backup credential set that includes the common expiry period set and a new credential that replaces a previous credential.

BACKGROUND

The present invention relates to connection credentials, and more specifically, to controlling connection credentials to provide uninterrupted connection and continuous availability to data over the connection.

Connection credentials are used in a large number of situations to provide authentication and authorization for access to data held at various types of data stores. As an example, data integrations between a data warehouse and a source operational data store often rely on credentials based authentication and authorization.

Connection credentials are generally required to expire and to be replaced with different credentials. Credentials may include identifiers, passwords, keys, certificates, or other types of authentication evidence. When credentials expire, there is typically a process for updating the credentials that takes some time and is therefore not instantaneous.

In some cases, the data source to which the credentials apply is owned by a different party (e.g., a separate company) and it is necessary to transmit a password request to the different party requiring a manual reset by the different party which may lead to an interrupted connection.

The manual reset becomes problematic when real time data feeds are involved in the connection as there may be a break in the connection and therefore the data availability.

SUMMARY

Embodiments of the present invention provide a method, a computer program product and a computer system, for controlling connection credentials for uninterrupted connection between a target data source and a data ingestor. One or more processors of a computer system provide at least two credential sets for access to resources of the target data source by the data ingestor. Each credential set of the at least two credential sets has a credential and a common expiry period and interleaved expiry times. The one or more processors allocate a credential set of the at least two credential sets as a current credential set with one or more other credential sets of the at least two credential sets as one or more backup credential sets. The one or more processors automatically swap the current credential set and a backup credential set before expiry of the current credential set. The one or more processors update, prior to the swapping, a backup credential set of the one or more backup credential sets, wherein the updated backup credential set comprises the common expiry period set and a new credential that replaces a previous credential.

DETAILED DESCRIPTION

Embodiments of a method, system, and computer program product are provided for controlling connection credentials for uninterrupted connection between a target data source and a data ingestor. The target data source may take the form of any data source from which data access is required with uninterrupted availability.

The uninterrupted connection and uninterrupted availability is an improvement in the technical field of computer security generally and more particularly in the technical field of controlling access to data of a target data source such as a data warehouse and a source operational data store that relies on credentials based authentication and authorization of the data for access to the target data source.

The data ingestor may be a system having a network connection to the target data source and authorized access to data of the target data source. The data access may be required in real time. The network connection may be a local network, or a remote network such as a cloud system.

An example target data source and data ingestor may be a data warehouse and a source operational data store that relies on credentials based authentication and authorization of the data ingestor for access to data of the target data source. In another example, the target data source may be an application programming interface (API) with access required by a client system. In one embodiment, the target data source is an application programming interface that uses real time technology that processes information in data streams.

Systems accessing the target data source may have a dependency on non-interrupted real time data feeds. An example of real time services may be services delivered by customer data integration (CDI) to internal service delivery clients. Another example is multi-cloud management platforms providing real time services to clients.

There following two example scenarios that may be considered. Firstly, a credential provider (i.e., the data ingestor) may have an application programming interface (API) that may be invoked to reset a password; i.e., a fully automated system. A small piece of code may be provided to get the password reset automatically that does not require a new password. If a new password is required, the new password may be generated using a password generator.

Secondly, the target data source to which the credentials apply may be owned by a different party (e.g., a separate company) and it may be required to transmit a password request to the different party requiring a manual reset by the different party, which can be a lengthy process that may cause connectivity interruptions.

The described embodiments for controlling connection credentials for uninterrupted connection between a target data source and a data ingestor may provide two or more credential sets with interleaved expiry times, such that the two or more credential sets provide a current and one or more backup credential sets and can be updated without interruption to the connection, which may be applied in either of the above scenarios.

Referring toFIG.1, a data access environment100is illustrated with a target data source120and a data ingestor110. The target data source120is protected by a credential component122to control access by the data ingestors110to data of the target data source120. The data ingestor110may include a target credential providing component112that provides registered credentials150to the credential component122for access to the target data source120to enable a network connection140.

A credential control system130is provided that manages connection credentials for access to data of the target data source120by the data ingestor110. The credential control system130may provide two or more credential sets for the data ingestor110with interleaved expiry times, such that the two or more credential sets provide a current and one or more backup credential sets and can be updated without interruption to the network connection140.

The credential control system130may be local to the data ingestor110or to the target data source120, or may be provided as a remote service. The credential control system130may include a registration component131for registering the data ingestor110and registering the two or more credential sets for access to data of the target data source120.

