# US 11,310,192 B1 · Systems and methods for second protocol communication over LDAP

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,192 B1
- Document ID: US11310192B1
- Status: Granted
- Kind: B1
- Application number: 16/722,388
- Filed: 2019-12-20
- Granted: 2022-04-19
- Earliest claimed: 2019-12-20
- Assignees: Stealthbits Technologies LLC
- Applicants: Stealthbits Technologies LLC
- Inventors: Anthony Nicholas Sarra; Alexander Ivash; Alexei Belous; Pavel Shmakov
- Web page: https://patentgrep.com/patent/US11310192B1

## CPC

- H04L 61/4523: using lightweight directory access protocol [LDAP]
- G06F 16/282: {Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes}
- G06F 16/289: {Object oriented databases}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 61/4552: Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A monitoring device is described. The monitoring device includes a processor. The monitoring device also includes memory in electronic communication with the processor. The monitoring device further includes instructions stored in the memory. The instructions are executable to intercept a lightweight directory access protocol (LDAP) search request sent to an LDAP search handler of a security subsystem from a calling device. The LDAP search request includes a query string containing data for a second protocol. The instructions are also executable to generate response data for the second protocol to substitute for a response by the LDAP search handler. The instructions are further executable to send an LDAP search result to the calling device, the LDAP search result comprising the response data for the second protocol.

## Claims

### Claim 1

A monitoring device, comprising:
a processor;
a memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable to:
intercept a lightweight directory access protocol (LDAP) search request sent to an LDAP search handler of a security subsystem from a calling device, the LDAP search request comprising a query string containing data for a second protocol, wherein the LDAP search handler performs LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to the LDAP search handler;
generate response data for the second protocol to substitute for a response by the LDAP search handler; and
send an LDAP search result to the calling device, the LDAP search result comprising the response data for the second protocol.

### Claim 2 (depends on 1)

The monitoring device of claim 1, wherein the query string causes the LDAP search handler to generate an empty dataset or error response.

### Claim 3 (depends on 1)

The monitoring device of claim 1, wherein the query string is formatted with a valid LDAP search request format.

### Claim 4 (depends on 1)

The monitoring device of claim 1, wherein the query string comprises a command for the monitoring device to perform an operation and a number of key value pairs to be used in the operation.

### Claim 5 (depends on 1)

The monitoring device of claim 1, wherein the query string comprises a filter to indicate that the LDAP search request is a modified LDAP search request.

### Claim 6 (depends on 1)

The monitoring device of claim 1, wherein the LDAP search result comprises a number of attributes that include the response data.

### Claim 7 (depends on 1)

The monitoring device of claim 1, the instructions being further executable to:
send the LDAP search request to the LDAP search handler to generate a first LDAP search result with an empty dataset or error response; and
substitute the empty dataset or error response of the first LDAP search result with the response data for the second protocol.

### Claim 8 (depends on 1)

The monitoring device of claim 1, wherein the monitoring device comprises a domain controller configured with the LDAP search handler, a search interceptor to intercept the LDAP search request, and second protocol response generator to generate the response data.

### Claim 9 (depends on 1)

The monitoring device of claim 1, wherein the LDAP search request is sent for password validation.

### Claim 10 (depends on 1)

The monitoring device of claim 1, wherein the LDAP search request is sent for reporting workstation logins.

### Claim 11

A method by a monitoring device, comprising:
intercepting a lightweight directory access protocol (LDAP) search request sent to LDAP search handler of a security subsystem, the LDAP search request comprising a query string containing data for a second protocol, wherein the LDAP search handler performs LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to the LDAP search handler;
generating response data for the second protocol to substitute for a response by the LDAP search handler; and
sending an LDAP search result to the calling device, the LDAP search result comprising the response data for the second protocol.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
sending the LDAP search request to the LDAP search handler to generate a first LDAP search result with an empty dataset or error response; and
substituting the empty dataset or error response of the first LDAP search result with the response data for the second protocol.

### Claim 13

A calling device, comprising:
a processor;
a memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable to:
detect an event;
generate a lightweight directory access protocol (LDAP) search request with a query string containing data for a second protocol, wherein the LDAP search request is for LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to an LDAP search handler;
send the LDAP search request to a monitoring device; and
receive an LDAP search result containing response data for the second protocol that substitutes for a response by the LDAP search handler.

### Claim 14 (depends on 13)

The calling device of claim 13, wherein the query string is formatted with a valid LDAP search request format but causes the LDAP search handler to generate an empty dataset or error response.

### Claim 15 (depends on 13)

The calling device of claim 13, wherein the query string comprises a command for the monitoring device to perform an operation and a number of key value pairs to be used in the operation.

### Claim 16 (depends on 13)

The calling device of claim 13, wherein the query string comprises a filter to indicate that the LDAP search request is a modified LDAP search request.

### Claim 17 (depends on 13)

The calling device of claim 13, wherein the LDAP search result comprises a number of attributes that include the response data.

### Claim 18 (depends on 13)

The calling device of claim 13, the instructions being further executable to perform an operation in response to the response data.

### Claim 19

A method by a calling device, comprising:
detecting an event;
generating a lightweight directory access protocol (LDAP) search request with a query string containing data for a second protocol, wherein the LDAP search request is for LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to an LDAP search handler;
sending the LDAP search request to a monitoring device; and
receiving an LDAP search result containing response data for the second protocol that substitutes for a response by the LDAP search handler.

### Claim 20 (depends on 19)

The method of claim 19, further comprising performing an operation in response to the response data.