# US 12,192,224 B2 · Opentelemetry security systems and methods

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,224 B2
- Document ID: US12192224B2
- Status: Granted
- Kind: B2
- Application number: 17/823,256
- Filed: 2022-08-30
- Published: 2024-02-29
- Granted: 2025-01-07
- Earliest claimed: 2022-08-30
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology Inc.
- Inventors: Walter T. Hulick, Jr.; Ashutosh Kulshreshtha
- Web page: https://patentgrep.com/patent/US12192224B2

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

According to some embodiments, a method includes detecting a start of an OpenTelemetry span by an application and determining security information related to the start of the OpenTelemetry span. The method further includes monitoring the application for one or more application behaviors during execution of the OpenTelemetry span. The method further includes detecting an end of the OpenTelemetry span by the application, and in response, calculate a security score for the OpenTelemetry span using the security information related to the start of the OpenTelemetry span and the one or more application behaviors detected during execution of the OpenTelemetry span. The method further includes updating a status of the OpenTelemetry span to include the security score and a text string related to the calculation of the security score.

## Claims

### Claim 1

A system comprising:
one or more memory units; and
a processor communicatively coupled to the one or more memory units, the processor configured to:
detect a start of an OpenTelemetry span by an application;
determine security information related to the start of the OpenTelemetry span and store the security information in a data structure in memory;
during execution of the OpenTelemetry span, monitor the application for one or more application behaviors and store the one or more application behaviors in the data structure;
detect an end of the OpenTelemetry span by the application, and in response,
calculate a security score for the OpenTelemetry span using:
the security information related to the start of the OpenTelemetry span; and
the one or more application behaviors detected during the execution of the Open Telemetry span; and
update a status of the OpenTelemetry span to include:
the security score; and
a text string related to the calculation of the security score;
determine one or more potential security issues for the OpenTelemetry span using the security score; and
mitigate the one or more potential security issues for the OpenTelemetry span using the security score.

### Claim 2 (depends on 1)

The system of claim 1, wherein the text string related to the calculation of the security score is a JSON Web Token (JWT).

### Claim 3 (depends on 2)

The system of claim 2, wherein the JWT indicates one or more of:
a number of points from exceptions;
a number of points related to a Common Vulnerabilities and Exposures (CVE);
a number of points from permission requests;
a number of points based on a parent span; and
a number of points from an OpenTelemetry TraceState.

### Claim 4 (depends on 1)

The system of claim 1, wherein:
updating the status of the OpenTelemetry span comprises executing an OpenTelemetry setStatus command;
the security score is inserted as a status code of the setStatus command; and
the text string related to the calculation of the security score is inserted as string description of the setStatus command.

### Claim 5 (depends on 1)

The system of claim 1, wherein the data structure comprises a hashtable.

### Claim 6 (depends on 1)

The system of claim 1, wherein the security information related to the start of the OpenTelemetry span comprises one or more of:
a location where a transaction of the OpenTelemetry span originated;
an identification of a user associated with the transaction;
a type of the transaction; or
a status of a parent span.

### Claim 7 (depends on 1)

The system of claim 1, wherein the one or more application behaviors comprises one or more of:
a security exception interception;
a class that is executed during the OpenTelemetry span;
a permission request made during the OpenTelemetry span; or
a computing environment in which the OpenTelemetry span is executed.

### Claim 8

A method by a computing system, the method comprising:
detecting a start of an OpenTelemetry span by an application;
determining security information related to the start of the OpenTelemetry span and storing the security information in a data structure in memory;
during execution of the OpenTelemetry span, monitoring the application for one or more application behaviors and storing the one or more application behaviors in the data structure;
detecting an end of the Open Telemetry span by the application, and in response, calculating a security score for the OpenTelemetry span using:
the security information related to the start of the OpenTelemetry span; and
the one or more application behaviors detected during the execution of the Open Telemetry span; and
updating a status of the OpenTelemetry span to include:
the security score; and
a text string related to the calculation of the security score;
determining one or more potential security issues for the OpenTelemetry span using the security score; and
mitigating the one or more potential security issues for the OpenTelemetry span using the security score.

