# US 12,001,566 B2 · Method and system for generating security findings acquisition records for systems and system components

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,001,566 B2
- Document ID: US12001566B2
- Status: Granted
- Kind: B2
- Application number: 17/490,188
- Filed: 2021-09-30
- Published: 2023-04-13
- Granted: 2024-06-04
- Earliest claimed: 2021-09-30
- Assignees: Dell Products L.P.
- Applicants: Dell Products L.P.
- Inventors: Sameer Sehgal
- Web page: https://patentgrep.com/patent/US12001566B2

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques described herein relate to a method for generating security findings acquisition (SFA) records. The method includes obtaining, by a security finding acquisition system (SFAS) orchestrator, an entity context request associated with an entity; making a first determination, by the SFAS orchestrator, that the entity is not associated with an entity directed acyclic graph (DAG); in response to the first determination: obtaining, by the SFAS orchestrator, the entity DAG associated with the entity from a lineage builder; making a second determination, by the SFAS orchestrator, that the entity is not associated with SFA anchors; in response to the second determination: obtaining, by the SFAS orchestrator, the SFA anchors associated with the entity from a resolver; obtaining, by the SFAS orchestrator, the SFA records associated with the entity from an extractor using the SFA anchors; and performing, by the SFAS orchestrator, security actions using the SFA records.

## Claims

### Claim 1

A method for generating security findings acquisition (SFA) records, the method comprising:
obtaining, by a security finding acquisition system (SFAS) orchestrator, an entity context request associated with an entity;
in response to obtaining the entity context request:
making a first determination, by the SFAS orchestrator, that the entity is not associated with an entity directed acyclic graph (DAG);
in response to the first determination:
obtaining, by the SFAS orchestrator, the entity DAG associated with the entity from a lineage builder;
making a second determination, by the SFAS orchestrator, that the entity is not associated with SFA anchors;
in response to the second determination:
obtaining, by the SFAS orchestrator, the SFA anchors associated with the entity from a resolver, wherein obtaining the SFA anchors comprises:
sending, by the SFAS orchestrator, an SFA anchor request and the entity DAG to the resolver;
in response to obtaining the SFA anchor request and the entity DAG:
obtaining, by the resolver, security modeling assessment system connection data from a registrar;
generating, by the resolver, the SFA anchors using the security modeling assessment system connection data and the entity DAG; and
providing, by the resolver, the SFA anchors to the SFAS orchestrator;
obtaining, by the SFAS orchestrator, the SFA records associated with the entity from an extractor using the SFA anchors; and
performing, by the SFAS orchestrator, security actions using the SFA records.

### Claim 2 (depends on 1)

The method of claim 1, wherein obtaining, by the SFAS orchestrator, the SFA records associated with the entity from the extractor using the SFA anchors comprises:
sending, by the SFAS orchestrator, a request for the SFA records associated with the entity and the SFA anchors to the extractor; and
in response to obtaining, by the extractor, the request for the SFA records associated with the entity and the SFA anchors:
obtaining security assessment data from security modeling assessment systems using the SFA anchors;
generating the SFA records using the security assessment data; and
providing the SFA records to the SFAS orchestrator.

### Claim 3 (depends on 1)

The method of claim 1, wherein the entity context request comprises entity context information associated with the entity, wherein the entity context information specifies the entity.

### Claim 4 (depends on 3)

The method of claim 3, wherein the entity DAG comprises:
a plurality of nodes associated with related entities associated with the entity, and
a node of the plurality of nodes associated with the entity.

### Claim 5 (depends on 4)

The method of claim 4, wherein the SFA records specify security assessment data associated with the plurality of nodes.

### Claim 6 (depends on 4)

The method of claim 4, wherein obtaining, by the SFAS orchestrator, the entity DAG associated with the entity from the lineage builder comprises:
sending, by the SFAS orchestrator, an entity DAG request and the entity context information to the lineage builder;
in response to obtaining, by the lineage builder, the entity DAG request and the entity context information:
obtaining, by the lineage builder, security modeling assessment execution environment connection data from the registrar;
obtaining, by the lineage builder, entity relationship data associated with the entity from a security modeling assessment execution environment using the security modeling assessment execution environment connection data;
generating, by the lineage builder, the entity DAG using the entity relationship data; and
providing, by the lineage builder, the entity DAG to the SFAS orchestrator.

### Claim 7 (depends on 6)

The method of claim 6, wherein the SFA anchors specify the security modeling assessment system connection data associated with the plurality of nodes.

### Claim 8 (depends on 1)

The method of claim 1, wherein the registrar maintains an address book, wherein the address book comprises the security modeling assessment system connection data and the security modeling assessment execution environment connection data.

