Automated Access, Key, Certificate, and Credential Management

• US 20150222604A1
• Filed: 12/21/2012
• Published: 08/06/2015
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Ylonen, Tatu J.
• Granted Patent: US 9,515,999 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Certain embodiments provide means for managing automated access to computers, e.g., using SSH user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSH key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

Claims

1. An apparatus, comprising:

a manager configured to manage access to at least one server based on authentication keys, said authentication keys being utilized between a first managed host having a client and a second managed host having a server, and said authentication keys being stored on said managed hosts;

wherein said manager is external to said first managed host and second managed host.

2. The apparatus according to claim 1, wherein the manager comprises a discoverer configured to discover information about at least one of trust relationships, keys, credentials, certificates, and configurations on at least one of the managed hosts.

3. The apparatus according to claim 1, wherein the manager further comprises a key installer configured to install an authorized key on at least one of the managed hosts.

4. The apparatus according to claim 1, wherein the manager further comprises a key remover configured to remove an authorized key from at least one of the managed hosts.

5. The apparatus according to claim 1, wherein the manager further comprises a trust relationship installer configured to install a trust relationship between the managed hosts.

6. The apparatus according to claim 1, wherein the manager further comprises a trust relationship remover configured to remove a trust relationship from between the managed hosts.

7. The apparatus according to claim 1, wherein the manager further comprises a key rotator configured to rotate existing key pairs.

8. The apparatus according to claim 1, wherein the manager further comprises a trust relationship converter configured to convert an existing trust relationship of a first type to a trust relationship of a second type.

9. The apparatus according to claim 1, wherein the manager further comprises a command restriction enforcer configured to add a command restriction to an existing trust relationship.

26. The apparatus according to claim 1, wherein the authentication keys comprise user authentication keys according to secure shell protocol (SSH), and the first managed host comprises an SSH client and the second managed host comprises an SSH server.

10. A method, comprising:

managing access to at least one server based on authentication keys, said authentication keys being utilized between a first managed host having a client and a second managed host having a server and said authentication keys being stored on said managed hosts;

wherein said managing is performed externally to said first managed host and second managed host.

11. The method according to claim 10, wherein the managing comprises discovering information about at least one of trust relationships, keys, credentials, certificates, and configurations on at least one of the managed hosts.

12. The method according to claim 10, wherein the managing further comprises installing an authorized key on at least one of the managed hosts.

13. The method according to claim 10, wherein the managing further comprises removing an authorized key from at least one of the managed hosts.

14. The method according to claim 10, wherein the managing further comprises installing a trust relationship between the managed hosts.

15. The method according to claim 10, wherein the managing further comprises removing a trust relationship from between the managed hosts.

16. The method according to claim 10, wherein the managing further comprises rotating existing key pairs.

17. The method according to claim 10, wherein the managing further comprises converting an existing trust relationship of a first type to a trust relationship of a second type.

18. The method according to claim 10, wherein the managing further comprises adding a command restriction to an existing trust relationship.

27. The method according to claim 10, wherein the authentication keys comprise user authentication keys according secure shell protocol (SSH), and the first managed host comprises an SSH client and the second managed host comprises an SSH server.

19. A non-transitory computer program comprising computer readable program code means embodied therein, operable to cause managing of access to at least one server based on authentication keys, wherein said authentication keys are utilized between a first managed host having a client and a second managed host having a server and said authentication keys are stored are on said managed hosts and wherein the managing is performed externally to said first managed host and second managed host.

20. A system, comprising at least manager apparatus, a first managed host having a client, and a second managed host having a server, wherein the manager apparatus is configured to manage access to at least one server based on authentication keys, said authentication keys being utilized between the first managed host and the second managed host and said keys being stored on said managed hosts and said manager apparatus is external to said first managed host and second managed host.

21. A method, comprising:

deploying, with a security protocol management host, one of a security protocol management agent and authorization credentials for agentless security protocol management on a plurality of hosts each having at least one of a client and a server operable according to the security protocol, thereby causing said hosts to become managed hosts;

discovering, with said security protocol management host, existing user authentication keys on at least a portion of said managed hosts;

analyzing, with said security protocol management host, the discovered user authentication keys to detect authorized connections between user accounts on said managed hosts; and

performing, with said security protocol management host, management operations related to said security protocol on the detected authorized connections.

22. The method according to claim 21, wherein the management operations include at least one of addition of an user authentication key, removal of an user authentication key, rotation of an user authentication key, addition of a trust relationship, removal of a trust relationship, conversion of an existing trust relationship of a first type to a trust relationship of a second type, and addition of a command restriction to an existing trust relationship.

23. A security protocol management host, comprising:

at least one processor; and

at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the security protocol management host at least to perform;

deploying one of a security protocol management agent and authorization credentials for agentless security protocol management on a plurality of hosts each having at least one of a client and a server configured to operate according to the security protocol, thereby causing said hosts to become managed hosts;

discovering existing user authentication keys on at least a portion of said managed hosts;

analyzing the discovered user authentication keys to detect authorized connections between user accounts on said managed hosts; and

performing management operations related to the security protocol on the detected authorized connections.

24. The security protocol management host according to claim 23, wherein the security protocol related management operations include at least one of addition of an user authentication key, removal of an user authentication key, rotation of an user authentication key, addition of a trust relationship, removal of a trust relationship, conversion of an existing trust relationship of a first type to a trust relationship of a second type, and addition of a command restriction to an existing trust relationship.

25. The security protocol management host according to claim 23, wherein the security protocol comprises secure shell protocol (SSH).