Systems and methods for distributed extended common vulnerabilities and exposures data management
AssigneeSecureworks Corp.
InventorsMehdi Tassoumt, Wayne Haber
Life of this patent
Estimating the term…
Abstract
In one aspect, the present disclosure is directed to systems and methods for validating and securely storing security entry updates. The security entry update is received from a contributor, and broadcast to a plurality of computing nodes. It then is determined whether to validate the received security update at each computing node of the plurality of computing nodes. If the received security entry update is validated, information relating to the received security update is added as transaction information in a current block, the current block is included in a blockchain that is stored in a datastore of each computing node of the plurality of computing nodes. Other aspects also are described.
Claims17
A method for validating and securely storing security updates amongst a threat intelligence community, comprising:
- receiving a security update submitted from one or more contributors to members of the threat intelligence community;
- broadcasting the received security update to a plurality of computing nodes in communication with one or more networks, each of the computing nodes managed by one or more of the members of the threat intelligence community and including a memory configured to store a blockchain;
- determining whether to validate the received security update at each computing node of the plurality of computing nodes, including:
- determining whether the received security update includes one or more required fields;
- and
- initiating voting among members of the threat intelligence community and receiving votes for validation or denial of the received security update from at least some of the members of the threat intelligence community;
- and
- if the received security update is validated by a selected number of votes or weighted votes from the members of the threat intelligence community:
- adding information relating to the received security update as transaction information in a current block;
- and
- including the current block in the blockchain stored in the memory of each computing node of the plurality of computing nodes;
- and
- if the received security update did not receive the selected number of votes or weighted votes, deny validation of the received security update.
A system for validating and securely storing security updates amongst a threat intelligence community, comprising:
- a distributed network including a plurality of computing nodes, each of the computing nodes managed by one or more members of the threat intelligence community;
- one or more processors at a series of computing nodes of a distributed network, wherein each of the computing nodes includes a memory having a datastore configured to store and manage a blockchain comprising a plurality of security updates;
- and
- a non-transitory memory storing computer readable instructions that are accessed and executed by the one or more processors of the computing nodes to cause the computing nodes to:
- receive a security update broadcast to the distributed network of computing nodes from at least one contributor;
- determine whether to validate the received security update based on a set of rules, the set of rules including, at least, a determination that the received security update includes selected fields, and on votes or weighted votes received from members of the threat intelligence community to validate or deny the received security update;
- and
- if the received security update is validated:
- add information relating to the received security update as transaction information in a current block;
- and
- include the current block in the blockchain in the datastore of each computing node of the plurality of computing nodes.
Dependencies are inferred from the claim text.