The two or more credential sets may be stored in a credential vault160and may be used as a current credential set and one or more backup credential sets and may be configured to have a common expiry period and interleaved expiry times. The credential control system130may include an expiry tracker component132for tracking the expiry of the credential sets and a credential update component133for coordinating the updating of the credentials in the credential sets. A credential swapping component135of a credential role component134may automatically swap the credential sets between being a current credential set and a backup credential set.

Referring toFIG.2, a flow diagram200shows an example embodiment of the described method for controlling connection credentials for uninterrupted connection between a target data source and a data ingestor.

The method may identify201a new data ingestor requiring credentials for access to a target data source. The method may register202the data ingestor with two or more credential sets for the target data source.

The method may configure203the credential sets to have a common expiry period and interleaved expiry times. In an embodiment with two credential sets, the interleaved expiry times may overlap by half the common expiry period. In an embodiment with three credential sets, the interleaved expiry times may overlap by a third of the common expiry period. Therefore, the interleaved expiry times may overlap by the common expiry period divided by the number of credential sets. The method may provide204an allocation of a first credential set as a current credential set and the other one or more credential sets as backup credential sets. The number (N) of credential sets is a positive integer of at least 2 (e.g., 2, 3, 4, 5, 6, etc.).

The method may determine205if a designated time is reached. If so, the second credential set is updated206as the backup credential set in the background. If not, the method loops back to step205to again determine if the designated time is reached.

The role of the credential sets is then swapped207. The swap207results in an updated backup credential set changing from a backup credential set to the new current credential set and the credential set that was the previous current credential set becomes a backup credential set. If there are two credential sets, the sets alternate between being a current and a backup credential set. If there are three or more credential sets, the role of the current credential set rotates through the credential sets. The role swapping207may be offset or delayed from the credential set updating206to provide a tolerance in the credential set up.

After step207has been performed, the method loops back to step205to again determine if the designated time is reached.

The method ofFIG.2is implemented with uninterrupted updated credential sets swapping in or “flip-flopping” at regular intervals while maintaining one or more backup credential sets. The designated time may be the common expiry period divided by the number of credential sets.

Referring toFIG.3, a schematic diagram300shows an example embodiment of a credential swap in an environment as described in relation toFIG.1. The environment ofFIG.1includes a target credential providing component112of a data ingestor110providing credentials150to a credential component122of a target data source120, with a network connection140between the data ingestor110and the target data source120. Two credential sets may be registered with the target data source120that uses real time technology that processes information in data streams.

In this example, the first set of credentials (Cred 1) and the second set of credentials (Cred 2) both have an expiry period of 90 days. At day 1310, the current credential set331is Cred 1 which is used initially for integration to the target data source120with Cred 1 having a full expiry period of 90 days and the backup credential set332being Cred 2 with an expiry period of 45 days for the initial period.

A swap over of credential sets takes place at day 45320, which is halfway through the expiry period of the current credential set, Cred 1. Just prior to this swapping time, there is an update at the target credential providing component112to update311Cred 2 to an updated credential set and to then swap312the current and backup credential sets so that Cred 2 becomes the current credential set341with an expiry period of 90 days (as it has just been updated) and Cred 1 becomes the backup credential set342with its remaining 45 days of expiry period left to run. At this time the credential checking component122at the target data source120is also updated321to verify the new current credential set and backup credential set. The updated credential set has a new credential (e.g., a new password) and an expiry period of 90 days.

When Cred 1 is swapped out after 45 days, Cred1 has 45 days left to run on Cred1's password, with Cred 2 at this point being swapped in and having 90 days to run. This means there are two “current” passwords giving 45 days of dual coverage. When the Cred 1 password expires 45 days later, there is still 45 days to run on Cred 2. The Cred 1 password is changed and swapped back in, which may occur just before Cred 1 expires to provide a little offset. This process flip-flops every 45 days, giving 45 days to renew the new credential.

Referring toFIGS.4A and4B, two schematic diagrams400,430show example embodiments of the repeated swapping or “flip-flopping” between two the credential sets over time406. The diagonal hashing shows the credential set that is the current credential set, with the other credential set being the backup credential set.

FIG.4Ashows the swapping of two credential sets with updates to the swapped in credential set happening simultaneously with the swapping.FIG.4Bshows an alternative embodiment in which the update to a credential set takes place during its time as the backup credential set a short time period before the swapping takes place. This provides an error tolerance for a delay in the credential set update.

