Managing authenticators in a computer system

• US 10,530,814 B2
• Filed: 03/15/2017
• Issued: 01/07/2020
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Ylonen, Tatu J.
• Primary Examiner(s): Bayou, Yonas A
• Application Number:
  US15/459,287
• Publication Number:
  US 20170222995A1
• Time in Patent Office: 1,028 Days
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Certain embodiments provide means for managing automated access to computers, e.g., using SSH user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSH key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

Claims

1. A method of managing keys by a management apparatus comprising at least one processor and memory in a computer system, comprising:

collecting from the computer system, by the management apparatus, information of existing public key infrastructure keys existing in the computer system,

determining, by the management apparatus, further information associated with the collected information of the existing public key infrastructure keys,

defining, by the management apparatus, an equivalence group comprising members based on the collected information of the existing public key infrastructure keys and associated with the members and the determined further information,

associating, by the management apparatus, at least one policy action to the equivalence group, and

causing, by the management apparatus, performing of the at least one policy action on the existing public key infrastructure keys of all of the members of the equivalence group.

2. The method of claim 1, wherein the equivalence group comprises multiple hosts.

3. The method of claim 2, wherein the determining of further information comprises determining whether the multiple hosts are sufficiently identical.

4. The method of claim 3, wherein determining whether the multiple hosts are sufficiently identical comprises determining at least one of whether the multiple hosts have the same user data sources with the same filters, whether the multiple hosts have the same users, whether the multiple hosts mount the same network file systems, whether the multiple hosts have the same operating system and/or version, whether the multiple hosts have the same patches installed, and whether the multiple hosts have the same software packages installed.

5. The method of claim 2, wherein the multiple hosts each comprise at least one of a computer, a computing node or apparatus on a network that has its own IP address and/or domain name, a mobile device, a cluster of computers, a distributed computer, and a virtual machine.

6. The method of claim 1, wherein the at least one policy action comprises copying of a file to the members of the equivalence group.

7. The method of claim 6, wherein the file is a key file.

8. The method of claim 6, wherein the copying comprises copying the file in a system directory or to a home directory.

9. The method of claim 1, wherein the at least one policy action on existing public key infrastructure keys of all members of the equivalence group comprises one of rotating keys, adding new keys, removing keys, and renewing keys.

10. The method of claim 1, wherein the existing public key infrastructure keys comprise at least one of a public key and a private key.

11. An apparatus for managing keys in a computer system, the apparatus comprising at least one processor, and at least one memory for storing instructions that, when executed, cause the apparatus to:

collect, from the computer system, information of existing public key infrastructure keys existing in the computer system,

determine further information associated with the collected information of the existing public key infrastructure keys,

determine an equivalence group comprising members based on the collected information of the existing public key infrastructure keys and associated with the members and the determined further information,

associate at least one policy action to the equivalence group, and

cause performing of the at least one policy action on the existing public key infrastructure keys of all of the members of the equivalence group.

12. The apparatus of claim 11, wherein the equivalence group comprises multiple hosts.

13. The apparatus of claim 12, configured to determine whether the multiple hosts are sufficiently identical.

14. The apparatus of claim 13, wherein the determination whether the multiple hosts are sufficiently identical comprises determination of at least one of whether the multiple hosts have the same user data sources with the same filters, whether the multiple hosts have the same users, whether the multiple hosts mount the same network file systems, whether the multiple hosts have the same operating system and/or version, whether the multiple hosts have the same patches installed, and whether the multiple hosts have the same software packages installed.

15. The apparatus of claim 12, wherein the multiple hosts each comprise at least one of a computer, a computing node or apparatus on a network that has its own IP address and/or domain name, a mobile device, a cluster of computers, a distributed computer, and a virtual machine.

16. The apparatus of claim 11, configured to cause copying of a file to the members of the equivalence group.

17. The apparatus of claim 16, wherein the file comprises a key file.

18. The apparatus of claim 16, wherein the copying comprises copying the file in a system directory or to a home directory.

19. The apparatus of claim 11, wherein the at least one policy action on existing public key infrastructure keys of all members of the equivalence group comprises one of rotating keys, adding new keys, removing keys, and renewing keys.

20. The apparatus of claim 11, wherein the existing public key infrastructure keys comprise at least one of a public key and a private key.