### Claim 9 (depends on 8)

The method of claim 8, wherein the text string related to the calculation of the security score is a JSON Web Token (JWT).

### Claim 10 (depends on 9)

The method of claim 9, wherein the JWT indicates one or more of:
a number of points from exceptions;
a number of points related to a Common Vulnerabilities and Exposures (CVE);
a number of points from permission requests;
a number of points based on a parent span; and
a number of points from an OpenTelemetry TraceState.

### Claim 11 (depends on 8)

The method of claim 8, wherein:
updating the status of the Open Telemetry span comprises executing an OpenTelemetry setStatus command;
the security score is inserted as a status code of the setStatus command; and
the text string related to the calculation of the security score is inserted as string description of the setStatus command.

### Claim 12 (depends on 8)

The method of claim 8, wherein the data structure comprises a hashtable.

### Claim 13 (depends on 8)

The method of claim 8, wherein the security information related to the start of the Open Telemetry span comprises one or more of:
a location where a transaction of the OpenTelemetry span originated;
an identification of a user associated with the transaction;
a type of the transaction; or
a status of a parent span.

### Claim 14 (depends on 8)

The method of claim 8, wherein the one or more application behaviors comprises one or more of:
a security exception interception;
a class that is executed during the Open Telemetry span;
a permission request made during the OpenTelemetry span; or
a computing environment in which the OpenTelemetry span is executed.

### Claim 15

One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
detecting a start of an OpenTelemetry span by an application;
determining security information related to the start of the OpenTelemetry span and storing the security information in a data structure in memory;
during execution of the OpenTelemetry span, monitoring the application for one or more application behaviors and storing the one or more application behaviors in the data structure;
detecting an end of the OpenTelemetry span by the application, and in response, calculating a security score for the OpenTelemetry span using:
the security information related to the start of the OpenTelemetry span; and
the one or more application behaviors detected during the execution of the OpenTelemetry span; and
updating a status of the OpenTelemetry span to include:
the security score; and
a text string related to the calculation of the security score;
determining one or more potential security issues for the OpenTelemetry span using the security score; and
mitigating the one or more potential security issues for the OpenTelemetry span using the security score.

### Claim 16 (depends on 15)

The one or more computer-readable non-transitory storage media of claim 15, wherein the text string related to the calculation of the security score is a JSON Web Token (JWT).

### Claim 17 (depends on 16)

The one or more computer-readable non-transitory storage media of claim 16, wherein the JWT indicates one or more of:
a number of points from exceptions;
a number of points related to a Common Vulnerabilities and Exposures (CVE);
a number of points from permission requests;
a number of points based on a parent span; and
a number of points from an OpenTelemetry TraceState.

### Claim 18 (depends on 15)

The one or more computer-readable non-transitory storage media of claim 15, wherein:
updating the status of the Open Telemetry span comprises executing an OpenTelemetry setStatus command;
the security score is inserted as a status code of the setStatus command; and
the text string related to the calculation of the security score is inserted as string description of the setStatus command.

### Claim 19 (depends on 15)

The one or more computer-readable non-transitory storage media of claim 15, wherein the data structure comprises a hashtable.

### Claim 20 (depends on 15)

The one or more computer-readable non-transitory storage media of claim 15, wherein:
the security information related to the start of the OpenTelemetry span comprises one or more of:
a location where a transaction of the OpenTelemetry span originated;
an identification of a user associated with the transaction;
a type of the transaction; or
a status of a parent span; and
the one or more application behaviors comprises one or more of:
a security exception interception;
a class that is executed during the OpenTelemetry span;
a permission request made during the OpenTelemetry span; or
a computing environment in which the OpenTelemetry span is executed.