Provisioning new virtual machine with credentials

• US 10,171,508 B2
• Filed: 09/27/2016
• Issued: 01/01/2019
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Ylonen, Tatu J.
• Primary Examiner(s): Bayou, Yonas A
• Application Number:
  US15/277,491
• Publication Number:
  US 20170019386A1
• Time in Patent Office: 826 Days
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Certain embodiments provide means for managing automated access to computers, e.g., using SSH user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSH key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

Claims

1. A method of provisioning a virtual data processing instance in a virtualized environment, comprising:

provisioning, by a data processing apparatus configured for hosting virtual data processing instances, a new virtual data processing instance for retrieval of credential information from a credential management system;

connecting, by the new virtual data processing instance hosted in the data processing apparatus, to the credential management system;

authenticating the new virtual data processing instance to the credential management system; and

receiving, by the new virtual data processing instance, the credential information from the credential management system.

2. The method according to claim 1, wherein the receiving comprises receiving at least one key from a key management system.

3. The method according to claim 2, wherein the at least one key comprises a host key.

4. The method according to claim 3, wherein the new virtual data processing instance comprises a virtual host and the host key is for another host.

5. The method according to claim 2, wherein the at least one key comprises a private key that authorizes the new virtual data processing instance to log into at least one other data processing instance.

6. The method according to claim 2, wherein the at least one key comprises a public key that authorizes an account on another data processing instance to log into the new virtual data processing instance.

7. The method according to claim 1, further comprising:

receiving credential information from the credential management system allowing the new virtual data processing instance to authenticate itself to the credential management system; and

using the received credential information by the new virtual data processing instance for authentication to the credential management system.

8. The method according to claim 7, wherein the received credential information comprises one of:

a shared secret; and

a public key for the credential management system and a private key for the new virtual data processing instance.

9. The method according to claim 1, comprising using management system information that has been preconfigured into a virtual machine image for the connecting and authenticating to the credential management system.

10. The method according to claim 1, further comprising installing credentials for the credential management system on the new virtual data processing instance before booting thereof or during a booting process.

11. The method according to claim 10, wherein the credentials for the credential management system are inserted into a virtual machine image before the booting.

12. The method according to claim 10, wherein the credentials for the credential management system are installed into the new virtual data processing instance by a provisioning system.

13. The method according to claim 1, further comprising configuring the new virtual data processing instance based on the received credential information for at least one of:

authentication to the credential management system, use of a host key for at least one other host in the virtualized environment, enabling an account in another data processing instance to log into the new virtual data processing instance, and logging into at least one other data processing instance.

14. The method according to claim 1, wherein the virtualized environment comprises a paravirtualized environment where parts of a kernel are shared by multiple instances.

15. A data processing apparatus for providing a virtual data processing instance in a virtualized environment, configured to:

host virtual data processing instances;

provision a new virtual data processing instance for retrieval of credential information from a credential management system;

connect the new virtual data processing instance to the credential management system;

authenticate the new virtual data processing instance to the credential management system; and

configure the new virtual data processing instance based on credential information received from the credential management system.

16. The data processing apparatus according to claim 15, wherein the new virtual data processing instance is configured to receive at least one of:

at least one key from a key management system; and

credential information from the credential management system allowing the new virtual data processing instance to authenticate itself to the credential management system.

17. The data processing apparatus according to claim 15, configured to use credential management system information that has been preconfigured into a virtual machine image for connecting and authenticating to the credential management system.

18. The data processing apparatus according to claim 15, comprising a provisioning system configured to install credentials for the credential management system on the new virtual data processing instance before booting thereof or during a booting process.

19. The data processing apparatus according to claim 15, comprising a provisioning system configured to install credentials for the credential management system on the new virtual data processing instance before booting thereof or during a booting process.

20. The data processing apparatus according to claim 15, further configured to configure the new virtual data processing instance based on the received credential information for at least one of:

authentication to the credential management system, use of a host key for at least one other host in the virtualized environment, enabling an account in another data processing instance to log into the new virtual data processing instance, and logging into at least one other data processing instance.

21. The data processing apparatus according to claim 15, wherein the virtualized environment comprises a paravirtualized environment where parts of a kernel are shared by multiple instances.

22. A non-transitory computer readable media comprising program code for causing an apparatus, operable in a virtualized environment to host virtual data processing instances and comprising a processor, to perform instructions for:

hosting a new virtual data processing instance by the apparatus in the virtualized environment, wherein the hosting comprises;

provisioning the new virtual data processing instance for retrieval of credential information from a credential management system;

connecting the new virtual data processing instance to the credential management system;

authenticating the new virtual data processing instance to the credential management system; and

configuring the new virtual data processing instance based on credential information received from the credential management system.