Validating public keys used in client certificate workflows
A key validation service may automatically determine whether an unauthorized public key was used by a client to log into a host using client-based authentication. This may allow the service to detect that an attack has occurred to circumvent the certificate workflow (e.g., tampering with the host security configuration file or using a replica of a trusted certificate authority). The service may do so by comparing the public key that was used by a client to a list of authorized public keys (e.g., public keys that are trusted by the service). When an unauthorized public key is detected, the service may provide a notification.
1 . A system, comprising:
one or more processors and one or more memories, wherein the one or more memories have stored thereon instructions, which when executed by the one or more processors, cause the one or more processors to implement a key validation service of a provider network, wherein the key validation service is configured to:
receive, from one or more authorized certificate authorities (CAs), a plurality of key creation events that respectively comprise an authorized public key that was provided by one of the authorized CAs to a given client as part of a given client certificate that was signed by the authorized CA using a private key of the authorized CA; and
for individual login events of an input stream, wherein the input stream comprises login events for different hosts:
receive the login event, wherein the login event comprises a public key that was provided by a client to one of the hosts for authentication of the client;
determine whether the public key that was used for the authentication of the client by the host was also used by the host to authenticate the client prior to the authentication of the client by the host indicated by the received login event of the input stream;
in response to a determination that the public key used for the authentication of the client was not also used by the host to authenticate the client prior to the authentication of the client indicated by the received login event of the input stream, determine, based on the authorized public keys of the plurality of key creation events received by the provider network from the one or more authorized CAs, whether the public key that was used for the authentication of the client by the host is an authorized public key or an unauthorized public key; and
in response to a determination that the public key is an unauthorized public key, send, to an endpoint, an indication based on the determination that the public key is unauthorized.
2 . The system as recited in claim 1 , wherein to determine that the public key was not previously used by the host to authenticate the client, the key validation service is further configured to:
determine, based on an event key for the login event and an event history, that the public key was not previously used by the host.
3 . The system as recited in claim 2 , wherein the key validation service is further configured to:
update the event history based on the event key for the login event.
4 . The system as recited in claim 1 , wherein the key validation service is further configured to:
in response to a determination that the public key was previously used by the host to authenticate the client, determine, based on satisfaction of one or more criteria, that the login event is an anomalous event; and
in response to the determination that the login event is an anomalous event, send, to the endpoint, an indication based on the anomalous event.
5 . The system as recited in claim 4 , wherein the one or more criteria comprises:
a geographic location of the client indicated by the login event is within one or more unauthorized locations, or
an amount of time since the public key was previously used by the host to authenticate the client exceeds a threshold amount of time.
6 . A method, comprising:
performing, by one or more computing devices of a provider network:
for individual login events of an input stream, wherein the input stream comprises login events for different hosts:
receiving the login event, wherein the login event comprises a public key that was provided by a client to one of the hosts for authentication of the client;
determining that the public key that was used for the authentication of the client by the host was not also used by the host to authenticate the client prior to the authentication of the client indicated by the received login event of the input stream, wherein a given authorized public key of a plurality of authorized public keys was provided by an authorized source to a given client as part of a given client certificate that was signed by the authorized source using a private key of the authorized source;
in response to determining that the public key that was used for the authentication of the client by the host was not also used by the host to authenticate the client prior to the authentication of the client indicated by the received login event of the input stream, determining, based on the plurality of authorized public keys provided by the authorized source to the provider network, that the public key that was used for the authentication of the client by the host is an unauthorized public key; and
in response to determining that the public key is an unauthorized public key, sending, to an endpoint, an indication based on the determination that the public key is unauthorized.
7 . The method as recited in claim 6 , wherein determining that the public key is an unauthorized public key comprises:
determining that none of the plurality of authorized public keys matches the public key.