FIG.4Ashows a first credential set410and a second credential set420. The first credential set410and the second credential set420have a same duration of expiry period (T) but are staggered such that the first credential set410expires at a halfway time (T/2) in the second credential set420and vice versa.

The first credential set410starts as the current credential set (with the current credential set shown by the hashing) and the second credential set420starts as the backup credential set. The second credential set420may start with a shortened initial expiry period of half the same duration of expiry period (i.e., T/2) to ensure that the expiry periods are interleaved and expire at alternating times. The first credential set410and the second credential set420each comprise a credential (e.g., identifiers (IDs), passwords, keys, certificates, or other types of authentication and/or authorization evidence) for authenticating and/or authorizing the data ingestor110to enforce data security.

At a time halfway (T/2) through the expiry period of the first credential set410, the second credential set420is updated421to have an expiry period of T and the roles of the first and second credential sets are swapped401so that the second credential set420becomes the current credential set and the first credential set410becomes the backup credential set.

At a time halfway through the expiry period of the second credential set420, the first credential set410is updated411and the roles of the first and second credential sets are swapped402back so that the first credential set410becomes the current credential set and the second credential set420becomes the backup credential set.

The preceding steps repeat with an additional update422to the second credential set420and role swap403, followed by a further update412to the first credential set410and role swap404, followed by a further update423to the second credential set420and role swap405, and so on.

The preceding process is characterized by an alternation of updating the backup credential set and swapping the current and backup credential sets. The updated backup credential set has a new credential (e.g., a new password) that replaces a previous credential and the common (i.e., same) expiry period of T.

FIG.4Bshows a similar process to that ofFIG.4A, with a first credential set440and a second credential set450. InFIG.4B, the updates451,441,452,442,453occur a short time period436(e.g., 0.01T, 0.05T, 0.10T, 0.20T, 0.30T, etc.) before the swapping of roles431-435takes place, which allows for a tolerance in the credential update. The short time period436is a time offset from the update, enabling swapping the current credential set and the backup credential set before the expiry of the current credential set and providing a remaining validity period of a swapped out current credential set as a backup credential set.

FIG.4Cshows a schematic diagram460of another example embodiment in which the concept is extended to swapping between three credential sets to increase the backup by another credential set, which provides additional security as, if a credential set is locked unexpectedly, there is always a backup credential set that may be applied immediately, which ensures no real time failure due to not having a valid credential set.

InFIG.4Cthere is a first credential set470, a second credential set480, and a third credential set490. The first, second and third credential sets each have a common (i.e., same) expiry period (T) but are staggered such that the expiry of each credential set takes place at a different time, with the times being a third of the common expiry period. Each credential set takes the role of the current credential set for a period of a third of the common expiry period, it then takes a role as a backup credential set for a period of two thirds of the common expiry period. Therefore, two credential sets have the role of backup credential sets at a time providing extra security in the event that a credential set is locked. The two backup credential sets may be designated as a first backup and a second backup. In this way, the credential sets may be rotated through the roles of current, first backup, and second backup.

A common expiry period is defined to be a same expiry period.

As inFIG.4B, the updates471-473,481-483,491-492occur a short time period466before the swapping of roles461-465takes place, which allows for a tolerance in the credential update. This results in an offset between the roles and the update times.

Referring toFIG.5, a block diagram500shows the data access environment500ofFIG.1with a credential control system130for controlling access credentials150for access by a data ingestor110to a target data source120to establish a network connection140.FIG.5illustrates a credential reset flow shown in broken lines and a credential swapping flow shown in solid lines that may be controlled by a workflow orchestration.

The credential control system130may include at least one processor501, a hardware module, or a circuit for executing the functions of the described components which may be software units executing on the at least one processor. Multiple processors running parallel processing threads may be provided enabling parallel processing of some or all of the functions of the components. Memory502may be configured to provide computer instructions503to the at least one processor501to carry out the functionality of the components.

The credential control system130includes a registration component131and each time a new data ingestor110is identified to pull the data from a target data source120, two or more credential sets are requested for providing access to the target data source. The two or more credential sets are stored in the credential vault160.

The credential control system130includes a credential update component133, for example, in the form of an identity and access control solution. The credential control system130also includes an expiry tracker component132that may be a polling module that acts as an automated reminder system for rotation of credentials at a configured time, such as at a half way time of the expiry period.

The credential vault160may store credential sets521,522including the credential details, the target details, and the expiry data. The credential vault160may have a credentials API511for using the stored credentials and a control API512for updating and swapping the roles the stored credentials.

