AUTOMATED REVOCATION SYSTEM FOR LEAKED ACCESS CREDENTIALS

Techniques for automatically revoking leaked access credentials are disclosed. In some embodiments, a computer system may receive an indication that a credential for accessing a resource has been leaked, where the credential has been leaked by being included in content that has been published on an online service or has been stored in a shared folder of the online service. The computer system may then determine that the credential is effective in accessing the resource, and, in response to the determining that the credential is effective, trigger a revocation of the credential, the revocation of the credential causing the credential to no longer be effective in accessing the resource.

BACKGROUND

Users can make content available for others to access via an online service. For example, software developers may publish source code on a code hosting platform, such as in situations where source code is being used as part of an open-source software project.

DETAILED DESCRIPTION

Users that publish content may not want certain information to be included in their published content. For example, software developers are concerned by the risk of having vulnerabilities that can represent a weakness exploitable by an attacker, which can occur when hardcoded tokens are included in source code that is published. This type of leak may occur when a software developer leaves hard-coded credentials in source code. The credentials can be used for inbound authentication, outbound communication to external components, or encryption of internal data. In these situations, it becomes very easy for an attacker to use these credentials to access a system, a database, or bypass the access control systems protecting the software. As a result, the security of electronic data, software, and hardware may be compromised. In addition to the issues discussed above, other technical problems may arise as well.

The implementation of the features disclosed herein involves a non-generic, unconventional, and non-routine operation or combination of operations. By applying one or more of the solutions disclosed herein, some technical effects of the system and method of the present disclosure are to automatically revoke leaked access credentials. In some example embodiments, a computer system may receive an indication that a credential for accessing a resource has been leaked, determine that the credential is effective in accessing the resource, and, in response to determining that the credential is effective, triggering a revocation of the credential. The credential may have been leaked by being included in content that has been published on an online service or by being included in content that has been stored in a shared folder of the online service. The revocation of the credential may cause the credential to no longer be effective in accessing the resource.

By automatically triggering the revocation of the leaked credential in response to the determination that the leaked credential is still effective in accessing the resource, the computer system quickly removes the vulnerability of the resource once the vulnerability is detected, thereby reducing the risk of exploitation by an attacker and improving the security of the resource. Furthermore, by conditioning the triggering of the revocation of the leaked credential on the determination that the leaked credential is still effective in accessing the resource, the computer system ensures that network bandwidth and system processing resources are not wasted on a request to revoke a leaked credential that is not at risk of exploitation by an attacker, thereby maximizing the efficiency of this computer security solution. Other technical effects will be apparent from this disclosure as well.

The methods or embodiments disclosed herein may be implemented as a computer system having one or more modules (e.g., hardware modules or software modules). Such modules may be executed by one or more hardware processors of the computer system. In some example embodiments, a non-transitory machine-readable storage device can store a set of instructions that, when executed by at least one processor, causes the at least one processor to perform the operations and method steps discussed within the present disclosure.

The details of one or more variations of the subject matter described herein are set forth in the accompanying drawings and the description below. Other features and benefits of the subject matter described herein will be apparent from the description and drawings, and from the claims.

FIG.1is an example network diagram illustrating a system100. A platform (e.g., machines and software), in the example form of an enterprise application platform112, provides server-side functionality, via a network114(e.g., the Internet) to one or more clients.FIG.1illustrates, for example, a client machine116with programmatic client118(e.g., a browser), a small device client machine122with a small device web client120(e.g., a browser without a script engine), and a client/server machine117with a programmatic client119.

Turning specifically to the enterprise application platform112, web servers124and Application Program Interface (API) servers125can be coupled to, and provide web and programmatic interfaces to, application servers126. The application servers126can be, in turn, coupled to one or more database servers128that facilitate access to one or more databases130. The web servers124, API servers125, application servers126, and database servers128can host cross-functional services132. The cross-functional services132can include relational database modules to provide support services for access to the database(s)130, which includes a user interface library136. The application servers126can further host domain applications134. The web servers124and the API servers125may be combined.

