# US 11,451,588 B2 · Exchanging and acting on security events at an enterprise using permissioned blockchain > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,588 B2 - Document ID: US11451588B2 - Status: Granted - Kind: B2 - Application number: 16/910,113 - Filed: 2020-06-24 - Published: 2021-11-04 - Granted: 2022-09-20 - Earliest claimed: 2020-04-30 - Assignees: VMware, Inc. - Applicants: Vmware, Inc. - Inventors: Rohit Pradeep Shetty; Pon Venkatesh M; Sheetal Deenadayalan; Pushkal Maheshwari; Erich Peter Stuntebeck - Web page: https://patentgrep.com/patent/US11451588B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various examples are disclosed for exchanging and acting on detected security events using permissioned blockchain. A unique identifier for a client device is obtained in response to a detected security event being identified. Security event data associated with the detected security event is sent to a plurality of nodes of a blockchain service, where the nodes are associated with a respective one of a plurality of computer security services and are configured to validate the security event data and endorse the security event data in response to predetermined criteria being satisfied. In response to the security event data being validated by the nodes, the security event data is published into the blockchain service as a block that is broadcasted to the nodes, where individual ones of the nodes are configured to store the security event data of the block in a local ledger. ## Claims ### Claim 1 A method for exchanging and acting on detected security events using permissioned blockchain, comprising: obtaining a unique identifier for a client device in response to a detected security event being identified on the client device, the unique identifier being obtained from a device identity service; sending security event data associated with the detected security event to a plurality of nodes of a blockchain service, the nodes being associated with a respective one of a plurality of computer security services and being configured to validate and endorse the security event data in response to predetermined criteria being satisfied; in response to the security event data being validated and endorsed by the nodes, publishing the security event data into the blockchain service as a block that is broadcasted to the nodes; storing, by individual ones of the nodes, the security event data of the block in a local ledger; performing, by at least one of the nodes, a remedial action in response to the security event data being published on the blockchain service, wherein data associated with the remedial action is stored on the blockchain service in association with the client device; and assigning a level of access to data stored in the blockchain service to the individual ones of the computer security services based on a metric value determined for the corresponding one of the computing security services. ### Claim 2 (depends on 1) The method of claim 1, wherein the detected security event comprises at least one of: malware detected on the client device; a virus detected on the client device; and a state of the client device not being in conformance with at least one enterprise-related compliance rule. ### Claim 3 (depends on 1) The method of claim 1, wherein sending the security event data associated with the detected security event to the nodes of the blockchain service comprises identifying the nodes of the blockchain service from a plurality of potential nodes of the blockchain service based at least in part on the nodes of the blockchain service subscribing to a common one of a plurality of blockchain communication channels. ### Claim 4 (depends on 1) The method of claim 1, wherein validating the security event data and endorsing the security event data in response to the predetermined criteria being satisfied comprises: identifying the predetermined criteria from a smart contract protocol; determining that the security event data satisfies the predetermined criteria on respective ones of the nodes; and validating, by the individual ones of the nodes, the security event data using code specified in the smart contract protocol. ### Claim 5 (depends on 4) The method of claim 4, wherein determining that the security event data satisfies the predetermined criteria on the respective ones of the nodes further comprises determining that a threshold portion of the nodes of the blockchain service has validated and endorsed the security event data. ### Claim 6 (depends on 4) The method of claim 4, wherein determining that the security event data satisfies the predetermined criteria on the respective ones of the nodes comprises: identifying that the security event data is in compliance with a predefined data format; determining that the security event data does not comprise personally identifying information (PII), and identifying that the unique identifier for the client device complies with a predefined identifier format. ### Claim 7 (depends on 1) The method of claim 1, further comprising: determining the metric value for individual ones of the computer security services, the metric value being determined based at least in part on a will-act or has-acted event generated by a corresponding one of the computer security services, the will-act or has-acted event being recorded in association with the detected security event by the corresponding one of the computer security services. ### Claim 8 A system for exchanging and acting on detected security events using permissioned blockchain, comprising: at least one server computing device; and program instructions stored in memory and executable in the at least one server computing device that, when executed by the at least one server computing device, direct the at least one server computing device to: obtain a unique identifier for a client device in response to a detected security event being identified on the client device, the unique identifier being obtained from a device identity service; send security event data associated with the detected security event to a plurality of nodes of a blockchain service, the nodes being associated with a respective one of a plurality of computer security services and being configured to validate the security event data and endorse the security event data in response to predetermined criteria being satisfied; in response to the security event data being validated by the nodes, publish the security event data into the blockchain service as a block that is broadcasted to the nodes, wherein individual ones of the nodes are configured to store the security event data of the block in a local ledger; and assign a level of access to data stored in the blockchain service to the