# US 12,015,596 B2 · Risk analysis using port scanning for multi-factor authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,596 B2
- Document ID: US12015596B2
- Status: Granted
- Kind: B2
- Application number: 17/140,092
- Filed: 2021-01-03
- Published: 2021-07-22
- Granted: 2024-06-18
- Earliest claimed: 2015-10-28
- Assignees: Qomplx LLC
- Applicants: Qomplx LLC
- Inventors: Jason Crabtree; Andrew Sellers
- Web page: https://patentgrep.com/patent/US12015596B2

## CPC

- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 16/951: Indexing; Web crawling techniques
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3297: {involving time stamps, e.g. generation of time stamps}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1433: {Vulnerability analysis}
- H04L 67/306: User profiles
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 5/04: Inference or reasoning models
- G06N 5/045: Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence
- G06N 5/046: Forward inferencing; Production systems
- G06N 20/00: Machine learning
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A system for risk analysis using port scanning for multi-factor authentication having a multi-dimensional time series data server configured to monitor and record a network's traffic data and to serve the traffic data to other modules and a directed computational graph module configured to scan open ports on connection destinations, analyze the scan results, and determine a verification score needed before granting access based at least in part on the analysis of the received responses. A plurality of verification methods build up a user's verification score to required level to gain access.

## Claims

### Claim 1

A system for risk analysis using port scanning for multi-factor authentication, comprising:
a multi-dimensional time series data server comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
monitor and store a network's traffic data; and
serve traffic data to other modules; and
a directed computational graph module comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
receive traffic data from the multi-dimensional time series data server;
identify a connection attempt from a user device to a destination device with unknown risk potential;
scan a plurality of network ports at the destination device;
analyze the scan results to determine at least a plurality of open ports at the destination device and a plurality of closed ports at the destination device; and
determine a required verification score for granting access to a network resource based at least in part on the open and closed ports on the destination device;
wherein a plurality of verification methods is used to build up a user's verification score to the required verification score in order for the user to gain access to the destination device.

### Claim 2 (depends on 1)

The system of claim 1, wherein the verification score is based at least in part on stored knowledge of the user.

### Claim 3 (depends on 2)

The system of claim 2, wherein the stored knowledge of the user comprises at least knowledge of user access privileges to resources on the local network.

### Claim 4 (depends on 1)

The system of claim 1, wherein at least a portion of the verification methods verifies visual media pertaining to the user.

### Claim 5 (depends on 1)

The system of claim 1, wherein at least a portion of the verification methods checks and verifies biometric features of the user.

### Claim 6 (depends on 1)

The system of claim 1, wherein at least a portion of the verification methods used are based on information obtained from untrusted parties.

### Claim 7 (depends on 1)

The system of claim 1, wherein at least a portion of the verification methods used are based on information pertaining to the user device.

### Claim 8

A method for risk analysis using port scanning for multi-factor authentication, comprising the steps of:
(a) using a computing device with a processor and a memory, monitoring and recording a network's traffic data for the purpose of providing a stateful, evolving baseline of authentication patterns, with a multi-dimensional time series data server;
(b) serving the traffic data to other modules, with the multi-dimensional time series data server;
(c) receiving the traffic data from the multi-dimensional time series data server, at a directed computation graph module;
(d) identifying a connection attempt from a user device to a destination device with unknown risk potential;
(e) scanning a plurality of network ports at the destination device;
(f) analyzing the scan results to determine at least a plurality of open ports at the destination device and a plurality of closed ports at the destination device; and
(g) determining a required verification score for granting access to a network resource based at least in part on the open and closed ports on the destination device; and
(h) requiring user of the user device to use a plurality of verification methods to earn enough verification score in order to gain access to the destination device.

### Claim 9 (depends on 8)

The method of claim 8, wherein the verification score is based at least in part on stored knowledge of the user.

### Claim 10 (depends on 9)

The method of claim 9, wherein the stored knowledge of the user comprises at least knowledge of user access privileges to resources on the local network.

### Claim 11 (depends on 8)

The method of claim 8, wherein at least a portion of the verification methods verifies visual media pertaining to the user.

### Claim 12 (depends on 8)

The method of claim 8, wherein at least a portion of the verification methods checks and verifies biometric features of the user.

### Claim 13 (depends on 8)

The method of claim 8, wherein at least a portion of the verification methods used are based on information obtained from untrusted parties.

### Claim 14 (depends on 8)

The method of claim 8, wherein at least a portion of the verification methods used are based on information pertaining to the user device.