Seamless Provision of Authentication Credential Data to Cloud-Based Assets on Demand

• US 20180359239A1
• Filed: 06/20/2018
• Published: 12/13/2018
• Est. Priority Date: 06/12/2017
• Status: Active Grant

• Current Assignee: CyberArk Software Ltd.
• Original Assignee: CyberArk Software Ltd.
• Inventors: Schwarz, Rafi, Maccabi, Eli, Cohen, Moti, Lahav, Nessi, Zilberman Kubovsky, Inbal, Sakirko, Evgeny
• Granted Patent: US 10,333,925 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

The disclosed embodiments include systems and methods for providing security tokens to cloud-based assets on demand. Operations performed in the disclosed embodiments include receiving a prompt from a cloud-based asset indicating that the cloud-based asset is seeking to communicate with an access-controlled resource, wherein the cloud-based asset lacks authorization to communicate with the access-controlled resource. Additionally, the operations include extracting information associated with the cloud-based asset by accessing a trusted cloud platform resource storing data associated with verified cloud-based assets, where the trusted cloud platform resource is separate from the cloud-based asset, and authenticating the cloud-based asset based on the extracted information. The operations also include generating a security token for the cloud-based asset, making a first portion of the security token available to be injected into the cloud-based asset, and responding to the prompt with a second portion of the security token.

Claims

1-28. -28. (canceled)

29. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for providing authentication credential data to cloud-based assets on demand, the operations comprising:

receiving a prompt indicating that a cloud-based asset is seeking to communicate with an access-controlled resource, wherein the cloud-based asset lacks authorization to communicate with the access-controlled resource;

extracting information associated with the cloud-based asset by, at least in part, accessing a trusted cloud platform resource storing data associated with verified cloud-based assets, the trusted cloud platform resource being separate from the cloud-based asset;

authenticating the cloud-based asset based on the extracted information;

making first authentication credential data available to the cloud-based asset in response to a first request;

authenticating the cloud-based asset based on the first authentication credential data; and

making second authentication credential data available to the cloud-based asset, in response to a second request, to allow the cloud-based asset to access the access-controlled resource using the first and second authentication credential data;

wherein the cloud-based asset'"'"'s ability to access the access-controlled resource is contingent on a verification of both the first and second authentication credential data.

30. The non-transitory computer readable medium of claim 29, wherein the making first authentication credential data available includes generating the first authentication credential data.

31. The non-transitory computer readable medium of claim 29, wherein the first authentication credential data and the second authentication credential data are each portions of a security token.

32. The non-transitory computer readable medium of claim 29, wherein the first authentication credential data and the second authentication credential data are each separate authentication credentials.

33. The non-transitory computer readable medium of claim 29, wherein the operations further comprise making the first authentication credential data available to be injected into the cloud-based asset.

34. The non-transitory computer readable medium of claim 29, wherein the operations further comprise concatenating the first authentication credential data and the second authentication credential data.

35. The non-transitory computer readable medium of claim 34, wherein the determining whether the cloud-based asset is authorized to access the access-controlled resource is based on the concatenated first authentication credential data and second authentication credential data.

36. The non-transitory computer readable medium of claim 29, wherein the operations further comprise making the second authentication credential data available to the cloud-based asset in response to the prompt and further in response to the authenticating of the cloud-based asset based on the first authentication credential data.

37. The non-transitory computer readable medium of claim 29, wherein the first authentication credential data includes a random data portion.

38. The non-transitory computer readable medium of claim 29, wherein the first authentication credential data includes a portion including information regarding the cloud-based asset.

39. The non-transitory computer readable medium of claim 29, wherein the first authentication credential data includes a portion including information regarding a cloud environment in which the cloud-based asset was spun up.

40. A computer-implemented method, executable by a processor of a computing system, for providing authentication credential data to a cloud-based asset on demand, the method comprising:

receiving a prompt indicating that a cloud-based asset is seeking to communicate with an access-controlled resource, wherein the cloud-based asset lacks authorization to communicate with the access-controlled resource;

extracting information associated with the cloud-based asset by, at least in part, accessing a trusted cloud platform resource storing data associated with verified cloud-based assets, the trusted cloud platform resource being separate from the cloud-based asset;

authenticating the cloud-based asset based on the extracted information;

making first authentication credential data available to the cloud-based asset in response to a first request;

authenticating the cloud-based asset based on the first authentication credential data; and

making second authentication credential data available to the cloud-based asset, in response to a second request, to allow the cloud-based asset to access the access-controlled resource using the first and second authentication credential data;

wherein the cloud-based asset'"'"'s ability to access the access-controlled resource is contingent on a verification of both the first and second authentication credential data.

41. The computer-implemented method of claim 40, wherein the extracted information associated with the cloud-based asset includes a virtual computing identifier associated with the cloud-based asset.

42. The computer-implemented method of claim 40, wherein the extracted information associated with the cloud-based asset includes a virtual computing namespace associated with the cloud-based asset.

43. The computer-implemented method of claim 40, wherein the extracted information associated with the cloud-based asset includes information regarding a virtualization platform used to spin up the cloud-based asset.

44. The computer-implemented method of claim 43, wherein the extracted information includes a parameter or configuration setting of the virtualization platform.

45. The computer-implemented method of claim 40, wherein the extracted information includes a permissible type of cloud-based assets.

46. The computer-implemented method of claim 40, wherein the extracted information includes a permissible role of cloud-based assets.

47. The computer-implemented method of claim 40, wherein the authenticating the cloud-based asset based on the extracted information is performed based on an authentication policy and the extracted information.

48. The computer-implemented method of claim 47, wherein the authentication policy includes rules that take into account a history of activity involving a virtualization platform used to spin up the cloud-based asset.

49. The computer-implemented method of claim 47, wherein the authentication policy includes rules that take into account a history of activity involving the cloud-based asset.

50. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for obtaining access to authentication credential data on demand, the operations comprising:

requesting, by a cloud-based asset, to communicate with an access-controlled resource, wherein the cloud-based asset lacks authorization to communicate with the access-controlled resource;

in response to the request to communicate and conditional on the cloud-based asset being authenticated based on extracted information associated with the cloud-based asset, obtaining access to first authentication credential data for the cloud-based asset;

in response to a subsequent request, obtaining access to second authentication credential data for the cloud-based asset;

requesting authorization, using the first authentication credential data and the second authentication credential data, to access the access-controlled resource; and

receiving authorization, in response to the request for authorization, to access the access-controlled resource;

wherein the cloud-based asset'"'"'s ability to access the access-controlled resource is contingent on a verification of both the first and second authentication credential data.

51. The non-transitory computer readable medium of claim 50, wherein the first authentication credential data and the second authentication credential data are separately verified.

52. The non-transitory computer readable medium of claim 50, wherein the first authentication credential data and the second authentication credential data are each portions of a security token.

53. The non-transitory computer readable medium of claim 50, wherein the operations further comprise receiving the first authentication credential data before the requesting to communicate with the access-controlled resource, and receiving the second authentication credential data after the requesting to communicate with the access-controlled resource.