The cross-functional services132provide services to users and processes that utilize the enterprise application platform112. For instance, the cross-functional services132can provide portal services (e.g., web services), database services, and connectivity to the domain applications134for users that operate the client machine116, the client/server machine117, and the small device client machine122. In addition, the cross-functional services132can provide an environment for delivering enhancements to existing applications and for integrating third-party and legacy applications with existing cross-functional services132and domain applications134. In some example embodiments, the system100comprises a client-server system that employs a client-server architecture, as shown inFIG.1. However, the embodiments of the present disclosure are, of course, not limited to a client-server architecture, and could equally well find application in a distributed, or peer-to-peer, architecture system.

FIG.2is a block diagram illustrating an example revocation system200. The components shown inFIG.2may be configured to communicate with each other via one or more network connections (e.g., using the network114inFIG.1). In some example embodiments, the revocation system200comprises any combination of one or more of a credential classifier202, a credential verifier204, and a credential manager206. One or more of the components of the revocation system200may be implemented by the enterprise application platform112ofFIG.1. For example, the credential classifier202, the credential verifier204, and the credential manager206may be incorporated into the application server(s)126. However, the revocation system200may be implemented in other ways as well.

The revocation system200may be configured to automatically revoke leaked access credentials. In some example embodiments, the credential classifier202may be configured to receive an indication that a credential for accessing a resource has been leaked. A resource is any physical or virtual component of limited availability within a computer system. All connected devices and internal system components are resources. Virtual system resources include files, network connections, and memory areas. In some example embodiments, the resource may comprise a database, a software application, or an application programming interface. However, other types of resources are also within the scope of the present disclosure.

The credential may have been leaked by being included in content that has been published on an online service210or has been stored in a shared folder of the online service210. A shared folder is a folder that is designated, at the point of installation, for users to store files that one or more other users of the respective file-sharing network can view, download, or otherwise access. In one example, the content comprises source code uploaded by a user of a computing device205onto a code hosting platform212of the online service210. Source code is a computer program in its original programming language before translation (e.g. by a compiler) into object code. Other types of content are also within the scope of the present disclosure. The code hosting platform212may comprise a file archive and web hosting facility for source code of software, documentation, web pages, and other works, accessible either publicly or privately. The code hosting platform212may be used for open-source software projects and other multi-developer projects to maintain revision and version history, or version control. When a software developer pushes source code into the code hosting platform212or a shared folder, the source code becomes accessible to other users. Depending on the nature of the code hosting platform212, the source code can stay in a private local environment (e.g., organization or company) or can become publicly available.

The credential may comprise any user name, identification number, password, license, security key, security token, or other security code, method, technology, or device used, alone or in combination, to verify an entity's identity and authorization to access the resource. In some example embodiments, the credential may comprise a password, a digital certificate, a security key, or an access token. Other types of credentials are also within the scope of the present disclosure.

The credential scanner214may scan the content stored on the online service210to identify any credentials or other secrets included in the content. For example, the credential scanner214may scan the source code stored by the code hosting platform212to identify any credentials in the source code. The credential scanner214may use pattern recognition techniques involving regular expressions to identify credentials. Additionally or alternatively, the credential scanner214may use one or more machine learning models to identify credentials. The online service210may store the credentials identified by the credential scanner214in an identified secret store216. The identified secret store216may be accessible to the revocation system200via a secure API. The revocation system200may access the identified secret store216in other ways as well.

The credential verifier204may be configured to determine that the credential is effective in accessing the resource. For example, the credential verifier204may transmit a verification request to a credential management system220to verify whether the credential is still effective in accessing the resource. The credential management system220may comprise any computer system that is configured to issue and manage credentials for accessing resources. In response to receiving the verification request, the credential management system220may perform a verification process to determine whether the credential is still effective, such as by checking the status of the credential in a database that stores credentials for resources. If the credential management system220determines that the credential is no longer effective, such as based on a search for the credential in the database resulting in the credential not being found in the database or an indication of the credential being expired, revoked, or otherwise ineffective), then the credential management system220may transmit a response to the credential verifier204indicating that the credential is not effective. If the credential management system220determines that the credential is still effective, such as based on the search of the credential in the database resulting in an indication that the credential is effective (e.g., the credential having a status of active or the like in the database), then the credential management system220may transmit a response to the credential verifier204indicating that the credential is effective.

