Intrusion detection with honeypot keys

Patent metadata

Field	Value
Publication number	US-11716351-B2
Application number	US-202117370863-A
Country	US
Kind code	B2
Filing date	Jul 8, 2021
Priority date	Sep 28, 2018
Publication date	Aug 1, 2023
Grant date	Aug 1, 2023

Abstract

A honeypot file is cryptographically secured with a cryptographic key. The key, or related key material, is then placed on a central keystore and the file is placed on a data store within the enterprise network. Unauthorized access to the honeypot file can then be detecting by monitoring use of the associated key material, which usefully facilitates detection of file access at any time when, and from any location where, cryptographic access to the file is initiated.

First claim

What is claimed is:

1. A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of:
providing a honeypot file and an access control list for the honeypot file, the access control list including an open access user for the honeypot file;
cryptographically processing the honeypot file with key material to provide a tagged file;
storing the tagged file in a file system at a location accessible to devices in an enterprise network;
storing the key material in a central keystore for the enterprise network, the key material for cryptographically processing the tagged file;
detecting a retrieval of the key material from the central keystore, the retrieval associated with cryptographic access to the tagged file by one of the devices; and
initiating a remedial action responsive to detecting the retrieval of the key material, the remedial action including monitoring subsequent network activity within the enterprise network by the one of the devices.

2. A method, comprising:
providing a honeypot file and an access control list for the honeypot file, the access control list including an open access user for the honeypot file;
cryptographically processing the honeypot file with key material to provide a tagged file;
storing the tagged file in a file system for a data store at a location accessible to devices in an enterprise network;
storing the access control list in the file system for the data store;
storing a portion of the key material in a central keystore for the enterprise network, the key material used in cryptographic processing of the tagged file by a device;
detecting a retrieval of the portion of the key material from the central keystore, the retrieval associated with the cryptographic processing of the tagged file by the device; and
initiating a security action responsive to the retrieval of the portion of the key material used in the cryptographic processing of the tagged file.

3. The method of claim 2 , wherein the key material includes an asymmetric key pair.

4. The method of claim 2 , wherein cryptographically processing the honeypot file includes using the key material to encrypt the honeypot file.

5. The method of claim 2 , wherein cryptographically processing the honeypot file includes using the key material to digitally sign the honeypot file.

6. The method of claim 2 , wherein the data store includes at least one of network storage for the enterprise network and a directory on an endpoint in the enterprise network.

7. The method of claim 2 , wherein the central keystore includes at least one of a remote cloud resource for the enterprise network, and a third party trusted resource.

8. The method of claim 2 , wherein detecting the retrieval of the portion of the key material includes at least one of detecting an opening of the tagged file and detecting an authentication of the tagged file.

9. The method of claim 2 , wherein the retrieval of the portion of the key material is requested from a file system extension on an endpoint that controls access to encrypted content.

10. The method of claim 2 , wherein the retrieval of the portion of the key material is requested from a decryption tool on an endpoint.

11. The method of claim 2 , wherein initiating the security action includes identifying a device associated with cryptographically processing the tagged file as a malicious intruder.

12. The method of claim 11 , wherein the security action includes at least one of blacklisting the malicious intruder from the enterprise network, redirecting the malicious intruder to a honeypot, and monitoring activities of the malicious intruder.

13. The method of claim 2 , wherein the security action includes triggering an alert.

14. The method of claim 2 , wherein the data store is on an endpoint of the enterprise network, and wherein the security action includes remediating the endpoint.

15. The method of claim 14 , wherein remediating the endpoint includes at least one of quarantining the endpoint and pulling one or more keys for access to secure content on the endpoint from the endpoint.

16. The method of claim 2 , wherein providing the honeypot file includes selecting a non-confidential file available on the data store and storing the tagged file on the data store as an older version of the honeypot file.

17. The method of claim 2 , wherein providing the honeypot file includes providing a crawler that traverses the enterprise network to locate documents having one or more properties suitable for use as the honeypot file.

18. The method of claim 2 , further comprising modifying the access control list for the honeypot file to attract unauthorized, malicious users of the enterprise network by limiting the access control list to a small number of users.

19. A system, comprising:
a data store at a location in an enterprise network accessible to devices in the enterprise network;
a central keystore for the enterprise network; and
a threat management facility executing on one or more hardware processors the threat management facility configured to perform the steps of:
providing a honeypot file and an access control list for the honeypot file, the access control list including an open access user for the honeypot file,
cryptographically processing the honeypot file with key material to provide a tagged file,
storing the tagged file in a file system for the data store,
storing the key material in the central keystore,
detecting use of the key material from the central keystore associated with cryptographic handling of the tagged filed by one of the devices, and
initiating a remedial action responsive to detecting use of the key material.

20. The system of claim 19 , wherein detecting use of the key material includes at least one of detecting an opening of the honeypot file and detecting an authentication of the honeypot file.

Assignees

• Sophos Ltd

Inventors

• Schütz Harald
• Berger Andreas
• Humphries Russell
• Harris Mark D
• Ray Kenneth D

Classifications

• H04L63/1491 Primary

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title