System security agent authentication and alert distribution

• US 7,937,760 B2
• Filed: 11/11/2009
• Issued: 05/03/2011
• Est. Priority Date: 12/30/2004
• Status: Expired due to Fees

• Current Assignee: Daedalus Prime LLC (Daedalus Group LLC)
• Original Assignee: Intel Corporation
• Inventors: Morgan, Dennis M., Ross, Alan D.
• Primary Examiner(s): Dada; Beemnet W
• Application Number:
  US12/616,709
• Publication Number:
  US 20100057907A1
• Time in Patent Office: 538 Days
• Field of Search: 726 22- 25, 713/151, 713/168, 713/171, 713/188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/87 by means of encapsulation, e.g. for integrated circuits
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An aggregation agent may combine and correlate information generated by multiple on-host agents and/or information generated in response to multiple security events. The aggregation agent may transmit the combined information to a security console. The security console may check the identity of the aggregation agent to determine whether to accept the information. The security console may map information to one or more consoles.

Claims

1. An apparatus comprising:

a receiver to receive from a transport agent on a communication link an aggregated security message, wherein the transport agent receives items of data from different respective on-host system agents of a host system, the on-host system agents monitoring the host system, each item of data representing a security event on the host system, wherein the transport agent aggregates the received items of data into the aggregated security message;

a communication line controller to configure the communication link to receive the aggregated security message; and

a management engine including circuitry to authenticate the transport agent based on the received aggregated security message, and in response to authenticating the transport agent, to determine for each of the items of data of the aggregated security message a respective security server with which the item of data is associated, and to transmit each of the items of data from the aggregated security message to a respective management console.

2. The apparatus of claim 1, wherein the management engine to determine the associated security server of each of the items of data includes the management engine to determine a security server associated with an on-host system agent that generated one of the items of data.

3. The apparatus of claim 1, wherein the management engine to determine the associated security server of each of the items of data includes the management engine to decompress the aggregated security message to extract the aggregated security message from a compressed state.

4. The apparatus of claim 1, wherein the management engine to determine the associated security server of each of the items of data includes the management engine to determine in response to authenticating the transport agent.

5. The apparatus of claim 1, wherein the management engine to transmit each item of data includes the management engine to transmit one of the items of data to the associated security server of the one of the items of data.

6. The apparatus of claim 1, wherein the management engine to authenticate the transport agent includes the management engine to verify cryptographic keys received from the transport agent.

7. The apparatus of claim 1, the management engine further to decrypt the aggregated security message.

8. An apparatus according to claim 1, the communication line controller to configure the communication link dynamically, after the link has been established with the transport agent.

9. An apparatus according to claim 1, wherein the communication line controller to configure the communication link includes the communication line controller to configure one or more of a port, a communication protocol, a communication channel, an encryption standard, and a compression standard.

10. An apparatus according to claim 1, the communication line controller to further indicate a management console with which the transport agent should direct subsequent communication.

11. A system comprising:

a plurality of agents to monitor the system, each of the plurality of agents to generate a different respective one of host-based security event notifications, each host-based security event notification representing a respective security event on the host system;

an aggregation agent including circuitry to receive the host-based security event notifications, to aggregate the received host-based security event notifications into a single security report and transmit the single security report to a security server;

a router coupled with the aggregation agent to route the single security report from the aggregation agent to the security server; and

the security server coupled with the router to receive the single security report and to indicate a host-based security event notification to a security console.

12. The system of claim 11, the security server further to authenticate the aggregation agent based on the received security report.

13. The system of claim 11, the security server to determine for each of the multiple security event notifications of the security report a respective security console with which the security event notification is associated.

14. The system of claim 13, wherein the security server to determine the associated security console of each of the multiple security event notifications includes the security server to determine a type of information indicated by one of the multiple security event notifications, and the security server to associate all security consoles configured to receive the type of information.

15. The system of claim 13, wherein the security server to determine the associated security console of each of the multiple security event notifications includes the security server to determine in response to authenticating the aggregation agent.

16. A system according to claim 13, wherein the security server to indicate the security event notification to the security console comprises the security server to indicate the security event notification to a security console associated with a host-based security event monitoring entity that generated the security event notification.

17. A system according to claim 11, wherein the aggregation agent resides on the host.

18. A system according to claim 11, wherein the aggregation agent to transmit the single security report to the security server comprises the aggregation agent to transmit the single security report to a control console on the security server.