Preventing masquerading service attacks

Patent metadata

Field	Value
Publication number	US-12335264-B2
Application number	US-202418441288-A
Country	US
Kind code	B2
Filing date	Feb 14, 2024
Priority date	Aug 25, 2021
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

Aspects of the invention include systems and methods configured to prevent masquerading service attacks. A non-limiting example computer-implemented method includes sending, from a first server in a cloud environment, a communication request comprising an application programming interface (API) key and a first server identifier to an identity and access management (IAM) server of the cloud environment. The API key can be uniquely assigned by the IAM server to a first component of the first server. The first server receives a credential that includes a token for the first component and sends the credential to a second server. The second server sends the credential, a second server identifier, and an identifier for a second component of the second server to the IAM server. The second server receives an acknowledgment from the IAM server and sends the acknowledgment to the first server.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, at a server in a cloud environment, a cloud admin application programming interface (API) key and a service policy from a cloud administrator of the cloud environment;
sending, from the server, server data comprising the cloud admin API key, the service policy, and a server identifier to an identity and access management (IAM) server of the cloud environment;
receiving, at the server, a registration acknowledgment from the IAM server, wherein the registration acknowledgment indicates that the IAM server has added the server to an internally maintained list of trusted servers; and
sending, from the server, the registration acknowledgment to the cloud administrator.

2. The computer-implemented method of claim 1 further comprising signing, by the server, the server data using a public key of the server.

3. The computer-implemented method of claim 2 , wherein the server signs the server data prior to sending the server data to the IAM server.

4. The computer-implemented method of claim 2 , wherein the registration acknowledgment indicates that the IAM server has verified the public key against a private key internal to the IAM server.

5. The computer-implemented method of claim 1 , wherein the server identifier comprises identification data that is unique to the server in the cloud environment.

6. A computer-implemented method comprising:
receiving, at a server in a cloud environment, a request for component deployment from an administrator of the cloud environment, wherein the request comprises an identifier for a component within the server;
sending, from the server, server data comprising the request for component deployment and a server identifier to an identity and access management (IAM) server of the cloud environment;
receiving, at the server, an acknowledgment from the IAM server comprising a component application programming interface (API) key; and
sending, from the server, an acknowledgment to the administrator that does not include the API key.

7. The computer-implemented method of claim 6 , wherein the administrator comprises a site reliability engineer (SRE) of the cloud environment.

8. The computer-implemented method of claim 6 , wherein the server identifier comprises identification data that is unique to the server in the cloud environment.

9. The computer-implemented method of claim 6 , wherein the acknowledgement from the IAM server indicates that the component has been deployed by the IAM server.

10. The computer-implemented method of claim 6 further comprising signing, by the server, the server data using a public key of the server.

11. The computer-implemented method of claim 10 , wherein the server signs the server data prior to sending the server data to the IAM server.

12. A computer-implemented method comprising:
receiving, at a server in a cloud environment, a cloud admin application programming interface (API) key and a service policy from a cloud administrator of the cloud environment;
sending, from the server, server data comprising the cloud admin API key, the service policy, and a server identifier to an identity and access management (IAM) server of the cloud environment;
signing, by the server, the server data using a public key of the server;
receiving, at the server, a registration acknowledgment from the IAM server, wherein the registration acknowledgment indicates that the IAM server has verified the public key against a private key internal to the IAM server; and
sending, from the server, the registration acknowledgment to the cloud administrator.

Assignees

• IBM

Inventors

• Wang Sen
• Liu Mei
• Niu Si Bo
• Gao Wen Yi
• Wang Zong Xiong Zx
• Zhang Guoxiang
• Tian Xiao Yi
• Zhang xian wei

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title