8 . The method as recited in claim 6 , further comprising performing, by the one or more computing devices:
receiving another login event of the input stream, wherein the other login event comprises another public key that was provided by another client to another of the hosts for authentication of the other client;
determining that the other public key was not previously used by the other host to authenticate the client; and
determining, based on the plurality of authorized public keys, that the other public key is an unauthorized public key.
9 . The method as recited in claim 6 , wherein determining that the public key was not previously used by the host to authenticate the client comprises:
determining, based on an event key for the login event and an event history, that the public key was not previously used by the host.
10 . The method as recited in claim 9 , wherein the event history comprises a lookup table, and further comprising performing, by the one or more computing devices:
inserting, into the lookup table, an entry comprising the event key or a hash of the event key.
11 . The method as recited in claim 9 , wherein the event key comprises one or more of an identifier of the host or an account identifier for the client.
12 . The method as recited in claim 6 , wherein the one or more authorized sources comprises one or more CAs.
13 . The method as recited in claim 6 , wherein the host comprises a virtual machine implemented by a service of the provider network.
14 . The method as recited in claim 13 , further comprising performing, by the one or more computing devices:
receiving another login event of the input stream, wherein the other login event comprises another public key that was provided by another client to another of the hosts for authentication of the other client;
determining that one of the plurality of authorized public keys matches the public key; and
in response to determining that the authorized public key matches the public key, determining that the public key is an authorized public key.
15 . One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors of a provider network cause the one or more processors to:
receive, from one or more authorized sources, a plurality of authorized public keys, wherein a given authorized public key of the plurality of authorized public keys was provided by an authorized source to a given client as part of a given client certificate that was signed by the authorized source using a private key of the authorized source;
for individual login events of an input stream, wherein the input stream comprises login events for different hosts:
receive the login event, wherein the login event comprises a public key that was provided by a client to one of the hosts for authentication of the client;
determine that the public key that was used for the authentication of the client by the host was not also used by the host to authenticate the client prior to the authentication of the client indicated by the received login event of the input stream;
in response to the determination that the public key that was used for the authentication of the client by the host was not also used by the host to authenticate the client prior to the authentication of the client indicated by the received login event of the input stream, determine, based on the plurality of authorized public keys provided by the authorized source to the provider network, that the public key that was used for the authentication of the client by the host is an unauthorized public key; and
in response to a determination that the public key is an unauthorized public key, send, to an endpoint, an indication based on the determination that the public key is unauthorized.
16 . The one or more storage media as recited in claim 15 , wherein to determine that the public key is an unauthorized public key, the program instructions when executed on or across the one or more processors further cause the one or more processors to:
determine that none of the plurality of authorized public keys matches the public key.
17 . The one or more storage media as recited in claim 15 , the program instructions when executed on or across the one or more processors further cause the one or more processors to:
receive another login event of the input stream, wherein the other login event comprises another public key that was provided by another client to another of the hosts for authentication of the other client;
determine that the other public key was not previously used by the other host to authenticate the client; and
determine, based on the plurality of authorized public keys, that the other public key is an unauthorized public key.
18 . The one or more storage media as recited in claim 15 , wherein the program instructions when executed on or across the one or more processors further cause the one or more processors to:
receive another login event of the input stream, wherein the other login event comprises another public key that was provided by another client to another of the hosts for authentication of the other client;
determine that the other public key was previously used by the host to authenticate the client;
determine, based on satisfaction of one or more criteria, that the other login event is an anomalous event; and
in response to the determination that the login event is an anomalous event, send, to the endpoint, an indication based on the anomalous event.
19 . The one or more storage media as recited in claim 18 , wherein the one or more criteria comprises:
a geographic location of the client indicated by the login event is within one or more unauthorized locations, or
an amount of time since the public key was previously used by the host to authenticate the client exceeds a threshold amount of time.
20 . The one or more storage media as recited in claim 15 , wherein the program instructions when executed on or across the one or more processors further cause the one or more processors to:
in response to a determination that the public key is an unauthorized public key, cause the host to be quarantined.