# US 12,003,525 B2 · Development security operations on the edge of the network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,525 B2
- Document ID: US12003525B2
- Status: Granted
- Kind: B2
- Application number: 17/711,427
- Filed: 2022-04-01
- Published: 2022-10-06
- Granted: 2024-06-04
- Earliest claimed: 2021-04-02
- Assignees: Siemens Aktiengesellschaft
- Applicants: Siemens Aktiengesellschaft
- Inventors: Valerio Formicola; Charif Mahmoudi
- Web page: https://patentgrep.com/patent/US12003525B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 2221/033: Test or assess software
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A zero trust architecture can continuously monitor and verify code uploaded at the edge of 5G networks, so as to automatically identify security inconsistencies between security requirements and the performance of a given system.

## Claims

### Claim 1

A computer-implemented method performed at an edge of a core network, the method comprising:
identifying an application that is connected to the core network;
extracting design attributes associated with one or more specifications of the application;
extracting implementation attributes associated with a code tool of the application;
monitoring the edge of the core network so as to identify monitored attributes associated with the application; and
comparing the design attributes, implementation attributes, and monitored attributes with one another so as determine whether there is an inconsistency between the design attributes, implementation attributes, and monitored attributes.

### Claim 2 (depends on 1)

The method as recited in claim 1, the method further comprising:
identifying the inconsistency between at least one of the design attributes, implementation attributes, and monitored attributes; and
responsive to identifying the inconsistency, discovering a security vulnerability associated with the application, so as to define a discovered security vulnerability.

### Claim 3 (depends on 2)

The method as recited in claim 2, the method further comprising:
based on the discovered security vulnerability, limiting access of the application to the core network.

### Claim 4 (depends on 2)

The method as recited in claim 2, the method further comprising:
based on the discovered security vulnerability, alerting an administrator of the core network of the discovered security vulnerability.

### Claim 5 (depends on 1)

The method as recited in claim 1, the method further comprising:
identifying a code update associated with the application, wherein extracting the implementation attributes is responsive to identifying the code update.

### Claim 6 (depends on 1)

The method as recited in claim 1, wherein the monitoring the edge of the core network further comprises monitoring the edge by a run-time execution environment that mirrors a software execution environment of the edge.

### Claim 7 (depends on 1)

The method as recited in claim 1, wherein the design attributes, implementation attributes, and monitored attributes define respective port information associated with the application.

### Claim 8 (depends on 1)

The method as recited in claim 1, the method further comprising:
generating a model based on the monitoring of the edge of the core network; and
identifying the inconsistency using the model.

### Claim 9

A module within a core network, the module comprising:
a processor; and
a memory storing instructions that, when executed by the processor, configure the module to:
identify an application that is connected to the core network;
extract design attributes associated with one or more specifications of the application;
extract implementation attributes associated with a code tool of the application;
monitor an edge of the core network so as to identify monitored attributes associated with the application; and
compare the design attributes, implementation attributes, and monitored attributes with one another so as determine whether there is an inconsistency between the design attributes, implementation attributes, and monitored attributes.

### Claim 10 (depends on 9)

The module as recited in claim 9, the memory further storing instructions that, when executed by the processor, further configure the module to:
identify the inconsistency between at least one of the design attributes, implementation attributes, and monitored attributes; and
responsive to identifying the inconsistency, discover a security vulnerability associated with the application, so as to define a discovered security vulnerability.

### Claim 11 (depends on 10)

The module as recited in claim 10, the memory further storing instructions that, when executed by the processor, further configure the module to:
based on the discovered security vulnerability, limit access of the application to the core network.

### Claim 12 (depends on 10)

The module as recited in claim 10, the memory further storing instructions that, when executed by the processor, further configure the module to:
based on the discovered security vulnerability, alerting an administrator of the core network of the discovered security vulnerability.

### Claim 13 (depends on 9)

The module as recited in claim 9, the memory further storing instructions that, when executed by the processor, further configure the module to:
identify a code update associated with the application, wherein extracting the implementation attributes is responsive to identifying the code update.

### Claim 14 (depends on 9)

The module as recited in claim 9, the memory further storing instructions that, when executed by the processor, further configure the module to:
monitor the edge by a run-time execution environment that mirrors a software execution environment of the edge.

### Claim 15 (depends on 9)

The module as recited in claim 9, wherein the design attributes, implementation attributes, and monitored attributes define respective port information associated with the application.

### Claim 16 (depends on 9)

The module as recited in claim 9, the memory further storing instructions that, when executed by the processor, further configure the module to:
generate a model based on the monitoring of the edge of the core network; and
identify the inconsistency using the model.

### Claim 17

A non-transitory computer-readable storage medium including instructions that, when processed by a computing system cause the computing system to perform operations comprising:
identifying an application that is connected to a core network;
extracting design attributes associated with one or more specifications of the application;
extracting implementation attributes associated with a code tool of the application;
monitoring an edge of the core network so as to identify monitored attributes associated with the application; and
comparing the design attributes, implementation attributes, and monitored attributes with one another so as determine whether there is an inconsistency between the design attributes, implementation attributes, and monitored attributes.