Automated access, key, certificate, and credential management

Patent metadata

Field	Value
Publication number	US-9515999-B2
Application number	US-201214367462-A
Country	US
Kind code	B2
Filing date	Dec 21, 2012
Priority date	Dec 21, 2011
Publication date	Dec 6, 2016
Grant date	Dec 6, 2016

Abstract

Certain embodiments provide means for managing automated access to computers, e.g., using SSH user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSH key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

First claim

The invention claimed is:

1. An apparatus, comprising:
a management host comprising a first processor and a first memory storing instructions that, when executed, manage access to at least one server based on authentication keys, said authentication keys being utilized between a first managed host comprising a second memory storing instructions that perform functions of a client and a second managed host comprising a third memory storing instructions that perform functions of the server, wherein the authentication keys are stored on the first managed host and the second managed host;
wherein the management host is external to the first managed host and the second managed host,
wherein the instructions stored in the first memory, when executed, cause information to be discovered about the first managed host and the second managed host by collecting the information over a network from the first managed host and the second managed host and automatically managing the authentication keys stored on the first managed host and the second managed host based on the collected information.

2. The apparatus according to claim 1 , wherein the instructions stored in the first memory, when executed, cause to be discovered information about at least one of trust relationships, keys, credentials, certificates, and configurations on at least one of the managed hosts.

3. The apparatus according to claim 1 , wherein the instructions stored in the first memory comprise a key installer configured to install an authorized key on at least one of the managed hosts.

4. The apparatus according to claim 1 , wherein the instructions stored in the first memory comprise a key remover configured to remove an authorized key from at least one of the managed hosts.

5. The apparatus according to claim 1 , wherein the instructions stored in the first memory further comprise a trust relationship installer configured to install a trust relationship between the managed hosts.

6. The apparatus according to claim 1 , wherein the instructions stored in the first memory further comprise a trust relationship remover configured to remove a trust relationship from between the managed hosts.

7. The apparatus according to claim 1 , wherein the instructions stored in the first memory further comprise a key rotator configured to rotate existing key pairs.

8. The apparatus according to claim 1 , wherein the instructions stored in the first memory further comprise a trust relationship converter configured to convert an existing trust relationship of a first type to a trust relationship of a second type.

9. The apparatus according to claim 1 , wherein the instructions stored in the first memory further comprise a command restriction enforcer configured to add a command restriction to an existing trust relationship.

10. The apparatus according to claim 1 , wherein the authentication keys comprise user authentication keys according to secure shell protocol (SSH), and the first managed host comprises an SSH client and the second managed host comprises an SSH server.

11. The apparatus of claim 1 , wherein the first memory stores instructions that, when executed, cause the information to be collected by reading one or more configuration files stored on the managed hosts and parsing the configuration files.

12. The apparatus of claim 1 , wherein the first memory stores instructions that, when executed, send scripts to the managed hosts and receive results from executing the scripts on the managed hosts.

13. A method, comprising:
managing access to a server based on authentication keys, said authentication keys being utilized between a first managed host comprising a first memory storing instructions that perform functions of a client and a second managed host comprising a second memory storing instructions that perform functions of a server, said authentication keys being stored on said managed hosts; wherein said managing is performed externally to said first managed host and said second managed host by a management host comprising a processor and third memory storing instructions that perform functions of the managing access;
discovering information about said managed hosts by collecting the information over a network from the first managed host and from the second managed host; and
managing automatically said authentication keys stored on said managed hosts based on the discovered information.

14. The method according to claim 13 , wherein the discovering comprises discovering information about at least one of trust relationships, keys, credentials, certificates, and configurations on at least one of the managed hosts.

15. The method according to claim 13 , wherein the managing further comprises installing an authorized key on at least one of the managed hosts.

16. The method according to claim 13 , wherein the managing further comprises removing an authorized key from at least one of the managed hosts.

17. The method according to claim 13 , wherein the managing further comprises installing a trust relationship between the managed hosts.

18. The method according to claim 13 , wherein the managing further comprises removing a trust relationship from between the managed hosts.

19. The method according to claim 13 , wherein the managing further comprises rotating existing key pairs.

20. The method according to claim 13 , wherein the managing further comprises converting an existing trust relationship of a first type to a trust relationship of a second type.

21. The method according to claim 13 , wherein the managing further comprises adding a command restriction to an existing trust relationship.

22. The method according to claim 13 , wherein the authentication keys comprise user authentication keys according to secure shell protocol (SSH), and the first managed host comprises an SSH client and the second managed host comprises an SSH server.

23. The method of claim 13 , wherein the discovering comprises collecting the information by reading one or more configuration files stored on the managed hosts and parsing the configuration files.

24. The method of claim 13 , wherein the discovering comprises sending scripts to the managed hosts and receiving results from executing the scripts on the managed hosts.

25. A non-transitory computer program comprising computer readable program code embodied therein, operable to cause a management host comprising a processor and a first memory storing instructions therein to manage access to a server based on authentication keys, wherein said authentication keys are utilized between a first managed host comprising a second memory storing instructions that perform functions of a client and a second managed host comprising a third memory storing instructions that perform functions of the server, wherein said authentication keys are stored are on said managed hosts and wherein the managing is performed externally to said first managed host and second managed host;
discovering information about said managed hosts by collecting the information over a network from the first managed host and the second managed host; and
managing automatically said authentication keys stored on said managed hosts based on the discovered information.

26. A system, comprising at least a manager apparatus comprising a processor and a first memory storing instructions that perform management functions, a first managed host comprising a second memory storing i

Assignees

• Ssh Communications Security Oyj

Inventors

• Ylonen Tatu J

Classifications

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title