In some example embodiments, the credential verifier204may be configured to identify a credential type for the credential and generate the verification request based on the credential type for the credential. Examples of credential types include, but are not limited to, an API token, a database password, and an e-mail credential. Other credential types are also within the scope of the present disclosure. The token verifier204may identify the credential type for the credential by inputting the credential into a machine learning classifier that is configured to classify the credential into one of one of a set of credential types. Alternatively, the credential verifier204may identify the credential type for the credential by applying one or more statis rules to the credential, such as by matching the format of the credential to the format of one of a set of credential types. Other ways of identifying the credential type for the credential are also within the scope of the present disclosure.

The credential verifier204may generate the request to verify that the credential is effective using the identified credential type. In some example embodiment, the credential verifier204may identify network domain information based on the identified credential type and generate the request to verify that the credential is effective based on the identifying of the network domain information. A network domain is an administrative grouping of multiple private computer networks or local hosts within the same infrastructure. Domains can be identified using a domain name. Domains which need to be accessible from the public Internet can be assigned a globally unique name within the Domain Name System (DNS). In some example embodiments, the network domain information is not directly evident based on the identified credential type. Therefore, if the credential verifier204determines that it cannot determine the network domain information of the credential directly from the identified credential type, the credential verifier204may scan the content stored on the online service210for the network domain information included in the content, identify the network domain information included in the content, and generate the request to verify that the credential is effective based on the identifying of the network domain information.

The network domain information may be used by the credential verifier204to determine the destination of the request, such as to determine to which credential management system200or to which credential management server within the credential management system200to address the request. The credential verifier204may be configured to transmit, to the credential management system220, a request to verify that the credential is effective in accessing the resource. The credential verifier204may transmit the request to the credential management system220via a network connection, such as via the network114inFIG.1.

The credential verifier204may receive, from the credential management system220, a verification that the credential is effective in accessing the resource. The verification may comprise a message that includes “PASS” or “1” or some other text-based indication that verifies that the credential is effective in accessing the resource. Other forms or configurations of the verification are also within the scope of the present disclosure. The credential verifier204may, alternatively, receive a response from the credential management system220indicating that the credential is not effective in accessing the resource. The response may comprise a message that includes “FAIL” or “0” or some other text-based indication that indicates that the credential is not effective in accessing the resource. Other forms or configurations of the response are also within the scope of the present disclosure.

In some example embodiments, the credential manager206may be configured to trigger a revocation of the credential in response to the determination that the credential is effective. The revocation of the credential may cause the credential to no longer be effective in accessing the resource. The triggering of the revocation of the credential may comprise transmitting, to the credential management system220, a request to revoke the credential. Other ways of triggering the revocation of the credential may be used as well. Additionally, subsequent to the triggering of the revocation of the credential, the credential manager206may cause a notification to be displayed on the computing device205of the user associated with the credential. For example, the notification may be transmitted to an e-mail account associated with the user. Other ways of causing the notification to be displayed on the computing device205of the user are also within the scope of the present disclosure.

FIG.3illustrates an example notification300. The notification300may comprise an indication310that the credential has been revoked and comprise a selectable link320configured to, in response to its selection, navigate the computing device205to a page configured to enable the user to create a new credential for accessing the resource. In some example embodiments, the notification300may also comprise an indication330that a leak has been detected with respect to the credential, as well as an identification332of the credential. The notification300may further comprise an indication340of the reason for the detected leak, as well as an indication342of the content in which the leaked credential is included and an indication of the online service344on which the content has been published or shared. Other configurations of the notification300are also within the scope of the present disclosure.

FIG.4is a flowchart illustrating an example method400of revoking leaked access credentials. The method400can be performed by processing logic that can comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (e.g., instructions run on a processing device), or a combination thereof. In one example embodiment, one or more of the operations of the method400are performed by the revocation system200ofFIG.2or any combination of one or more of its components (e.g., the credential classifier202, the credential verifier204, the credential manager206).

At operation410, the revocation system200may receive an indication that a credential for accessing a resource has been leaked. In some example embodiments, the credential may have been leaked by being included in content that has been published on an online service210or has been stored in a shared folder of the online service210. However, the credential may have been leaked in other ways as well. The credential may comprise a password, a digital certificate, a security key, or an access token. Other types of credentials are also within the scope of the present disclosure. The resource may comprise a database, a software application, or an application programming interface. However, other types of resources are also within the scope of the present disclosure. In some example embodiments, the content may comprise source code and the online service210may comprise a code hosting platform. Other types of content and online services210may be used as well.

