SSH Private Key Detection for Cloud Lateral Movement Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for detecting lateral movement in cloud computing environments are complex, costly, and fail to provide comprehensive coverage, especially for serverless applications, making it difficult to detect and prevent attacks that exploit exposed cryptographic network protocol keys.
Innovation Solution
A system and method that inspects workloads for private CNP keys, associates them with public CNP key hashes, and generates a lateral movement path using a security graph to identify potential vulnerabilities and expose compromised keys, enabling proactive security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If specialized scanning agents are deployed to detect cloud workload vulnerabilities, then detection capability is improved, but device complexity and operational cost increase
Solution Approach 1:
The patent extracts the vulnerability scanning function from traditional agent-based systems and implements it through cloud provider APIs. The system uses `list_instances`, `get_instance_metadata`, and `stop_instance` API calls to scan workloads without deploying specialized scanning agents, thereby reducing system complexity while maintaining detection capability.
Solution Approach 2:
The patent introduces cloud provider APIs as an intermediary between the scanning system and workloads. Instead of directly interacting with workloads through complex agents, the system uses standardized API calls to retrieve instance information, metadata, and stop instances, simplifying the overall system architecture.
2Adaptability or versatility
If agent-based scanning is implemented for container workloads, then coverage is improved, but deployment and maintenance complexity increase
Solution Approach 1:
The patent implements a universal scanning approach using cloud provider APIs that works across different workload types including virtual machines, containers, and serverless functions. The same API-based mechanism (`list_instances`, `getinstance_metadata`) scans all workload types without requiring type-specific agents, thereby improving versatility while reducing deployment complexity.
3Reliability
If comprehensive cloud workload scanning is performed, then security coverage is improved, but time required for scanning increases
Solution Approach 1:
The patent performs preliminary actions by retrieving instance metadata and configuration information before actually scanning for vulnerabilities. The system uses `getinstance_metadata` to obtain workload information in advance, allowing the scanning process to be more efficient and reducing overall scanning time while maintaining comprehensive coverage.
Solution Approach 2:
The patent implements a streamlined scanning process that skips unnecessary steps by directly using cloud provider APIs to access workload information. Instead of performing comprehensive manual inspection, the system rapidly retrieves instance details, metadata, and configuration through API calls, significantly reducing scanning time while maintaining security coverage.
4Object-affected harmful factors
If lateral movement detection is enhanced to detect exposed cryptographic keys, then security against attacks is improved, but detection complexity increases
Solution Approach 1:
The patent implements feedback mechanisms by continuously monitoring cloud workload metadata and configuration changes. The system uses `getinstance_metadata` to retrieve current workload information and compares it against known vulnerable patterns, providing real-time feedback on potential exposed cryptographic keys and enabling proactive security responses.
Data Source
AI summary
A system and method for detecting lateral movement based on an exposed cryptographic network protocol (CNP) key in a cloud computing environment. The method includes: inspecting a first workload for a private CNP key, the private CNP key associated with a hash of a public CNP key; detecting in a security database a representation of the public CNP key; generating a lateral movement path, the lateral movement path including an identifier of a second workload, the second workload represented by a representation connected to the representation of the public CNP key.