# US 12,223,037 B2 · Systems and methods for context-based mitigation of computer security risks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,037 B2
- Document ID: US12223037B2
- Status: Granted
- Kind: B2
- Application number: 17/069,529
- Filed: 2020-10-13
- Published: 2021-05-20
- Granted: 2025-02-11
- Earliest claimed: 2017-02-27
- Assignees: Ivanti, Inc.
- Applicants: Ivanti, Inc.
- Inventors: Robert M. Juncker; Christopher J. Goettl
- Web page: https://patentgrep.com/patent/US12223037B2

## CPC

- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/104: {Grouping of entities}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 12/12: Detection or prevention of fraud
- H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
- H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

An apparatus includes a processor operatively coupled to a memory. The processor receives a first set of risk assessment rules including first user privilege criteria and first device criteria. The first device criteria include a computing device patch level, a network type, and/or a password policy. The processor identifies a user-specific security risk based on the first set of risk assessment rules and applies a privilege mitigation measure based on the user-specific security risk without being in communication with a management server. The processor later receives a second, updated set of risk assessment rules at the computing device. Upon detecting another login of the user, the processor identifies an updated user-specific security risk based on the updated set of risk assessment rules, and applies a modified privilege mitigation measure based on the updated user-specific security risk, again without being in communication with the management server.

## Claims

### Claim 1

A method of context-based privilege mitigation, the method comprising:
detecting a login event of a user of a computing device;
receiving, by the computing device from a management server, a risk assessment rule that includes risk criteria and a plurality of privilege mitigation measures associated with the risk criteria, the risk assessment rule being communicated from the management server in response to the detection of the login event at the computing device, and the risk assessment rule indicates that a software application is vulnerable to an exploit;
evaluating, by an agent on the computing device, information on the computing device that is relevant to the risk criteria;
determining that the user has elevated privileges on the computing device;
detecting, by the computing device, a vulnerable software application to which the user has access, the vulnerable software application being flagged by the risk assessment rule;
identifying, by the computing device, a particular privilege mitigation measure of the plurality of privilege mitigation measures, wherein the particular privilege mitigation measure is mapped to the detected vulnerable software application; and
applying, by the computing device, the particular privilege mitigation measure on the computing device, the particular privilege mitigation measure including an action that reduces a user privilege level of the user and prevents software from being used on the computing device by the user until a desired update to the vulnerable software application has been installed.

### Claim 2 (depends on 1)

The method of claim 1, wherein the risk criteria include user privilege criteria, device criteria, and application criteria applicable to detection of the vulnerable software application.

### Claim 3 (depends on 2)

The method of claim 2, wherein:
the device criteria include at least one of:
a patch level of the computing device,
a network type of the computing device, or
a password policy; and
the particular privilege mitigation measure is associated with the user privilege criteria.

### Claim 4 (depends on 1)

The method of claim 1, wherein:
the risk criteria are a first risk criteria;
the login event is a first login event;
the vulnerable software application is a first security risk;
the action is a first action;
the particular privilege mitigation measure is a first privilege mitigation measure; and
the method further comprises:
receiving a second risk assessment rule including a second risk criteria and the plurality of privilege mitigation measures associated with the second risk criteria;
detecting a second login event of the user of the computing device;
determining a second security risk associated with the second login event based at least partially on the second risk criteria;
identifying a second privilege mitigation measure of the plurality of privilege mitigation measures, wherein the second privilege mitigation measure is mapped to the second security risk based on the second risk criteria and the second privilege mitigation measure includes a second action to decrease the second security risk that is different from the first action; and
applying the second privilege mitigation measure on the computing device.

### Claim 5 (depends on 1)

The method of claim 1, further comprising receiving a second risk assessment rule in response to detection of a new vulnerability associated with the computing device.

### Claim 6 (depends on 4)

The method of claim 4, wherein:
the second risk criteria include a network type of the computing device; and
the second privilege mitigation measure includes one or both of:
disabling network access for the user responsive to the network type of the computing device being a public network; and
sending an alert to the user responsive to the network type of the computing device being a public network that advises the user that the network is public.

