Back to results
US 10,567,360 B2Granted
SSH key validation in a hyper-converged computing environment
AssigneeVMware, Inc.
InventorsVishesh Kumar Nirwal, Suket Gakhar
Life of this patent
Estimating the term…
Abstract
Disclosed are various examples for validating a public SSH host key. The examples can be implemented in a hyper-converged computing environment to detect potential man-in-the-middle attacks in which an attacker intercepts or spoofs an internet protocol (IP) address of a target virtual machine (VM) that is being addressed by a management service and with which a secure shell (SSH) session is being established.
Claims20
A computer-implemented method, comprising:
- initiating a secure shell (SSH) connection to a target virtual machine running on a host computing device, the host computing device being one of a plurality of hyper-converged computing devices in a hyper-converged virtual computing environment;
- obtaining a public SSH host key from the target virtual machine, wherein the public SSH host key corresponds to a private SSH host key associated with the target virtual machine;
- sending an artifact of the public SSH host key to a trusted service running on the same host computing device as the target virtual machine, wherein the trusted service is configured to validate the public SSH host key associated with the target virtual machine by obtaining the public SSH host key directly from the target virtual machine in a request without using the same internet protocol address associated with the SSH connection to the target virtual machine;
- obtaining a validity indication from the trusted service in response to a determination that the public SSH host key is valid or invalid;
- and
- saving the public SSH host key as a trusted key in response to the validity indication indicating that the public SSH host key is valid.
3 more elements
A system, comprising:
- at least one computing device comprising memory;
- and
- program instructions stored in the memory and executable in the at least one computing device that, when executed, cause the at least one computing device to:
- initiate a secure shell (SSH) connection to a target virtual machine running on a host computing device, the host computing device being one of a plurality of hyper-converged computing devices in a hyper-converged virtual computing environment;
- obtain a public SSH host key from the target virtual machine, wherein the public SSH host key corresponds to a private SSH host key associated with the target virtual machine;
- send an artifact of the public SSH host key to a trusted service running on the same host computing device as the target virtual machine, wherein the trusted service is configured to validate the public SSH host key associated with the target virtual machine by obtaining the public SSH host key directly from the target virtual machine in a request without using the same internet protocol address associated with the SSH connection to the target virtual machine;
- obtain a validity indication from the trusted service in response to a determination that the public SSH host key is valid or invalid;
- and
- save the public SSH host key as a trusted key in response to the validity indication indicating that the public SSH host key is valid.
6 more elements
A non-transitory computer-readable medium embodying program code executable in at least one computing device that, when executed by the at least one computing device, causes the at least one computing device to:
- initiate a secure shell (SSH) connection to a target virtual machine running on a host computing device, the host computing device being one of a plurality of hyper-converged computing devices in a hyper-converged virtual computing environment;
- obtain a public SSH host key from the target virtual machine, wherein the public SSH host key corresponds to a private SSH host key associated with the target virtual machine;
- send an artifact of the public SSH host key to a trusted service running on the same host computing device as the target virtual machine, wherein the trusted service is configured to validate the public SSH host key associated with the target virtual machine by obtaining the public SSH host key directly from the target virtual machine in a request without using the same internet protocol address associated with the SSH connection to the target virtual machine;
- obtain a validity indication from the trusted service in response to a determination that the public SSH host key is valid or invalid;
- and
- save the public SSH host key as a trusted key in response to the validity indication indicating that the public SSH host key is valid.
3 more elements
Dependencies are inferred from the claim text.