MANAGING RELATIONSHIPS IN A COMPUTER SYSTEM

• US 20170163689A1
• Filed: 02/24/2017
• Published: 06/08/2017
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Ylonen, Tatu J.
• Granted Patent: US 9,998,497 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Certain embodiments provide means for managing automated access to computers, e.g., using SSH user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSH key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

Claims

1. A method in a computer network system, the method comprising:

obtaining information on trust relationships between entities in the computer network system,

determining transitive reachability information for a selected entity based on the information on trust relationships,

generating a transitive reachability graph describing at least one access relation of the entity based on the transitive reachability information, and

performing a management action based on the on the generated transitive reachability graph.

2. The method of claim 1, comprising displaying the generated transitive reachability graph.

3. The method of claim 2, comprising at least one of displaying all access relationships of the entity,

displaying all accounts and/or hosts that can be reached from each account and/or host in the computer network system,

displaying entities that can access one or more accounts and/or hosts in the computer network system, and

displaying entities that can access root accounts and/or privileged accounts in the computer network system.

4. The method of claim 1, comprising generating one or more reports or alerts based on the on the generated transitive reachability graph.

5. The method of claim 4, comprising generating a report or an alert in response to determining that a trust relationship crosses a configured boundary it should not cross or determining a violation of a policy.

6. The method of claim 1, comprising performing a policy action based on the generated transitive reachability graph.

7. The method of claim 6, comprising enforcing a security policy.

8. The method of claim 7, the enforcing comprising at least one of restricting use of permitted algorithms, key sizes or trust relationship configuration methods,

preventing trust relationships between functional accounts and normal user accounts, and

selectively preventing access from development systems to production systems.

9. The method of claim 1, wherein the obtaining comprises at least one of discovering key based trust relationships,

discovering non-key based trust relationships,

discovering an account on a source host that can automatically log into an account on a destination host,

discovering host equivalence based access,

discovering user accounts in a source host and a destination host that refer to same account or identity in a directory, and

discovering same user account identity in a source host and a destination host.

10. The method of claim 1, comprising storing the generated transitive reachability graph.

11. An apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to

obtain information on trust relationships between entities in a computer network system,

determine transitive reachability information for a selected entity based on the information on trust relationships,

generate a transitive reachability graph describing at least one access relation of the entity based on the transitive reachability information, and

cause a management action based on the on the generated transitive reachability graph.

12. The apparatus of claim 11, further configured to cause a display of the generated transitive reachability graph.

13. The apparatus of claim 12, configured to cause at least one of

a display of all access relationships of the entity,

a display of all accounts and/or hosts that can be reached from each account and/or host in the computer network system,

a display of entities that can access one or more accounts and/or hosts in the computer network system, and

a display of entities that can access root accounts and/or privileged accounts in the computer network system.

14. The apparatus of claim 11, further configured to generate one or more reports or alerts based on the on the generated transitive reachability graph.

15. The apparatus of claim 14, configured to generate a report or an alert in response to determination of a trust relationship that crosses a configured boundary it should not cross or determination of a violation of a policy.

16. The apparatus of claim 11, further configured to cause performing of a policy action based on the generated transitive reachability graph.

17. The apparatus of claim 16, configured to enforce a security policy.

18. The apparatus of claim 17, configured to at least one of

restrict use of permitted algorithms, key sizes or trust relationship configuration methods,

prevent trust relationships between functional accounts and normal user accounts, and

selectively prevent access from development systems to production systems.

19. The apparatus of claim 11, configured at least one of

discover key based trust relationships,

discover non-key based trust relationships,

discover accounts on source hosts that can automatically log into accounts on destination hosts,

discover host equivalence based access,

discover user accounts in source hosts and destination hosts that refer to same account or identity in a directory, and

discover same user account identity in source hosts and destination hosts.

20. The apparatus of claim 11, configured to store the generated transitive reachability graph.

21. The apparatus of claim 11, comprising a key management host.

22. A non-transitory computer readable media comprising program code for causing a processor to perform instructions in a computer network system, the method performed comprising:

obtaining information on trust relationships between entities in the computer network system,

determining transitive reachability information for a selected entity based on the information on trust relationships,

generating a transitive reachability graph describing at least one access relation of the entity based on the transitive reachability information, and

performing a management action based on the on the generated transitive reachability graph.