EXTRACTING INFORMATION IN A COMPUTER SYSTEM

• US 20170366580A1
• Filed: 08/10/2017
• Published: 12/21/2017
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Ylonen, Tatu J.
• Granted Patent: US 10,812,530 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Certain embodiments provide means for managing automated access to computers, e.g., using SSII user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSH key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

Claims

1. A method in a computer system, comprising:

obtaining by a management system log data for at least one host; and

extracting, by the management system from the log data, information for a login event, said information comprising information of at least an originating host device network address, a destination host device network address, and information of a key fingerprint.

2. The method of claim 1, wherein the destination host device network address is deduced from information about the network host from which the log data was received.

3. The method of claim 1, wherein the originating host device network address is determined based on an identifier by a security protocol client and logged by a security protocol server.

4. The method of claim 1, comprising obtaining the log data by a server of the management system from at least one of a server host, a client host, a centralized log data collection system and an analysis system.

5. The method of claim 1, comprising determining, based on the log data, information about use of a key.

6. The method of claim 5, comprising determining at least one of which key has been used, when a key has been used, how a key has been used, from which IP address a key has been used, at least one command used with a key, and keys which have not been used for a given time.

7. The method of claim 1, comprising determining, based on the log data, an authenticated user who invoked a given client.

8. The method of claim 7, comprising determining a key fingerprint based on the log data, and a user identity based on the key fingerprint.

9. The method of claim 1, comprising identifying public keys from the log data based on key fingerprint information.

10. The method of claim 9, wherein at least two different key fingerprint formats are used in identifying public keys.

11. An apparatus for a management system in a computer system, the apparatus comprising at least one processor, and at least one memory for storing instructions that, when executed, cause the apparatus to

obtain log data for at least one host;

and

extract, from the log data, information for a login event, said information comprising information of at least an originating host device network address, a destination host device network address, and information of a key fingerprint.

12. The apparatus of claim 11, comprising a server of a computer network management system.

13. The apparatus of claim 11, configured to determine the destination host device network address from information about a network host from which the log data was received.

14. The apparatus of claim 11, configured to determine the originating host device network address based on an identifier received from a security protocol client and logged by a security protocol server.

15. The apparatus of claim 11, configured to obtain the log data from at least one of a server host, a client host, a centralized log data collection system and an analysis system.

16. The apparatus of claim 11, configured to determine, based on the log data, information about use of a key.

17. The apparatus of claim 16, configured to determine at least one of which key has been used, when a key has been used, how a key has been used, from which IP address a key has been used, at least one command used with a key, and keys which have not been used for a given time.

18. The apparatus of claim 11, configured to determine, based on the log data, an authenticated user who invoked a given client.

19. The apparatus of claim 18, configured to determine a key fingerprint based on the log data, and further a user identity based on the key fingerprint.

20. The apparatus of claim 11, configured to identify public keys from the log data based on key fingerprint information.

21. The apparatus of claim 20, configured to use at least two different key fingerprint formats in identifying public keys.

22. A non-transitory computer readable media comprising program code for causing a processor of a management system to perform instructions in a computer system, the method performed comprising:

obtaining log data for at least one host; and

extracting, from the log data, information for a login event, the information comprising information of at least an originating host device network address, a destination host device network address, and information of a key fingerprint.