In the reset flow, the expiry tracker component132may determine that it is a credential reset time for one of the credential sets521,522and may prompt the credential update component133to automatically or manually update the credential set for use by the target credential providing component112of the data ingestor110. The control API512of the credential vault160may update the credentials of one of the credential sets521,522.

There are two example forms of credential update component133to be considered. Firstly, the data ingestor110may have an API that may be invoked to reset a password, i.e. a fully automated system. A small piece of code may be provided to get the password reset automatically that does not require a new password. If a new password is required, this may be generated using a password generator. Secondly, the target data source120to which the credentials apply may be owned by a different party (e.g. a separate company) and it may be required to put a password request into their process (i.e. it is a manual reset on their part). This can be a lengthy process which may cause connectivity interruptions.

In the swapping flow, the expiry tracker component132may determine that it is a credential swap time for the roles of the credential sets521,522between the current and backup roles. The credential swapping component135may update the credential component122of the target data source120and may use the credentials API511to update the roles of the stored credentials521,522.

Many target data sources, such as APIs for applications that process information in data streams, rely on an expiring credential for authentication and authorization purposes. Systems using these targets that have a dependency on non-interrupted real time data feeds have an issue in the period when the target credential expires, especially if the credential renewal process is controlled by another entity.

This is true for many scenarios, with specific examples including: the real time services being delivered by customer data integration to service delivery clients and by multicloud platforms providing real time services to clients.

The described method and system concentrate on having a valid credential set, such as a user identifier and password, always available that can be flip-flopped into the connection credentials for a remote data source.

The described method and system provide an active credential that is always available even when the password control process is owned by another party, allowing real time connections to remote data sources to be maintained even when the remote system is controlled by another party.

This ensures that real time connections can be maintained despite potentially extended timelines for changing passwords on remote third party managed targets where the password control is the responsibility of the third party.

The described method and system may manage both cloud and data center scenarios.

FIG.6depicts a block diagram of components of a computing system as used for the credential control system130, in accordance with an embodiment of the present invention. It should be appreciated thatFIG.6provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

The computing system can include one or more processors602, one or more computer-readable RAMs604, one or more computer-readable ROMs606, one or more computer readable storage media608, device drivers612, read/write drive or interface614, and network adapter or interface616, all interconnected over a communications fabric618. Communications fabric618can be implemented with any architecture designed for passing data and/or control information between processors (such as microprocessors, communications and network processors, etc.), system memory, peripheral devices, and any other hardware components within the system.

One or more operating systems610, and application programs611, are stored on one or more of the computer readable storage media608for execution by one or more of the processors602via one or more of the respective RAMs604(which typically include cache memory). In the illustrated embodiment, each of the computer readable storage media608can be a magnetic disk storage device of an internal hard drive, CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk, a semiconductor storage device such as RAM, ROM, EPROM, flash memory, or any other computer readable storage media that can store a computer program and digital information, in accordance with embodiments of the invention.

The computing system can also include a R/W drive or interface614to read from and write to one or more portable computer readable storage media626. Application programs611on the computing system can be stored on one or more of the portable computer readable storage media626, read via the respective R/W drive or interface614and loaded into the respective computer readable storage media608.

The computing system can also include a network adapter or interface616, such as a TCP/IP adapter card or wireless communication adapter. Application programs611on the computing system can be downloaded to the computing device from an external computer or external storage device via a network (for example, the Internet, a local area network or other wide area networks or wireless networks) and network adapter or interface616. From the network adapter or interface616, the programs may be loaded into the computer readable storage media608. The network may comprise copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and edge servers.

The computing system can also include a display screen620, a keyboard or keypad622, and a computer mouse or touchpad624. Device drivers612interface to display screen620for imaging, to keyboard or keypad622, to computer mouse or touchpad624, and/or to display screen620for pressure sensing of alphanumeric character entry and user selections. The device drivers612, R/W drive or interface614, and network adapter or interface616can comprise hardware and software stored in computer readable storage media608and/or ROM606.

Cloud Computing

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Referring now toFIG.8, a set of functional abstraction layers provided by cloud computing environment50(FIG.7) is shown. It should be understood in advance that the components, layers, and functions shown inFIG.8are intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

A computer program product of the present invention comprises one or more computer readable hardware storage devices having computer readable program code stored therein, said program code executable by one or more processors to implement the methods of the present invention.