# US 2023/0069596 A1 · Preventing masquerading service attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0069596 A1
- Document ID: US20230069596A1
- Status: Published application
- Kind: A1
- Application number: 17/411,226
- Filed: 2021-08-25
- Published: 2023-03-02
- Earliest claimed: 2021-08-25
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Sen Wang; Mei Liu; Si Bo Niu; WEN YI GAO; Zong Xiong ZX Wang; Guoxiang Zhang; Xiao Yi Tian; XIAN WEI ZHANG
- Web page: https://patentgrep.com/patent/US20230069596A1

## CPC

- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Aspects of the invention include systems and methods configured to prevent masquerading service attacks. A non-limiting example computer-implemented method includes sending, from a first server in a cloud environment, a communication request comprising an application programming interface (API) key and a first server identifier to an identity and access management (IAM) server of the cloud environment. The API key can be uniquely assigned by the IAM server to a first component of the first server. The first server receives a credential that includes a token for the first component and sends the credential to a second server. The second server sends the credential, a second server identifier, and an identifier for a second component of the second server to the IAM server. The second server receives an acknowledgment from the IAM server and sends the acknowledgment to the first server.

## Claims

### Claim 1

A computer-implemented method comprising:
receiving, at a server in a cloud environment, a cloud admin application programming interface (API) key and a service policy from a cloud administrator of the cloud environment;
sending, from the server, server data comprising the cloud admin API key, the service policy, and a server identifier to an identity and access management (IAM) server of the cloud environment;
receiving, at the server, a registration acknowledgment from the IAM server; and
sending, from the server, the registration acknowledgment to the cloud administrator.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 further comprising signing, by the server, the server data using a public key of the server.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein the server signs the server data prior to sending the server data to the IAM server.

### Claim 4 (depends on 2)

The computer-implemented method of claim 2, wherein the registration acknowledgment indicates that the IAM server has verified the public key against a private key internal to the IAM server.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein the registration acknowledgment indicates that the IAM server has added the server to an internally maintained list of trusted servers.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein the server identifier comprises identification data that is unique to the server in the cloud environment.

### Claim 7

A computer-implemented method comprising:
receiving, at a server in a cloud environment, a request for component deployment from an administrator of the cloud environment, wherein the request comprises an identifier for a component within the server;
sending, from the server, server data comprising the request for component deployment and a server identifier to an identity and access management (TAM) server of the cloud environment;
receiving, at the server, an acknowledgment from the TAM server comprising a component application programming interface (API) key; and
sending, from the server, an acknowledgment to the administrator that does not include the API key.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, wherein the administrator comprises a site reliability engineer (SRE) of the cloud environment.

### Claim 9 (depends on 7)

The computer-implemented method of claim 7, wherein the server identifier comprises identification data that is unique to the server in the cloud environment.

### Claim 10 (depends on 7)

The computer-implemented method of claim 7, wherein the acknowledgement from the TAM server indicates that the component has been deployed by the TAM server.

### Claim 11 (depends on 7)

The computer-implemented method of claim 7 further comprising signing, by the server, the server data using a public key of the server.

### Claim 12 (depends on 11)

The computer-implemented method of claim 11, wherein the server signs the server data prior to sending the server data to the TAM server.

### Claim 13

A computer-implemented method comprising:
sending, from a first server in a cloud environment, a communication request comprising an application programming interface (API) key and a first server identifier to an identity and access management (IAM) server of the cloud environment, wherein the API key is assigned by the IAM server to a first component of the first server;
receiving, at the first server, a credential comprising a token for the first component;
sending, from the first server, the credential to a second server in the cloud environment;
sending, from the second server, server data comprising the credential, a second server identifier, and an identifier for a second component of the second server to the IAM server;
receiving, at the second server, an acknowledgment from the IAM server; and
sending, from the second server, the acknowledgment to the first server.

### Claim 14 (depends on 13)

The computer-implemented method of claim 13 further comprising initializing a communication channel between the first component and the second component.

### Claim 15 (depends on 13)

The computer-implemented method of claim 13, wherein the first component is stored within a lock-down system of the first server.

### Claim 16 (depends on 15)

The computer-implemented method of claim 15, wherein the lock-down system comprises a limited API.

### Claim 17 (depends on 16)

The computer-implemented method of claim 16, wherein the cloud environment includes a site reliability engineer (SRE).

### Claim 18 (depends on 17)

The computer-implemented method of claim 17, wherein the limited API does not include functionality for providing the API key to the SRE.

### Claim 19 (depends on 13)

The computer-implemented method of claim 13, wherein the first server identifier comprises identification data that is unique to the first server in the cloud environment, and wherein the second server identifier comprises identification data that is unique to the second server in the cloud environment.

### Claim 20 (depends on 13)

The computer-implemented method of claim 13, wherein the server data further comprises a service identifier associated with a service policy of the cloud environment.