### Claim 9

A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for generating security findings acquisition (SFA) records, the method comprising:
obtaining, by a security finding acquisition system (SFAS) orchestrator, an entity context request associated with an entity;
in response to obtaining the entity context request:
making a first determination, by the SFAS orchestrator, that the entity is not associated with an entity directed acyclic graph (DAG);
in response to the first determination:
obtaining, by the SFAS orchestrator, the entity DAG associated with the entity from a lineage builder;
making a second determination, by the SFAS orchestrator, that the entity is not associated with SFA anchors;
in response to the second determination:
obtaining, by the SFAS orchestrator, the SFA anchors associated with the entity from a resolver, wherein obtaining the SFA anchors comprises:
sending, by the SFAS orchestrator, an SFA anchor request and the entity DAG to the resolver, wherein, in response to obtaining the SFA anchor request and the entity DAG, the resolver:
obtains security modeling assessment system connection data from a registrar,
generates the SFA anchors using the security modeling assessment system connection data and the entity DAG, and
provides the SFA anchors to the SFAS orchestrator;
obtaining, by the SFAS orchestrator, the SFA records associated with the entity from an extractor using the SFA anchors; and
performing, by the SFAS orchestrator, security actions using the SFA records.

### Claim 10 (depends on 9)

The non-transitory computer readable medium of claim 9, wherein obtaining, by the SFAS orchestrator, the SFA records associated with the entity from the extractor using the SFA anchors comprises:
sending, by the SFAS orchestrator, a request for the SFA records associated with the entity and the SFA anchors to the extractor; and
in response to obtaining, by the extractor, the request for the SFA records associated with the entity and the SFA anchors:
obtaining security assessment data from security modeling assessment systems using the SFA anchors;
generating the SFA records using the security assessment data; and
providing the SFA records to the SFAS orchestrator.

### Claim 11 (depends on 9)

The non-transitory computer readable medium of claim 9, wherein the entity context request comprises entity context information associated with the entity, wherein the entity context information specifies the entity.

### Claim 12 (depends on 11)

The non-transitory computer readable medium of claim 11, wherein the entity DAG comprises:
a plurality of nodes associated with related entities associated with the entity, and
a node of the plurality of nodes associated with the entity.

### Claim 13 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein the SFA records specify security assessment data associated with the plurality of nodes.

### Claim 14 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein obtaining, by the SFAS orchestrator, the entity DAG associated with the entity from the lineage builder comprises:
sending, by the SFAS orchestrator, an entity DAG request and the entity context information to the lineage builder;
in response to obtaining, by the lineage builder, the entity DAG request and the entity context information:
obtaining, by the lineage builder, security modeling assessment execution environment connection data from the registrar;
obtaining, by the lineage builder, entity relationship data associated with the entity from a security modeling assessment execution environment using the security modeling assessment execution environment connection data;
generating, by the lineage builder, the entity DAG using the entity relationship data; and
providing, by the lineage builder, the entity DAG to the SFAS orchestrator.

### Claim 15 (depends on 14)

The non-transitory computer readable medium of claim 14, wherein the SFA anchors specify the security modeling assessment system connection data associated with the plurality of nodes.

### Claim 16 (depends on 9)

The non-transitory computer readable medium of claim 9, wherein the registrar maintains an address book, wherein the address book comprises the security modeling assessment system connection data and the security modeling assessment execution environment connection data.

### Claim 17

A system, comprising:
a production environment comprising entities; and
a security findings acquisition system (SFAS) orchestrator of a SFAS, comprising a processor and memory, programmed to:
obtain an entity context request associated with an entity of the entities;
in response to obtaining the entity context request:
make a first determination that the entity is not associated with an entity directed acyclic graph (DAG);
in response to the first determination:
obtain the entity DAG associated with the entity from a lineage builder;
make a second determination that the entity is not associated with SFA anchors;
in response to the second determination:
obtain the SFA anchors associated with the entity from a resolver, wherein obtaining the SFA anchors comprises:
send an SFA anchor request and the entity DAG to the resolver, wherein, in response to obtaining the SFA anchor request and the entity DAG, the resolver:
obtains security modeling assessment system connection data from a registrar,
generates the SFA anchors using the security modeling assessment system connection data and the entity DAG, and
provides the SFA anchors to the SFAS orchestrator;
obtain the SFA records associated with the entity from an extractor using the SFA anchors; and
perform security actions using the SFA records.

### Claim 18 (depends on 17)

The system of claim 17, wherein obtaining the SFA records associated with the entity from the extractor using the SFA anchors comprises:
sending, by the SFAS orchestrator, a request for the SFA records associated with the entity and the SFA anchors to the extractor; and
in response to obtaining, by the extractor, the request for the SFA records associated with the entity and the SFA anchors:
obtaining security assessment data from security modeling assessment systems using the SFA anchors;
generating the SFA records using the security assessment data; and
providing the SFA records to the SFAS orchestrator.