In some example embodiments, the receiving the indication that the credential for accessing the resource has been leaked may comprise detecting that the content that has been published on the online service210or has been stored in the shared folder of the online service210, scanning the content in response to the detecting that content that has been published on the online service210or has been stored in the shared folder of the online service210, and identifying the credential based on the scanning of the content. However, other ways of receiving the indication that the credential for accessing the resource has been leaked are also within the scope of the present disclosure.

Next, the revocation system200may, at operation420, determine that the credential is effective in accessing the resource. For example, the revocation system200may transmit a verification request to the credential management system220to verify whether the credential is still effective in accessing the resource. In response to receiving the verification request, the credential management system220may perform a verification process to determine whether the credential is still effective, such as by checking the status of the credential in a database that stores credentials for resources. If the credential management system220determines that the credential is no longer effective, such as based on a search for the credential in the database resulting in the credential not being found in the database or an indication of the credential being expired, revoked, or otherwise ineffective), then the credential management system220may transmit a response to the revocation system200indicating that the credential is not effective. If the credential management system220determines that the credential is still effective, such as based on the search of the credential in the database resulting in an indication that the credential is effective (e.g., the credential having a status of active or the like in the database), then the credential management system220may transmit a response to the revocation system200indicating that the credential is effective.

The revocation system200may then, in response to the determining that the credential is effective, trigger a revocation of the credential, at operation430. In some example embodiments, the revocation of the credential may cause the credential to no longer be effective in accessing the resource. The triggering of the revocation of the credential may comprise transmitting, to a credential management system220, a request to revoke the credential. Other ways of triggering the revocation of the credential may be used as well.

At operation440, subsequent to the triggering of the revocation of the credential, the revocation system200may cause a notification to be displayed on a computing device205of a user associated with the credential. The notification may indicate that the credential has been revoked and comprise a selectable link configured to, in response to its selection, navigate the computing device205to a page configured to enable the user to create a new credential for accessing the resource.

FIG.5is a flowchart illustrating an example method500of determining that a credential is effective in accessing a resource. The method500can be performed by processing logic that can comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (e.g., instructions run on a processing device), or a combination thereof. In one example embodiment, one or more of the operations of the method500are performed by the revocation system200ofFIG.2or any combination of one or more of its components (e.g., the credential classifier202, the credential verifier204, the credential manager206).

At operation510, the revocation system200may identify a credential type for the credential. Examples of credential types include, but are not limited to, an application programming interface (API) token, a database password, and an e-mail credential. Other credential types are also within the scope of the present disclosure. In some example embodiments, the revocation system200may identify the credential type for the credential by inputting the credential into a machine learning classifier that is configured to classify the credential into one of a set of credential types. In some other example embodiments, the revocation system200may identify the credential type for the credential by applying one or more rules to the credential, such as by matching the format of the credential to the format of one of a set of credential types. Other ways of identifying the credential type for the credential are also within the scope of the present disclosure.

Next, the revocation system200may, at operation520, generate the request to verify that the credential is effective using the identified credential type. In some example embodiment, the generating the request to verify that the credential is effective in accessing the resource may further comprise identifying network domain information based on the identified credential type and generating the request to verify that the credential is effective based on the identifying of the network domain information. Alternatively, the generating the request to verify that the credential is effective in accessing the resource further comprises scanning the content for network domain information included in the content, identifying the network domain information included in the content, and generating the request to verify that the credential is effective based on the identifying of the network domain information. The network domain information may be used to determine the destination of the request, such as to determine to which credential management system200or to which credential management server within the credential management system200to address the request.

The revocation system200may then transmit, to a credential management system220, a request to verify that the credential is effective in accessing the resource, at operation530. The revocation system200may transmit the request to the credential management system220via a network connection, such as via the network114inFIG.1.

At operation540, the revocation system200may receive, from the credential management system220, a verification that the credential is effective in accessing the resource. The verification may comprise a message that includes “PASS” or “1” or some other text-based indication that verifies that the credential is effective in accessing the resource. Other forms or configurations of the verification are also within the scope of the present disclosure.

Example 1 includes a computer-implemented method performed by a computer system having a memory and at least one hardware processor, the computer-implemented method comprising: receiving an indication that a credential for accessing a resource has been leaked, the credential having been leaked by being included in content that has been published on an online service or has been stored in a shared folder of the online service; determining that the credential is effective in accessing the resource; and in response to the determining that the credential is effective, triggering a revocation of the credential, the revocation of the credential causing the credential to no longer be effective in accessing the resource.

