Restrictions on use of a key

• US 10,693,916 B2
• Filed: 10/30/2018
• Issued: 06/23/2020
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Ylonen, Tatu J.
• Primary Examiner(s): Bayou, Yonas A
• Application Number:
  US16/174,427
• Publication Number:
  US 20190075134A1
• Time in Patent Office: 602 Days
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Certain embodiments provide means for managing automated access to computers, e.g., using SSH user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSH key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

Claims

1. A method in a computerized system comprising:

configuring, by a management apparatus, at least one address based restriction on use of a key by source hosts for access to target hosts in the computerized system,

determining use of the key for access to a target host,

receiving information of an address of a source host from which the key is used for the access to the target host,

comparing the address of the source host from which the key is used for the access to the target host against the at least one address based restriction on use of the key, and

performing a management action based on the comparison.

2. The method of claim 1, wherein the at least one address based restriction comprises information on allowed Internet Protocol (IP) addresses.

3. The method of claim 2, wherein the at least one address based restriction comprises information of at least one IP address from which the key can be used for access and/or to which the key can be used for access.

4. The method of claim 1, wherein the key comprises an authorized key.

5. The method of claim 4, comprising determining IP addresses from which the authorized key is used for logins to a user account.

6. The method of claim 4, wherein the management action comprises modifying an authorized key file associated with the source host from which the key is used.

7. The method of claim 1, wherein the key comprises an authentication key provided by one of an authorized key, an identity key, or a Secure Shell (SSH) key.

8. The method of claim 1, wherein the configured at least one address based restriction restricts use of the key to be only from one or more hosts from which the key has been used during a period.

9. The method of claim 1, comprising storing information on the at least one address based restriction at a key manager network element.

10. The method of claim 1, wherein the management action comprises at least one of:

preventing use of the key, deletion of the key, rotating the key, modifying the key, removal of the key used for the access to the target host from a file of authorized keys, generating an alert, generating a report, logging an audit notification, indicating the key as suspicious, or indicating the use of the key as suspicious.

11. The method of claim 1, comprising automatically configuring IP address based restrictions for public keys in an authorized key file.

12. The method of claim 1, comprising identifying a host based on the received information of the address of the source host from which the key is used.

13. The method of claim 12, comprising storing information of a plurality of IP addresses for the host and handling the stored information of a plurality of IP addresses as alternative identifiers of the host.

14. The method of claim 1, comprising determining whether the address of the source host from which the key is used belongs to a host under management of the management apparatus.

15. The method of claim 1, comprising determining that an access relationship between hosts based on the key crosses a predefined boundary.

16. The method of claim 1, wherein the management action comprises a management action on the key used by the source host from which the key is used for access to the target host.

17. An apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to:

configure, in the apparatus, at least one address based restriction on use of a key by source hosts for access to target hosts,

determine use of the key for access to a target host,

receive information of an address of a source host from which the key is used for access to the target host,

compare the address of the source host from which the key is used for the access to the target host against the at least one address based restriction on use of the key, and

perform a management action based on the evaluation comparison.

18. The apparatus of claim 17, wherein the at least one address based restriction comprises at least one of information on allowed Internet Protocol (IP) addresses, information of at least one IP address from which the key can be used for access, or information of at least one IP address to which the key can be used for access.

19. The apparatus of claim 17, wherein the key comprises an authorized key, the apparatus being configured to determine IP addresses from which the authorized key is used for logins to a user account.

20. The apparatus of claim 17, configured to restrict use of the key to be only from one or more hosts from which the key has been used during a period.

21. The apparatus of claim 17, comprising a key manager network element.

22. The apparatus of claim 17, configured to store information on the at least one address based restriction at a non-volatile memory.

23. The apparatus of claim 17, configured to, based on the comparison, at least one of prevent use of the key, delete the key, rotate the key, modify the key, remove the key used for the access to the target host from a file of authorized keys, generate an alert, generate a report, log an audit notification, indicate the key as suspicious, or indicate the use of the key as suspicious.

24. The apparatus of claim 17, configured to determine whether the address of the source host from which the key is used belongs to a host under management of the apparatus.

25. The apparatus of claim 17, configured to determine that an access relationship between hosts based on the key crosses a predefined boundary.

26. A non-transitory computer readable media comprising program code for causing an apparatus comprising a processor to perform instructions for:

configuring at least one address based restriction on use of a key by source hosts for access to target hosts in the apparatus,

determining use of the key for access to a target host,

receiving information of an address of a source host from which the key is used for access to the target host,

comparing the address of the source host from which the key is used for the access to the target host against the at least one address based restriction on use of the key, and

performing a management action based on the comparison.