Certificate Private-Key Mapping in Security Graphs for Cloud Lateral Movement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud environments face challenges in detecting and preventing lateral movement attacks due to the complexity of deploying and maintaining agent-dependent scanning tools, which often fail to provide comprehensive coverage for virtual machines, containers, and serverless applications, making it difficult to detect and prevent attackers moving through the network.
Innovation Solution
A method and system that utilize a security graph to detect potential lateral movement by matching private encryption keys with certificates, each having a hash value of a public key, and determining resource compromise based on compromised public key elements, enabling visualization of potential vulnerabilities and compromised workloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agent-dependent scanning tools are deployed to detect cloud workload vulnerabilities, then vulnerability detection capability is improved, but device complexity and maintenance cost increase
Solution Approach 1:
The patent extracts the vulnerability scanning function from agent-dependent processes and implements it through agentless techniques. Specifically, it uses cloud-native APIs and configuration files to gather security information without requiring scanning agents to be deployed on individual workloads, thereby maintaining detection capability while reducing deployment complexity
Solution Approach 2:
The patent creates a universal scanning approach that works across multiple cloud workload types (virtual machines, containers, serverless applications) using a single agentless methodology. The system can scan diverse workload types through common mechanisms like configuration file analysis and API queries, eliminating the need for different agent implementations for different platforms
2Reliability
If scanning agents are deployed to cover all cloud workload types, then vulnerability coverage is improved, but ease of operation deteriorates
Solution Approach 1:
The patent implements self-service mechanisms where cloud workloads provide their own security information through exposed configuration files and APIs. The scanning system queries these self-provided information sources without needing to install or maintain agents on the workloads, making the system easier to operate while maintaining comprehensive coverage
Solution Approach 2:
The patent introduces cloud-native configuration files and APIs as intermediaries between the scanning system and the workloads. These intermediaries provide the necessary security information without requiring direct agent installation on workloads, simplifying deployment while maintaining coverage across virtual machines, containers, and serverless applications
3Measurement precision
If traditional scanning methods are used, then detection capability is improved, but response time to lateral movement attacks worsens
Solution Approach 1:
The patent performs preliminary actions by continuously monitoring and analyzing credential usage patterns, certificate validity, and access anomalies before lateral movement attacks can progress. The system proactively identifies suspicious activities such as unusual certificate usage or unexpected access patterns, enabling early detection and response to potential lateral movement attacks
Data Source
AI summary
A system and method for detecting potential lateral movement in a cloud computing environment includes detecting a private encryption key and a certificate, each of which further include a hash value of a respective public key, wherein the certificate is stored on a first resource deployed in the cloud computing environment; generating in a security graph: a private key node, a certificate node, and a resource node connected to the certificate node, wherein the security graph is a representation of the cloud computing environment; generating a connection in the security graph between the private key node and the certificate node, in response to determining a match between the hash values of the public key of the private key and the public key of the certificate; and determining that the first resource node is potentially compromised, in response to receiving an indication that an element of the public key is compromised.