Example 2 includes the computer-implemented method of example 1, wherein the credential comprises a password, a digital certificate, a security key, or an access token.

Example 3 includes the computer-implemented method of example 1 or example 2, wherein the resource comprises a database, a software application, or an application programming interface.

Example 4 includes the computer-implemented method of any one of examples 1 to 3, wherein the content comprises source code and the online service comprises a code hosting platform.

Example 5 includes the computer-implemented method of any one of examples 1 to 4, wherein the receiving the indication that the credential for accessing the resource has been leaked comprises: detecting that the content that has been published on the online service or has been stored in the shared folder of the online service; in response to the detecting that content that has been published on the online service or has been stored in the shared folder of the online service, scanning the content; and identifying the credential based on the scanning of the content.

Example 6 includes the computer-implemented method of any one of examples 1 to 5, wherein the determining that the credential is effective in accessing the resource comprises: transmitting, to a credential management system, a request to verify that the credential is effective in accessing the resource; and receiving, from the credential management system, a verification that the credential is effective in accessing the resource.

Example 7 includes the computer-implemented method of any one of examples 1 to 6, wherein the determining that the credential is effective in accessing the resource further comprises: identifying a credential type for the credential; and generating the request to verify that the credential is effective using the identified credential type.

Example 8 includes the computer-implemented method of any one of examples 1 to 7, wherein the generating the request to verify that the credential is effective in accessing the resource further comprises: identifying network domain information based on the identified credential type; and generating the request to verify that the credential is effective based on the identifying of the network domain information.

Example 9 includes the computer-implemented method of any one of examples 1 to 8, wherein the generating the request to verify that the credential is effective in accessing the resource further comprises: scanning the content for network domain information included in the content; identifying the network domain information included in the content; and generating the request to verify that the credential is effective based on the identifying of the network domain information.

Example 10 includes the computer-implemented method of any one of examples 1 to 9, wherein the triggering of the revocation of the credential comprises transmitting, to a credential management system, a request to revoke the credential.

Example 11 includes the computer-implemented method of any one of examples 1 to 10, further comprising: subsequent to the triggering of the revocation of the credential, causing a notification to be displayed on a computing device of a user associated with the credential, wherein the notification indicates that the credential has been revoked and comprises a selectable link configured to, in response to its selection, navigate the computing device to a page configured to enable the user to create a new credential for accessing the resource.

Example 12 includes a system comprising: at least one processor; and a non-transitory computer-readable medium storing executable instructions that, when executed, cause the at least one processor to perform the method of any one of examples 1 to 11.

Example 13 includes a non-transitory machine-readable storage medium, tangibly embodying a set of instructions that, when executed by at least one processor, causes the at least one processor to perform the method of any one of examples 1 to 11.

Example 14 includes a machine-readable medium carrying a set of instructions that, when executed by at least one processor, causes the at least one processor to carry out the method of any one of examples 1 to 11.

The example computer system600includes a processor602(e.g., a central processing unit (CPU), a graphics processing unit (GPU) or both), a main memory604, and a static memory606, which communicate with each other via a bus608. The computer system600may further include a graphics or video display unit610(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system600also includes an alphanumeric input device612(e.g., a keyboard), a user interface (UI) navigation (or cursor control) device614(e.g., a mouse), a storage unit (e.g., a disk drive unit)616, an audio or signal generation device618(e.g., a speaker), and a network interface device620.

The storage unit616includes a machine-readable medium622on which is stored one or more sets of data structures and instructions624(e.g., software) embodying or utilized by any one or more of the methodologies or functions described herein. The instructions624may also reside, completely or at least partially, within the main memory604and/or within the processor602during execution thereof by the computer system600, the main memory604and the processor602also constituting machine-readable media. The instructions624may also reside, completely or at least partially, within the static memory606.

This detailed description is merely intended to teach a person of skill in the art further details for practicing certain aspects of the present teachings and is not intended to limit the scope of the claims. Therefore, combinations of features disclosed above in the detailed description may not be necessary to practice the teachings in the broadest sense, and are instead taught merely to describe particularly representative examples of the present teachings.