# US 11,122,087 B2 · Managing cybersecurity vulnerabilities using blockchain networks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,087 B2
- Document ID: US11122087B2
- Status: Granted
- Kind: B2
- Application number: 16/712,340
- Filed: 2019-12-12
- Published: 2020-12-31
- Granted: 2021-09-14
- Earliest claimed: 2019-06-27
- Assignees: Advanced New Technologies Co., Ltd.
- Applicants: Advanced New Technologies Co., Ltd.
- Inventors: Jun Gu; Yixiang Zhang
- Web page: https://patentgrep.com/patent/US11122087B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3247: {involving digital signatures}
- H04L 63/1433: {Vulnerability analysis}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for cybersecurity vulnerability management. One of the methods includes receiving a vulnerability report indicating a cybersecurity vulnerability by a blockchain network. The blockchain network provides access to the vulnerability report to an administration server. A vulnerability verification report indicating a verification of the cybersecurity vulnerability from the administration server is received by the blockchain network. The blockchain network stores information of the cybersecurity vulnerability into a vulnerability record that is stored on the blockchain network. The blockchain network provides access to the vulnerability record to a service provider, and receives a notification indicating a resolution to the cybersecurity vulnerability from the service provider.

## Claims

### Claim 1

A computer-implemented method for cybersecurity vulnerability management, the method comprising:
maintaining, by a blockchain network, a blockchain that comprises one or more blocks storing a vulnerability record, wherein the vulnerability record comprises information of one or more cybersecurity vulnerabilities of computer-implemented services;
maintaining, by the blockchain network, a smart contract for a cybersecurity vulnerability management scheme, wherein the smart contract comprises defined parties of the cybersecurity vulnerability management scheme and defined functions operable by the defined parties of the cybersecurity vulnerability management scheme, wherein the defined parties comprise an administration server and one or more service providers;
receiving, by the blockchain network and from a client device, via a smart contract call of a function defined in the smart contract for submitting a vulnerability report, the vulnerability report indicating a cybersecurity vulnerability of a computer-implemented service provided by a service provider;
providing, by the blockchain network, access to the vulnerability report to the administration server for verifying the cybersecurity vulnerability in the vulnerability report;
receiving, by the blockchain network and from the administration server, a vulnerability verification report indicating a verification of the cybersecurity vulnerability in the vulnerability report submitted by the client device, wherein the vulnerability verification report comprise an identifier of the administration server;
storing, by the blockchain network, information of the cybersecurity vulnerability into the vulnerability record that is stored on the blockchain network, wherein the information of the cybersecurity vulnerability is based on the vulnerability report and the vulnerability verification report;
after storing the information of the cybersecurity vulnerability into the vulnerability record, providing, by the blockchain network, access to the vulnerability record to the service provider; and
after providing the access to the vulnerability record to the service provider, receiving, by the blockchain network and from the service provider, a notification indicating a resolution to the cybersecurity vulnerability, wherein the notification comprises a service name of the computer-implemented service provided by the service provider, an identifier of the service provider, a description of the cybersecurity vulnerability, and a description of the resolution to the cybersecurity vulnerability.

### Claim 2 (depends on 1)

The method of claim 1, wherein the cybersecurity vulnerability comprises at least one of a software vulnerability or a hardware vulnerability.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
receiving, by the blockchain network and from the administration server, a request to access the vulnerability report;
determining, by the blockchain network, whether the administration server is authorized to access the vulnerability report; and
in response to determining that the administration server is authorized to access the vulnerability report, sending the vulnerability report to the administration server.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
receiving, by the blockchain network and from the service provider, a request to access the vulnerability verification report;
determining, by the blockchain network, whether the service provider is authorized to access the vulnerability verification report; and
in response to determining that the service provider is authorized to access the vulnerability verification report, sending the vulnerability verification report to the service provider.

### Claim 5 (depends on 1)

The method of claim 1, wherein the method further comprises:
receiving, by the blockchain network and from the service provider, a request to reward a blockchain account of the client device; and
in response to receiving the request from the service provider, providing, by the blockchain network, a reward to the blockchain account of the client device.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
in response to receiving the notification from the service provider, storing, by the blockchain network, the resolution to the cybersecurity vulnerability into the vulnerability record; and
providing, by the blockchain network, access to the vulnerability record to a service user of the computer-implemented service.

