Zero-knowledge secrets indexing
A system and method for secure secrets correlation. A method includes transmitting a plurality of secret indices from a first system to a second system, wherein the plurality of secret indices correspond to a plurality of secrets stored within a computing environment, wherein the second system is deployed externally to the computing environment; receiving a plurality of non-secret identifiers from the second system; comparing the plurality of non-secret identifiers to the plurality of secret indices in order to determine comparison results; and transmitting the comparison results to the second system.
1 . A method for securing secrets correlation, comprising:
transmitting a plurality of secret indices from a first system to a second system, wherein the plurality of secret indices correspond to a plurality of secrets stored within a computing environment, wherein the second system is deployed externally to the computing environment;
receiving a plurality of non-secret identifiers from the second system;
comparing the plurality of non-secret identifiers to the plurality of secret indices in order to determine comparison results; and
transmitting the comparison results to the second system.
2 . The method of claim 1 , further comprising:
tokenizing secret data of the plurality of secrets into a plurality of tokens; and
hashing the plurality of tokens in order to generate a plurality of hashes, wherein the plurality of secret indices is created based on the plurality of hashes.
3 . The method of claim 2 , wherein the secret data for each of the plurality of secrets includes the secret and at least one non-secret identifier that is associated with the secret.
4 . The method of claim 2 , wherein the plurality of hashes is a plurality of first hashes, further comprising:
generating a second hash for each of the received plurality of non-secret identifiers, wherein comparing the plurality of non-secret identifiers to the plurality of secret indices further comprises comparing the second hash generated for each of the plurality of non-secret identifiers to the plurality of first hashes.
5 . The method of claim 2 , wherein the secret data for each secret of the plurality of secrets is tokenized into a respective subset of the plurality of tokens, wherein the plurality of tokens is hashed using at least one salt value, wherein a number of subsets of the plurality of tokens hashed using the same salt value of the at least one salt value is below a predetermined threshold.
6 . The method of claim 1 , wherein the second system is configured to correlate between the plurality of non-secret identifiers and the plurality of secret indices based on the comparison results.
7 . The method of claim 6 , wherein the second system is further configured to detect a secrets-based vulnerability with respect to at least one first secret of the plurality of secrets based on the correlation between the plurality of non-secret identifiers and the plurality of secret indices, and to perform a remediation action to secure the at least one first secret based on the detected secrets-based vulnerability.
8 . The method of claim 7 , wherein the remediation action includes changing deployment of the at least one first secret.
9 . The method of claim 7 , wherein the remediation action includes modifying a policy used to control access to each of the at least one first secret.
10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
transmitting a plurality of secret indices from a first system to a second system, wherein the plurality of secret indices correspond to a plurality of secrets stored within a computing environment, wherein the second system is deployed externally to the computing environment;
receiving a plurality of non-secret identifiers from the second system;
comparing the plurality of non-secret identifiers to the plurality of secret indices in order to determine comparison results; and
transmitting the comparison results to the second system.
11 . A system for secure secrets correlation, wherein the system is a first system, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
transmit a plurality of secret indices from the first system to a second system, wherein the plurality of secret indices correspond to a plurality of secrets stored within a computing environment, wherein the second system is deployed externally to the computing environment;
receive a plurality of non-secret identifiers from the second system;
compare the plurality of non-secret identifiers to the plurality of secret indices in order to determine comparison results; and
transmit the comparison results to the second system.
12 . The system of claim 11 , wherein the system is further configured to:
tokenize secret data of the plurality of secrets into a plurality of tokens; and
hash the plurality of tokens in order to generate a plurality of hashes, wherein the plurality of secret indices is created based on the plurality of hashes.
13 . The system of claim 12 , wherein the secret data for each of the plurality of secrets includes the secret and at least one non-secret identifier that is associated with the secret.
14 . The system of claim 12 , wherein the plurality of hashes is a plurality of first hashes, wherein the system is further configured to:
generate a second hash for each of the received plurality of non-secret identifiers, wherein comparing the plurality of non-secret identifiers to the plurality of secret indices further comprises comparing the second hash generated for each of the plurality of non-secret identifiers to the plurality of first hashes.
15 . The system of claim 12 , wherein the secret data for each secret of the plurality of secrets is tokenized into a respective subset of the plurality of tokens, wherein the plurality of tokens is hashed using at least one salt value, wherein a number of subsets of the plurality of tokens hashed using the same salt value of the at least one salt value is below a predetermined threshold.
16 . The system of claim 11 , wherein the second system is configured to correlate between the plurality of non-secret identifiers and the plurality of secret indices based on the comparison results.
17 . The system of claim 16 , wherein the second system is further configured to detect a secrets-based vulnerability with respect to at least one first secret of the plurality of secrets based on the correlation between the plurality of non-secret identifiers and the plurality of secret indices, and to perform a remediation action to secure the at least one first secret based on the detected secrets-based vulnerability.
18 . The system of claim 17 , wherein the remediation action includes changing deployment of the at least one first secret.
19 . The system of claim 17 , wherein the remediation action includes modifying a policy used to control access to each of the at least one first secret.