Cloud Public Key Reuse Detection Across Multiple Tenancies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The reuse of user-provided public keys across multiple cloud tenancies can lead to security vulnerabilities and loss of non-repudiation, as a single key pair can control multiple user accounts and compute instances, potentially compromising security and integrity within the cloud environment.
Innovation Solution
Implement a key reuse detection service that monitors public keys and their corresponding fingerprints across tenancies, identifying and tagging keys reused beyond a threshold number of times, prompting users to change keys and potentially deactivating affected accounts or instances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If public keys are reused across multiple user accounts and compute instances, then ease of operation is improved, but security is worsened
Solution Approach 1:
The system performs preliminary detection of public key reuse by querying a database that stores public keys and their attributes across multiple tenancies. Before allowing operations with a public key, the system checks if it has been reused beyond a threshold number of times, and if so, tags it as reused and generates an output indicating the reuse. This preliminary action prevents security issues before they can affect the system.
2Adaptability or versatility
If public key reuse is allowed, then adaptability is improved, but security is worsened
Solution Approach 1:
The system implements a feedback mechanism by monitoring public key usage across the cloud environment. When a public key is detected to be reused beyond a threshold number of times across multiple user accounts or compute instances, the system generates an output indicating the reuse and tags the public key accordingly. This feedback allows the system to adapt by identifying and flagging potentially compromised keys while still allowing legitimate reuse within acceptable limits.
Data Source
AI summary
Techniques for detected reuse of a public key of a public/private cryptographic key pair within a cloud environment are disclosed. A database maintained within a cloud environment is accessed, the database storing a plurality of public keys. Each public key has a corresponding attribute, and the database further stores a plurality of attributes corresponding to the plurality of public keys. Each public key is associated with either (i) a corresponding user account of a corresponding tenancy of the cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment. A number of times a first public key or a first attribute corresponding to the first public key occurring within the database is determined. Responsive to the number of times being equal to or greater than a threshold number, the first public key is tagged as being reused for at least the threshold number of times.