### Claim 7 (depends on 1)

The method of claim 1, wherein the resolution to the cybersecurity vulnerability comprises at least one of the following: a software patch, or a hardware replacement.

### Claim 8 (depends on 1)

The method of claim 1, wherein the smart contract comprises authorized entities, among the defined parties of the cybersecurity vulnerability management scheme, that are authorized to perform one or more of the defined functions.

### Claim 9 (depends on 1)

The method of claim 1, wherein the defined parties comprise one or more of a security specialist who identifies the cybersecurity vulnerability of the computer-implemented service or a service user of the computer-implemented service provided by the service provider, and wherein the smart contract call of the function defined in the smart contract for submitting the vulnerability report is from one of the one or more of the security specialist.

### Claim 10

A non-transitory, computer-readable storage medium storing one or more instructions executable by a computer system to perform operations for cybersecurity vulnerability management, the operations comprising:
maintaining, by a blockchain network, a blockchain that comprises one or more blocks storing a vulnerability record, wherein the vulnerability record comprises information of one or more cybersecurity vulnerabilities of computer-implemented services;
maintaining, by the blockchain network, a smart contract for a cybersecurity vulnerability management scheme, wherein the smart contract comprises defined parties of the cybersecurity vulnerability management scheme and defined functions operable by the defined parties of the cybersecurity vulnerability management scheme, wherein the defined parties comprise an administration server and one or more service providers;
receiving, by the blockchain network and from a client device, via a smart contract call of a function defined in the smart contract for submitting a vulnerability report, the vulnerability report indicating a cybersecurity vulnerability of a computer-implemented service provided by a service provider;
providing, by the blockchain network, access to the vulnerability report to the administration server for verifying the cybersecurity vulnerability in the vulnerability report;
receiving, by the blockchain network and from the administration server, a vulnerability verification report indicating a verification of the cybersecurity vulnerability in the vulnerability report submitted by the client device, wherein the vulnerability verification report comprise an identifier of the administration server;
storing, by the blockchain network, information of the cybersecurity vulnerability into the vulnerability record that is stored on the blockchain network, wherein the information of the cybersecurity vulnerability is based on the vulnerability report and the vulnerability verification report;
after storing the information of the cybersecurity vulnerability into the vulnerability record, providing, by the blockchain network, access to the vulnerability record to the service provider; and
after providing the access to the vulnerability record to the service provider, receiving, by the blockchain network and from the service provider, a notification indicating a resolution to the cybersecurity vulnerability, wherein the notification comprises a service name of the computer-implemented service provided by the service provider, an identifier of the service provider, a description of the cybersecurity vulnerability, and a description of the resolution to the cybersecurity vulnerability.

### Claim 11 (depends on 10)

The non-transitory, computer-readable storage medium of claim 10, wherein the cybersecurity vulnerability comprises at least one of a software vulnerability or a hardware vulnerability.

### Claim 12 (depends on 10)

The non-transitory, computer-readable storage medium of claim 10, the operations further comprising:
receiving, by the blockchain network and from the administration server, a request to access the vulnerability report;
determining, by the blockchain network, whether the administration server is authorized to access the vulnerability report; and
in response to determining that the administration server is authorized to access the vulnerability report, sending the vulnerability report to the administration server.

### Claim 13 (depends on 10)

The non-transitory, computer-readable storage medium of claim 10, the operations further comprising:
receiving, by the blockchain network and from the service provider, a request to access the vulnerability verification report;
determining, by the blockchain network, whether the service provider is authorized to access the vulnerability verification report; and
in response to determining that the service provider is authorized to access the vulnerability verification report, sending the vulnerability verification report to the service provider.

### Claim 14 (depends on 10)

The non-transitory, computer-readable storage medium of claim 10, wherein the operations further comprise:
receiving, by the blockchain network and from the service provider, a request to reward a blockchain account of the client device; and
in response to receiving the request from the service provider, providing, by the blockchain network, a reward to the blockchain account of the client device.

