Trust relationships in a computerized system
AssigneeSSH Communications Security OYJ
InventorsTommi Linnakangas, Marko Teiste, Antti Huima, Tatu J. Ylonen
Life of this patent
Estimating the term…
Abstract
Methods and apparatuses for a computerized system are disclosed. A data processing device receives information from at least one source of log information in the computerized system and detects, based at least in part on said received log information, at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device. Information is then stored for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device.
Claims26
A method in a computerized system, comprising:
- receiving at a data processing device log information from at least one source of log information in the computerized system,
- detecting based at least in part on said received log information at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device, and
- storing information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device,
- further comprising analyzing the log information to identify logins that use public-key authentication, and based on the analyzing, estimating at least one metric relating to the trust relationship.
A method in a computerized system, comprising:
- receiving at a data processing device log information from at least one source of log information in the computerized system;
- detecting based at least in part on said received log information at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device;
- storing information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device;
- and
- triggering, in response to detection of a connection from the second host device to the first host device by a user authenticated by a public key represented by its fingerprint, a localized scanning of locations known to potentially contain information of access granting public keys of the user.
A method in a computerized system, comprising:
- receiving at a data processing device log information from at least one source of log information in the computerized system;
- detecting based at least in part on said received log information at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device;
- storing information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device, wherein storing information for determination of the trust relationship record comprises detecting a login to a first user account on the first host device and determining a fingerprint of a key used for authenticating the login, and in response thereto updating a database to indicate that a key corresponding to the fingerprint has been used for logging into the first user account on the first host device at the time of the login;
- the method further comprising:
- identifying a static trust relationship matching the first user account, the first host device, and the fingerprint;
- and
- updating the database to indicate that the static trust relationship has been used at the time of the login.
A method in a computerized system, comprising:
- receiving at a data processing device log information from at least one source of log information in the computerized system;
- detecting based at least in part on said received log information at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device;
- storing information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device;
- and
- determining a pair of public and private keys based on matching fingerprint information associated with the keys, and creating a trust relationship record accordingly.
A method in a computerized system, comprising:
- receiving at a data processing device log information from at least one source of log information in the computerized system,
- detecting based at least in part on said received log information at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device,
- storing information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device, and
- generating a presentation based on said information for determination of the trust relationship record.
An apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to:
- process log information received from at least one source of log information in a computerized system to detect, based at least in part on said received log information, at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device;
- store information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device;
- analyze the log information to identify logins that use public-key authentication;
- and
- estimate, based on the analyzing, at least one metric relating to the trust relationship.
An apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to:
- process log information received from at least one source of log information in a computerized system to detect, based at least in part on said received log information, at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device;
- store information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device;
- and
- trigger, in response to detection of a connection from the second host device to the first host device by a user authenticated by a public key represented by its fingerprint, a localized scanning of locations known to potentially contain information of access granting public keys of the user.
An apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to:
- process log information received from at least one source of log information in a computerized system to detect, based at least in part on said received log information, at least one security protocol related event at a first host device, the at least one security protocol related event being initiated by a second host device;
- store information for determination of a trust relationship record based on the detected at least one security protocol related event and information of the second host device;
- determine pairs of public and private keys based on matching fingerprint information associated with the keys;
- and
- create a trust relationship record accordingly.
Dependencies are inferred from the claim text.