Authenticated assessment of network system assets
A method for authenticated asset assessment is provided. The method involves executing a scan assistant on an asset to allow a remote scan engine to execute one or more scan operations on the asset for determining a state of the asset. The scan assistant may verify the identity of the scan engine by checking that a certificate received from the scan engine is signed with a private key associated with the scan engine. In some embodiments, the authentication may be performed as part of a TLS handshake process that establishes a TLS connection between the scan engine and the scan assistant. Once the scan engine is authenticated, the scan engine may communicate with the scan assistant according to a communication protocol to collect data about the asset. Advantageously, the disclosed technique reduces security risks associated with authenticated scans and improves the performance of authenticated scans.
1. A method comprising:
performing, by a scan assistant on an asset of a network:
establishing a transport layer security (TLS) connection with a scan engine on a device having electronic communication with the asset using TLS protocol, wherein the asset comprises at least one computing resource, wherein the scan engine is configured to use the scan assistant to perform scans of the asset based on a communication protocol, wherein the scan assistant provides the scan engine access to perform the scans, and
wherein the establishing of the TLS connection comprises the scan assistant:
receiving a public certificate from the scan engine; and
authenticating the scan engine to execute scan operations on the asset based on verifying the public certificate from the scan engine with a certificate authority stored on the asset;
receiving, from the scan engine, one or more scan operations to execute on the asset according to the communication protocol;
executing the one or more scan operations on the asset to obtain results reflecting a state of the asset; and
sending the results to the scan engine according to the communication protocol.
2. The method of claim 1 , wherein the one or more scan operations specify operating system commands to collect information about the asset.
3. The method of claim 1 , further comprising the scan assistant establishing different TLS connections with different scan engines according to different TLS protocol versions.
4. The method of claim 1 , wherein the scan engine stores different pairs of public certificates and private keys associated with different assets, and the different pairs of public certificates and private keys are used to establish TLS connections with the different assets.
5. The method of claim 1 , further comprising the scan assistant:
generating a second public certificate and a second private key pair associated with the scan assistant; and
sending the second public certificate of the scan assistant to the scan engine as part of a two-way certificate authentication,
wherein the second public certificate and second private key pair is generated when the asset is rebooted or the scan assistant is started as a service on the asset, and
wherein the scan engine is configured to authenticate the scan assistant without verifying the second public certificate from the scan assistant with a second certificate authority.
6. The method of claim 1 , further comprising the scan assistant:
storing a signed second public certificate and a second private key pair on the asset; and
sending the signed second public certificate to the scan engine;
wherein the scan engine is configured to authenticate the scan assistant based on verifying the signed second public certificate from the scan assistant with a second certificate authority stored on the scan engine.
7. The method of claim 6 , further comprising the scan engine:
receiving, from the scan assistant, the signed second public certificate; and
verifying the scan assistant based on the signed second public certificate using the second certificate authority stored on the scan engine.
8. The method of claim 7 , wherein the scan engine is configured to use different certificate authorities to verify public certificates of different scan assistants.
9. The method of claim 1 , wherein the TLS connection is established using a one-way certificate authentication.
10. The method of claim 1 , wherein the TLS connection is established using a two-way certificate authentication.
11. The method of claim 1 , wherein the communication protocol is used by the scan engine to request data stored on the asset or query information about the asset.
12. The method of claim 1 , wherein the communication protocol is used by the scan engine to execute commands on the asset.
13. A system comprising:
a memory that stores program instructions; and
one or more processor that executes the program instructions to implement a scan assistant on an asset, the scan assistant configured to:
establish a transport layer security (TLS) connection with a scan engine on a device having electronic communication with the asset using TLS protocol, wherein the asset comprises at least one computing resource, wherein the scan engine is configured to use the scan assistant to perform scans of the asset based on a communication protocol, wherein the scan assistant provides the scan engine access to perform the scans, and wherein to establish the TLS connection the scan assistant is configured to:
receive a public certificate from the scan engine; and
authenticate the scan engine to execute scan operations on the asset based on verifying the public certificate from the scan engine with a certificate authority stored on the asset;
receive, from the scan engine, one or more scan operations to execute on the asset according to the communication protocol;
execute the one or more scan operations on the asset to obtain results reflecting a state of the asset; and
send the results to the scan engine according to the communication protocol.
14. The system of claim 13 , wherein the one or more scan operations specify to execute one or more shell scripts on the asset.
15. The system of claim 13 , wherein the certificate authority comprises a self-signed public certificate signed using a private key of the scan engine.
16. The system of claim 13 , wherein the scan assistant is configured to:
generate a second public certificate and a second private key pair associated with the scan assistant; and
send the second public certificate of the scan assistant to the scan engine as part of a two-way certificate authentication,
wherein the second public certificate and second private key pair is generated when the asset is rebooted or the scan assistant is started as a service on the asset, and
wherein the scan engine is configured to authenticate the scan assistant without verifying the second public certificate from the scan assistant with a second certificate authority.
17. The system of claim 13 , wherein the scan assistant is configured to:
store a signed second public certificate and a second private key pair on the asset; and
send the signed second public certificate to the scan engine;
wherein the scan engine is configured to authenticate the scan assistant based on verifying the signed second public certificate from the scan assistant with a second certificate authority stored on the scan engine.
18. A non-transitory, computer-readable storage medium storing program instructions that when executed by one or more processors, cause the one or more processors to implement a scan assistant on an asset, the scan assistant configured to:
establish a transport layer security (TLS) connection with a scan engine on a device having electronic communication with the asset using TLS protocol, wherein the asset comprises at least one computing resource, wherein the scan engine is configured to use the scan assistant to perform scans of the asset based on a communication protocol, wherein the scan assistant provides the scan engine access to perform the scans wherein to establish the TLS connection the scan assistant is configured to:
receive a public certificate from the scan engine; and
authenticate the scan engine to execute scan operations on the asset based on verifying the public certificate from the scan engine with a certificate authority stored on the asset;
receive, from the scan engine, one or more scan operations to execute on the asset according to the communication protocol;
execute the one or more scan operations on the asset to obtain results reflecting a state of the asset; and
send the results to the scan engine according to the communication protocol.
19. The non-transitory, computer-readable storage medium of claim 18 , wherein the certificate authority comprises a self-signed public certificate signed using a private key of the scan engine, and the self-signed public certificate is included as part of an installation package of the scan assistant.
20. The non-transitory, computer-readable storage medium of claim 18 , wherein the certificate authority comprises a self-signed public certificate signed using a private key of the scan engine, and the self-signed public certificate is pushed to the scan assistant based on a periodic rotation schedule.