### Claim 15 (depends on 10)

The non-transitory, computer-readable storage medium of claim 10, the operations further comprising:
in response to receiving the notification from the service provider, storing, by the blockchain network, the resolution to the cybersecurity vulnerability into the vulnerability record; and
providing, by the blockchain network, access to the vulnerability record to a service user of the computer-implemented service.

### Claim 16 (depends on 10)

The non-transitory, computer-readable storage medium of claim 10, wherein the resolution to the cybersecurity vulnerability comprises at least one of the following: a software patch, or a hardware replacement.

### Claim 17

A system for cybersecurity vulnerability management, comprising:
one or more processors; and
one or more computer-readable memories coupled to the one or more processors and having instructions stored thereon that are executable by the one or more processors to perform operations comprising:
maintaining, by a blockchain network, a blockchain that comprises one or more blocks storing a vulnerability record, wherein the vulnerability record comprises information of one or more cybersecurity vulnerabilities of computer-implemented services;
maintaining, by the blockchain network, a smart contract for a cybersecurity vulnerability management scheme, wherein the smart contract comprises defined parties of the cybersecurity vulnerability management scheme and defined functions operable by the defined parties of the cybersecurity vulnerability management scheme, wherein the defined parties comprise an administration server and one or more service providers;
receiving, by the blockchain network and from a client device, via a smart contract call of a function defined in the smart contract for submitting a vulnerability report, the vulnerability report indicating a cybersecurity vulnerability of a computer-implemented service provided by a service provider;
providing, by the blockchain network, access to the vulnerability report to the administration server for verifying the cybersecurity vulnerability in the vulnerability report;
receiving, by the blockchain network and from the administration server, a vulnerability verification report indicating a verification of the cybersecurity vulnerability in the vulnerability report submitted by the client device, wherein the vulnerability verification report comprise an identifier of the administration server;
storing, by the blockchain network, information of the cybersecurity vulnerability into the vulnerability record that is stored on the blockchain network, wherein the information of the cybersecurity vulnerability is based on the vulnerability report and the vulnerability verification report;
after storing the information of the cybersecurity vulnerability into the vulnerability record, providing, by the blockchain network, access to the vulnerability record to the service provider; and
after providing the access to the vulnerability record to the service provider, receiving, by the blockchain network and from the service provider, a notification indicating a resolution to the cybersecurity vulnerability, wherein the notification comprises a service name of the computer-implemented service provided by the service provider, an identifier of the service provider, a description of the cybersecurity vulnerability, and a description of the resolution to the cybersecurity vulnerability.

### Claim 18 (depends on 17)

The system of claim 17, wherein the cybersecurity vulnerability comprises at least one of a software vulnerability or a hardware vulnerability.

### Claim 19 (depends on 17)

The system of claim 17, the operations further comprising:
receiving, by the blockchain network and from the administration server, a request to access the vulnerability report;
determining, by the blockchain network, whether the administration server is authorized to access the vulnerability report; and
in response to determining that the administration server is authorized to access the vulnerability report, sending the vulnerability report to the administration server.

### Claim 20 (depends on 17)

The system of claim 17, the operations further comprising:
receiving, by the blockchain network and from the service provider, a request to access the vulnerability verification report;
determining, by the blockchain network, whether the service provider is authorized to access the vulnerability verification report; and
in response to determining that the service provider is authorized to access the vulnerability verification report, sending the vulnerability verification report to the service provider.

### Claim 21 (depends on 17)

The system of claim 17, wherein the operations further comprises:
receiving, by the blockchain network and from the service provider, a request to reward a blockchain account of the client device; and
in response to receiving the request from the service provider, providing, by the blockchain network, a reward to the blockchain account of the client device.

### Claim 22 (depends on 17)

The system of claim 17, the operations further comprising:
in response to receiving the notification from the service provider, storing, by the blockchain network, the resolution to the cybersecurity vulnerability into the vulnerability record; and
providing, by the blockchain network, access to the vulnerability record to a service user of the computer-implemented service.

### Claim 23 (depends on 17)

The system of claim 17, wherein the resolution to the cybersecurity vulnerability comprises at least one of the following: a software patch, or a hardware replacement.