IDENTITY BASED BEHAVIOR MEASUREMENT ARCHITECTURE

• US 20190312902A1
• Filed: 06/07/2019
• Published: 10/10/2019
• Est. Priority Date: 04/07/2016
• Status: Active Grant

• Current Assignee: IDfusion, LLC
• Original Assignee: IDfusion, LLC
• Inventors: Wettstein, Gregory Henry, Stofferahn, Scott Byron, Engen, Richard William, Grosen, Johannes Christian
• Granted Patent: US 10,958,678 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: H04L 2209/127 Trusted platform modules [TPM]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/108 Source integrity

Abstract

A method includes generating a behavioral state for an endpoint device based on actor identities and corresponding subject identities for a plurality of operations wherein for each operation, a respective actor represented by a respective actor identity performs the operation upon a respective subject represented by a respective subject identity. Performance of a later operation by an actor with an actor identity upon a subject with a subject identity is recorded and the actor identity and the subject identity are used to determine that the performance of the later operation does not match the behavioral state and indicates a security risk.

Claims

1. A method comprising:

generating a behavioral state for an endpoint device based on actor identities and corresponding subject identities for a plurality of operations wherein for each operation, a respective actor represented by a respective actor identity performs the operation upon a respective subject represented by a respective subject identity;

recording performance of a later operation by an actor having an actor identity upon a subject having a subject identity; and

using the actor identity and the subject identity to determine that the performance of the later operation does not match the behavioral state and indicates a security risk.

2. The method of claim 1 wherein generating the behavioral state comprises for each of the plurality of requested operations projecting a contour point based on the actor identity and the subject identity into a unique identity of the endpoint device and combining the projected contour points to form the behavioral state.

3. The method of claim 2 wherein the projected contour points are combined in a time-invariant manner.

4. The method of claim 2 wherein the actor identity is given by the following equation A_M=H_M (FA₁ . . . FA_N), where A_M is the actor identity, FA is an actor identity dimension, and H_M is a hash function with a digest size M.

5. The method of claim 4 wherein the subject identity is given by the following equation S_M=H_M (FS₁ . . . FS_N), where S_M is the subject identity, and FS is subject identity dimensions.

6. The method of claim 5 wherein each contour point for a given actor identity operating on a subject identity is given by the following equation C_M=H_M (A_M∥

S_M), where C_M is a contour point.

7. The method of claim 6, wherein each contour point C_M is projected into the unique identity for the endpoint device through the following equation P_M=H_M (D_M∥

C_M), where D_M is the unique identity for the endpoint device, C_M is the contour point, and ∥

is a concatenation.

8. The method of claim 7, further comprising generating the unique identity for the endpoint device according to the following equation:

D_M=H_M(R_M∥

H_M(C)), where D_M is the unique identity, R_M is a range value of size M, C is the credential, ∥

is a concatenation, and H_M is the hash function with digest size M.

9. The method of claim 7, wherein the endpoint device belongs to an organization provisioning devices, and the method further comprises generating the unique identity for the endpoint device according to the following equation:

D_M=H_M(O_M∥

H_M(D_C)), where D_M is the unique identity, O_M is an identity of an associated organization, D_C is a credential of the endpoint device, ∥

is a concatenation, and H_M is the hash function with digest size M.

10. An endpoint device, comprising:

memory; and

a processor executing instructions to perform steps comprising;

generating a behavior value based the identities of actors and subjects that were involved in operations performed at least in part on the endpoint device;

receiving an identity of an actor and an identity of a subject involved in a later operation; and

using the identity of the actor and the identity of the subject and the behavior value to determine that the later operation is suspect.

11. The endpoint device of claim 10 wherein generating the behavior value comprises for each of the plurality of requested operations projecting a contour point based on the identity of the actor performing the operation and the identity of the subject upon which the operation is being performed into a unique identity of the endpoint device and combining the projected contour points for the plurality of requested operations to form the behavior value.

12. The endpoint device of claim 11 wherein the projected contour points are combined in a time-invariant manner.

13. The endpoint device of claim 11 wherein the identity of each actor is given by the following equation A_M=H_M (FA₁ . . . FA_N), where A_M is the identity of the actor, each FA is an actor identity dimension, and H_M is a hash function with a digest size M.

14. The endpoint device of claim 13 wherein the identity of each subject is given by the following equation S_M=H_M (FS₁ . . . FS_N), where S_M is the identity of the subject, and each FS is a subject identity dimension.

15. The endpoint device of claim 14 wherein each contour point is given by the following equation C_M=H_M (A_M∥

S_M), where C_M is the contour point.

16. The endpoint device of claim 15, wherein each contour point C_M is projected into the unique identity for the endpoint device through the following equation P_M=H_M (D_M∥

C_M), where D_M is the unique identity for the endpoint device, C_M is the contour point, and ∥

is a concatenation.

17. The endpoint device of claim 16, further comprising generating the unique identity for the endpoint device according to the following equation:

D_M=H_M(R_M∥

H_M(C)), where D_M is the unique identity, R_M is a range value of size M, C is the credential, ∥

is a concatenation, and H_M is the hash function with digest size M.

18. The endpoint device of claim 16, wherein the endpoint device belongs to an organization provisioning devices, and the method further comprises generating the unique identity for the endpoint device according to the following equation:

D_M=H_M(O_M∥

H_M(D_C)), where D_M is the unique identity, O_M is an identity of an associated organization, D_C is a credential of the endpoint device, ∥

is a concatenation, and H_M is the hash function with digest size M.

19. An endpoint device comprising:

a memory; and

a processor executing a security supervisor that provides a single value indicative of a plurality of past actor-subject operations and that detects a security violation in the endpoint device on a further actor-subject operation and the single value.

20. The endpoint device of claim 19 wherein the single value comprises a sum of contour points projected into an identity for the endpoint device.