Intrusion detection with honeypot keys
AssigneeSophos Limited
InventorsHarald Schütz, Andreas Berger, Russell Humphries, Mark D. Harris, Kenneth D. Ray
Life of this patent
Estimating the term…
Abstract
A honeypot file is cryptographically secured with a cryptographic key. The key, or related key material, is then placed on a central keystore and the file is placed on a data store within the enterprise network. Unauthorized access to the honeypot file can then be detecting by monitoring use of the associated key material, which usefully facilitates detection of file access at any time when, and from any location where, cryptographic access to the file is initiated.
Claims20
A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of:
- providing a honeypot file in a file system accessible to devices in an enterprise network;
- cryptographically securing the honeypot file by encrypting the honeypot file to provide a tagged file;
- storing key material in a central keystore for the enterprise network, the key material for decrypting the tagged file;
- detecting a retrieval of the key material from the central keystore, the retrieval associated with an attempted access of the tagged file by one of the devices;
- and
- initiating a remedial action responsive to detecting the retrieval of the key material, the remedial action including monitoring subsequent network activity within the enterprise network by the one of the devices.
A method, comprising:
- providing a honeypot file in a file system accessible to a device;
- cryptographically securing the honeypot file to provide a tagged file;
- storing the tagged file on a data store in an enterprise network;
- storing a portion of key material in a central keystore for the enterprise network, the key material used in decrypting the tagged file;
- detecting a retrieval of the portion of the key material from the central keystore;
- and
- initiating a security action responsive to the retrieval of the portion of the key material used in decrypting the tagged file.
A system, comprising:
- a data store in an enterprise network;
- a central keystore for the enterprise network;
- and
- a threat management facility executing on a processor and configured to provide a honeypot file, to cryptographically secure the honeypot file with key material, to store the cryptographically secure honeypot file on the data store, to store the key material in the central keystore, to detect use of the key material from the central keystore associated with a decryption of the honeypot file, and to initiate a remedial action responsive to the decryption.
Dependencies are inferred from the claim text.