### Claim 7 (depends on 4)

The method of claim 4, wherein the applying the second privilege mitigation measure includes:
patching;
privilege management;
whitelisting;
blacklisting;
automatically repairing a group policy associated with the user;
causing installation of an update on the computing device; or repairing user account settings associated with the user to comply with a group policy.

### Claim 8 (depends on 4)

The method of claim 4, wherein:
the computer device is in operable communication with a network, and
the identification of the second security risk is performed in response to:
a detected change in the network; or
a detected group policy violation.

### Claim 9

A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations of context-based privilege mitigation, the operations comprising:
detecting a login event of a user of a computing device;
receiving, by the computing device from a management server, a risk assessment rule that includes risk criteria and a plurality of privilege mitigation measures associated with the risk criteria, the risk assessment rule being communicated from the management server in response to the detection of the login event at the computing device, and the risk assessment rule indicates that a software application is vulnerable to an exploit;
evaluating, by an agent on the computing device, information on the computing device that is relevant to the risk criteria;
determining that the user has elevated privileges on the computing device;
detecting, by the computing device, a vulnerable software application to which the user has access, the vulnerable software application being flagged by the risk assessment rule;
identifying, by the computing device, a particular privilege mitigation measure of the plurality of privilege mitigation measures, wherein the particular privilege mitigation measure is mapped to the detected vulnerable software application; and
applying, by the computing device, the particular privilege mitigation measure on the computing device, the particular privilege mitigation measure including an action that reduces a user privilege level of the user and prevents software from being used on the computing device by the user until a desired update to the vulnerable software application has been installed.

### Claim 10 (depends on 9)

The non-transitory computer-readable medium of claim 9, wherein the risk criteria include user privilege criteria, device criteria, and application criteria applicable to detection of the vulnerable software application.

### Claim 11 (depends on 10)

The non-transitory computer-readable medium of claim 10, wherein:
the device criteria include at least one of:
a patch level of the computing device,
a network type of the computing device, or
a password policy; and
the particular privilege mitigation measure is associated with the user privilege criteria.

### Claim 12 (depends on 9)

The non-transitory computer-readable medium of claim 9, wherein:
the risk criteria are a first risk criteria;
the login event is a first login event;
the vulnerable software application is a first security risk;
the action is a first action;
the particular privilege mitigation measure is a first privilege mitigation measure; and
the operations further comprise:
receiving a second risk assessment rule including a second risk criteria and the plurality of privilege mitigation measures associated with the second risk criteria;
detecting a second login event of the user of the computing device;
determining a second security risk associated with the second login event based at least partially on the second risk criteria;
identifying a second privilege mitigation measure of the plurality of privilege mitigation measures, wherein the second privilege mitigation measure is mapped to the second security risk based on the second risk criteria and the second privilege mitigation measure includes a second action to decrease the second security risk that is different from the first action; and
applying the second privilege mitigation measure on the computing device.

### Claim 13 (depends on 9)

The non-transitory computer-readable medium of claim 9, wherein the operations further comprise receiving a second risk assessment rule in response to detection of a new vulnerability associated with the computing device.

### Claim 14 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein:
the second risk criteria include a network type of the computing device; and
the second privilege mitigation measure includes one or both of:
disabling network access for the user responsive to the network type of the computing device being a public network; and
sending an alert to the user responsive to the network type of the computing device being a public network that advises the user that the network is public.

### Claim 15 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein the applying the second privilege mitigation measure includes:
patching;
privilege management;
whitelisting;
blacklisting;
automatically repairing a group policy associated with the user;
causing installation of an update on the computing device; or
repairing user account settings associated with the user to comply with a group policy.

### Claim 16 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein:
the computer device is in operable communication with a network, and
the identification of the second security risk is performed in response to:
a detected change in the network; or
a detected group policy violation.