individual ones of the computer security services based on a metric value determined for the corresponding one of the computing security services. ### Claim 9 (depends on 8) The system of claim 8, wherein the detected security event comprises at least one of: malware detected on the client device; a virus detected on the client device; and a state of the client device not being in conformance with at least one enterprise-related compliance rule. ### Claim 10 (depends on 8) The system of claim 8, wherein sending the security event data associated with the detected security event to the nodes of the blockchain service comprises identifying the nodes of the blockchain service from a plurality of potential nodes of the blockchain service based at least in part on the nodes of the blockchain service subscribing to a common one of a plurality of blockchain communication channels. ### Claim 11 (depends on 8) The system of claim 8, wherein the nodes of the blockchain service are configured to validate the security event data and endorse the security event data in response to predetermined criteria being satisfied by: identifying the predetermined criteria from a smart contract protocol; determining that the security event data satisfies the predetermined criteria on respective ones of the nodes; and wherein the nodes of the blockchain service are configured to validate the security event data using code specified in the smart contract protocol. ### Claim 12 (depends on 11) The system of claim 11, wherein determining that the security event data satisfies the predetermined criteria on the respective ones of the nodes further comprises determining that a threshold portion of the nodes of the blockchain service has validated and endorsed the security event data. ### Claim 13 (depends on 11) The system of claim 11, wherein determining that the security event data satisfies the predetermined criteria on the respective ones of the nodes comprises: identifying that the security event data is in compliance with a predefined data format; determining that the security event data does not comprise personally identifying information (PII), and identifying that the unique identifier for the client device complies with a predefined identifier format. ### Claim 14 (depends on 8) The system of claim 8, wherein the at least one computing device is further directed to: determine a metric value for individual ones of the computer security services, the metric value being determined based at least in part on a will-act or has-acted event generated by a corresponding one of the computer security services, the will-act or has-acted event being recorded in association with the detected security event by the corresponding one of the computer security services; and assign a level of access to data stored in the blockchain service to the individual ones of the computer security services based on the metric value determined for the corresponding one of the computing security services. ### Claim 15 A non-transitory computer-readable medium for exchanging and acting on detected security events using permissioned blockchain comprising program instructions that, when executed by at least one computing device, direct the at least one computing device to: obtain a unique identifier for a client device in response to a detected security event being identified on the client device, the unique identifier being obtained from a device identity service; send security event data associated with the detected security event to a plurality of nodes of a blockchain service, the nodes being associated with a respective one of a plurality of computer security services and being configured to validate the security event data and endorse the security event data in response to predetermined criteria being satisfied; in response to the security event data being validated by the nodes, publish the security event data into the blockchain service as a block that is broadcasted to the nodes, wherein individual ones of the nodes are configured to store the security event data of the block in a local ledger; and assign a level of access to data stored in the blockchain service to the individual ones of the computer security services based on a metric value determined for the corresponding one of the computing security services. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the detected security event comprises at least one of: malware detected on the client device; a virus detected on the client device; and a state of the client device not being in conformance with at least one enterprise-related compliance rule. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein sending the security event data associated with the detected security event to the nodes of the blockchain service comprises identifying the nodes of the blockchain service from a plurality of potential nodes of the blockchain service based at least in part on the nodes of the blockchain service subscribing to a common one of a plurality of blockchain communication channels. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the nodes of the blockchain service are configured to validate the security event data and endorse the security event data in response to predetermined criteria being satisfied by: identifying the predetermined criteria from a smart contract protocol; determining that the security event data satisfies the predetermined criteria on respective ones of the nodes of the blockchain service; and wherein the nodes of the blockchain service are configured to validate the security event data using code specified in the smart contract protocol. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein determining that the security event data satisfies the predetermined criteria on the respective ones of the nodes comprises: identifying that the security event data is in compliance with a predefined data format; determining that the security event data does not comprise personally identifying information (PII), identifying that the unique identifier for the client device complies with a predefined identifier format; and determining that a threshold portion of the nodes of the blockchain service has validated and endorsed the security event data. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the at least one computing device is further directed to: determine the metric value for individual ones of the computer security services, the metric value being determined based at least in part on a will-act or has-acted event generated by a corresponding one of the computer security services, the will-act or has-acted event being recorded in association with the detected security event by the corresponding one of the computer security services.