Authentication incident detection and management
AssigneeAttivo Networks Inc.
InventorsVenu Vissamsetty, Srikant Vissamsetti, Nitin Jyoti, Harinath Vishwanath Ramchetty
Life of this patent
Estimating the term…
Abstract
A system reports credentials on nodes of a network. Nodes are assigned to security silos. If a credential reported from a node is found to match a credential found on a node outside of its security silo or be for authentication with a node outside the its security an alert is generated, unless proper precautions are generated. Credentials may be reported as one-way hashes of credentials. Security silos may be automatically generated to segregate at-risk nodes from critical servers based on the presence or use of email clients and browsers. Precautions that may be used to suppress alerts, such as using KERBEROS TGT.
Claims19
A method comprising:
- receiving, by a computer device, definitions of a plurality of silos, such that a first silo references a first group of nodes of a plurality of network nodes and a second silo references a second group of nodes of the plurality of network nodes not included in the first group of nodes, each node of the plurality of network nodes being one of a plurality of computing devices;
- evaluating, by the computer device, credentials stored on each node of the plurality of network nodes;
- identifying, by the computer device, one or more credentials stored on a first node referenced by the first silo of the plurality of silos, the one or more credentials effective to authenticate the first node with respect to one or more other nodes of the plurality of network nodes;
- determining, by the computer device, that a first credential of the one or more credentials stored on the first node matches an authentication credential of a second node of the plurality of network nodes that is not referenced by the first silo, the authentication credential being effective to authenticate with respect to the second node;
- in response to determining that the first credential matches the authentication credential for the second node that is not referenced by the first silo, generating, by the computer device, an alert;
- determining, by the computer device, that a second credential of the one or more credentials stored on the first node matches an authentication credential of a third node of the plurality of network nodes that is referenced by the first silo, the authentication credential being effective to authenticate with respect to the third node;
- and
- in response to determining that the first credential matches the authentication credential for the second node that is not referenced by the first silo, refraining, by the computer device, from generating an alert.
A system comprising one or more processing devices and one or more memory devices coupled to the one or more processing devices, the one or more memory devices storing executable code effective to cause the one or more processing devices to:
- receive definitions of a plurality of silos, each silo definition referencing at least one node of a plurality of network nodes such that a first silo references a first group of nodes of the plurality of network nodes and a second silo references a second group of nodes of the plurality of network nodes not included in the first group of nodes;
- for each node of the plurality of network nodes—
- (a) evaluate credentials stored on the each node;
- (b) if a first credential stored on the each node matches an authentication credential enabling automatic authentication with a second node of the plurality of network nodes that is not referenced by a silo referencing the each node, generating an alert;
- and
- (c) if the first credential stored on the each node matches an authentication credential enabling automatic authentication with a third node of the plurality of network nodes that is referenced by the silo referencing the each node, refraining from generating the alert.
Dependencies are inferred from the claim text.