Processing system for providing console access to a cyber range virtual environment

Patent metadata

Field	Value
Publication number	US-10924481-B2
Application number	US-201816181569-A
Country	US
Kind code	B2
Filing date	Nov 6, 2018
Priority date	Nov 6, 2018
Publication date	Feb 16, 2021
Grant date	Feb 16, 2021

Abstract

Aspects of the disclosure relate to processing systems that implement a virtual air gap to facilitate improved techniques for establishing console access to a cyber range virtual environment. A computing platform may receive, via a first firewall, a cyber range request and authentication credentials from a secure console host platform. By comparing the authentication credentials to access records in a stored database, the computing platform may determine an authorization level corresponding to the authentication credentials. After verifying the authentication credentials, the computing platform may grant access to a broker, which may grant access to a console hosted by the secure console host platform. The computing platform may establish, using the broker and between the console and a cyber range host platform, a connection, which may cause a user device to access, through the console, cyber ranges hosted by the cyber range host platform that correspond to the determined authorization level.

First claim

What is claimed is:

1. A system, comprising:
a user device;
a secure console host platform;
a virtual air gap; and
a cyber-range host platform,
wherein:
the cyber-range host platform is on a physically separate network than the user device, the secure console host platform, and the virtual air gap;
the cyber-range host platform is configured to host one or more simulated cyber attacks;
user authentication occurs in the virtual air gap, away from the user device and away from the cyber-range host platform;
the user device and the secure console host platform are associated with a first area, the virtual air gap is associated with a second area, and the cyber-range host platform is associated with a third area;
the second area and the third area are physically separate and cannot communicate with each other;
the first area and the third area are physically separate and cannot communicate with each other unless and until a broker authenticates and authorizes a connection within the virtual air gap between the secure console host platform and the cyber-range host platform;
a user of the user device in the first area authenticates in the second area to gain access to the third area; and
access to the broker is granted upon verification of authentication credentials associated with the user device, and the broker then grants access to a console hosted by the secure console host platform and located behind a firewall, wherein the user device is configured to prompt for user input that causes simulation of a cyber attack mitigation procedure at the cyber-range host platform after the access to the broker is granted.

2. The system of claim 1 , wherein the user authentication occurs in a no-man's-land area of the virtual air gap, away from the user device and away from the cyber-range host platform.

3. The system of claim 1 , wherein a display of the console logically originates from the cyber-range host platform.

4. The system of claim 1 , wherein authenticating and authorizing the connection within the virtual air gap between the secure console host platform and the cyber-range host platform comprises establishing, by the broker, a connection between the secure console host platform and the cyber-range host platform.

5. The system of claim 1 , wherein the user device is an internal enterprise computing device and cannot directly access the cyber-range host platform.

6. A virtual air gap host platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the virtual air gap host platform to:
receive, via a first firewall, a cyber range access request and authentication credentials from a user device, wherein a secure console host platform is unable to access a stored user records database to verify the authentication credentials and is unable to authenticate the cyber range access request;
determine, by comparing the authentication credentials to access records in the stored user records database, a cyber range authorization level corresponding to the authentication credentials; and
grant, after verifying the authentication credentials, access to a broker that grants access to a console hosted by the secure console host platform, wherein the broker establishes, between the console hosted by the secure console host platform and a cyber range host platform, a connection that causes the user device to access, through the console, one or more cyber ranges hosted by the cyber range host platform that correspond to the determined cyber range authorization level, wherein:
the cyber range host platform is physically separated from the virtual air gap host platform, the secure console host platform, and the user device,
the cyber range host platform is isolated from the verification of the authentication credentials and the broker,
the cyber range host platform is configured to host one or more simulated cyber attacks, and
the user device is configured to prompt for user input that causes simulation of a cyber attack mitigation procedure at the cyber range host platform after the access to the broker is granted.

7. The virtual air gap host platform of claim 6 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the virtual air gap host platform to establish a data connection with the secure console host platform.

8. The virtual air gap host platform of claim 6 , wherein the authentication credentials correspond to a delegate user identification, wherein the delegate user identification was determined by the secure console host platform based on user login information.

9. The virtual air gap host platform of claim 6 , wherein establishing the connection between the console hosted by the secure console host platform and the cyber range host platform further causes the secure console host platform to:
generate information directing the user device to cause display of a user interface; and
send, to the user device and via a second firewall, the information.

10. The virtual air gap host platform of claim 9 , wherein the information is one or more of input data corresponding to the console, output data corresponding to the console, and settings corresponding to the console.

11. The virtual air gap host platform of claim 6 , wherein establishing the connection between the console hosted by the secure console host platform and the cyber range host platform comprises:
granting access to a cyber range of the one or more cyber ranges hosted by the cyber range host platform or denying access to the cyber range of the one or more cyber ranges hosted by the cyber range host platform.

12. The virtual air gap host platform of claim 6 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the virtual air gap host platform to:
receive, from an authoritative computing device, an update to the cyber range authorization level; and
modify, based on the received update to the cyber range authorization level, the access records in the stored user records database.

13. The virtual air gap host platform of claim 6 , wherein the virtual air gap host platform, the secure console host platform, and the user device are connected to a shared network and wherein the cyber range host platform is not connected to the shared network.

14. A method comprising:
at a virtual air gap host platform comprising at least one processor, a communication interface, and memory:
receiving, via a first firewall, a cyber range access request and authentication credentials from a user device, wherein a secure console host platform is unable to access a stored user records database to verify the authentication credentials and is unable to authenticate the cyber range access request;
determining, by comparing the authentication credentials to access records in the stored user records database, a cyber range authorization level corresponding to the authentication credentials; and
granting, after verifying the authentication credentials, access to a broker that grants access to a console hosted by the secure console host platform, wherein the broker establishes, between the console hosted by the secure console host platform and a cyber range host platform, a connection that causes the user device to access, through the console, one or more cyber ranges hosted by the cyber range host platform that correspond to the determined cyber range authorization leve

Assignees

• Bank Of America

Inventors

• Haletky Edward
• Williams Jesse
• Gupta Saumitra
• Jinks Jr Tommy W
• Schaumburg Kathleen D

Classifications

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title