# US 12,225,002 B2 · Enriching exposed credential search results to make them actionable > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,002 B2 - Document ID: US12225002B2 - Status: Granted - Kind: B2 - Application number: 17/967,113 - Filed: 2022-10-17 - Published: 2024-04-18 - Granted: 2025-02-11 - Earliest claimed: 2022-10-17 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Michael Christopher Fanning; Suvam Mukherjee; Jacek Andrzej Czerwonka; Christopher Michael Henry Faucon; Eddy Toshiyuki Okada Nakamura; Danielle Nicole Gonzalez; Nicolas Yves Couraud; Alison Lynne Maclellan - Web page: https://patentgrep.com/patent/US12225002B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 21/554: {involving event detection and direct action} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for (i) using contextual information associated with an exposed credential to identify a resource that could be accessed using the exposed credential, (ii) identifying a responsible entity of that resource, and (iii) alerting the responsible entity about the exposed credential are disclosed. A credential is determined to be in an exposed state. The exposed credential, if used, could potentially provide an actor access to a resource, despite the fact that the actor should not have access to the resource. The exposed credential is analyzed to determine a context. Based on that context, the resource is identified. A responsible entity associated with the resource is identified. An alert is then sent to that entity. ## Claims ### Claim 1 A method for (i) using contextual information associated with an exposed credential to identify a resource that could be accessed using the exposed credential, (ii) identifying a responsible entity of that resource, and (iii) alerting the responsible entity about the exposed credential, said method comprising: identifying a credential that is located within an artifact; determining that the credential is in an exposed state such that the credential is an exposed credential, wherein the exposed credential, if used, could potentially provide access to a resource; analyzing one or more of the exposed credential or the artifact to determine a context that is associated with the exposed credential; based on the context that is associated with the exposed credential, identifying the resource; determining a responsible entity that is associated with the resource; triggering transmission of an alert, wherein the alert includes information corresponding to the exposed credential; periodically querying to determine whether the exposed credential has been invalidated; in response to a determination that the exposed credential has not been invalidated, providing a subsequent alert; and in response to a determination that the exposed credential has already been invalidated, finalizing actions related to remediation of the exposed credential. ### Claim 2 (depends on 1) The method of claim 1, wherein the information corresponding to the exposed credential includes one or more of: information describing characteristics of the exposed credential, information describing a security model associated with the exposed credential, information as to where the exposed credential was found, or information as to what steps can be performed to invalidate the exposed credential. ### Claim 3 (depends on 1) The method of claim 1, wherein the artifact is at least one of: a source controlled artifact, a work ticket, an automation artifact, a workflow artifact, an email, or a document. ### Claim 4 (depends on 1) The method of claim 1, wherein the exposed credential is at least one of: a bearer token, an identity, a certificate, a private key, a static credential store, a container of artifacts, compressed data, or a password. ### Claim 5 (depends on 1) The method of claim 1, wherein the credential is identified based on a detected pattern associated with the credential. ### Claim 6 (depends on 1) The method of claim 1, wherein determining that the credential is in the exposed state includes determining an access availability of a data source that is storing the credential. ### Claim 7 (depends on 1) The method of claim 1, wherein the context is determined via a discovery process that involves one or more of: examining the artifact, examining a nested set of artifacts that include the artifact, or consultation with a security model. ### Claim 8 (depends on 1) The method of claim 1, wherein the resource is at least one of: a local application, a cloud service operating in a cloud environment, a database administration resource, an on-premise resource, an identity, or a certificate. ### Claim 9 (depends on 1) The method of claim 1, wherein the responsible entity is one or more entities with permissions for managing the resource. ### Claim 10 (depends on 1) The method of claim 1, wherein identifying the credential that is located within the artifact includes: scanning a data source that includes the artifact; identifying a suspected credential that is suspected of being the exposed credential, which, if used, could provide access to the resource; determining a characteristic of the suspected credential, said characteristic comprising a detected pattern associated with the suspected credential; and based on the determined characteristic of the suspected credential, determining that the suspected credential is the exposed credential. ### Claim 11 (depends on 1) The method of claim 1, wherein the method further includes: after the resource has been identified, determining whether the exposed credential can actually provide access to the resource. ### Claim 12 (depends on 1) The method of claim 1, wherein the exposed credential is a password, and wherein the method further includes: determining that the password cannot be used to access the resource; determining a characteristic of the password; based on the determined characteristic, generating one or more variations of the password; attempting to access the resource using the one or more variations of the password; and attempting to access a different resource using the password, where the different resource is of a same type as said resource. ### Claim 13 (depends on 1) The method of claim 1, wherein determining the responsible entity is based on at least one of: querying a metadata store associated with the resource, the metadata store comprising registration information that links the responsible entity to the resource, utilizing the credential to perform additional discovery by consulting a service using the credential to build out information about the responsible entity, using the credential to communicate directly with a security model to obtain information about the responsible entity, or analyzing telemetry data that is associated with at least one of the artifact, the credential, or the resource. ### Claim 14 (depends on 1) The method of claim 1, wherein the exposed credential is included in a nested set of artifacts. ### Claim 15 A method for (i) using contextual information associated with an exposed credential to identify a resource that could be accessed using the exposed credential, (ii) identifying a responsible entity of that resource, and (iii) alerting the responsible entity about the exposed credential, said method comprising: identifying a credential that is located within an artifact; determining that the credential is in an exposed state such that the credential is an exposed credential, wherein the exposed credential, if used, could potentially provide access to a resource; analyzing one or more of the exposed credential or the artifact to determine a context that is associated with the exposed credential, wherein the context includes historical information associated with the exposed credential, the historical information including a duration that the exposed credential has been in the exposed state; based on the context that is associated with the exposed credential, identifying the resource; identifying a subscription mapping that is associated with the resource, wherein the subscription mapping includes a subscription identification for an entity associated with the resource; identifying the subscription identification and the entity for the resource; and triggering transmission of an alert to the entity, wherein the alert includes information detailing the exposed credential. ### Claim 16 (depends on 15) The method of claim 15, wherein the resource is a cloud service operating in a cloud environment, and wherein the subscription mapping is a billing subscription for the cloud service. ### Claim 17 A method for (i) using contextual information associated with an exposed credential to identify a resource that could be accessed using the exposed credential, (ii) identifying a responsible entity of that resource, and (iii) alerting the responsible entity about the exposed credential, said method comprising: identifying a first credential that is located within a first artifact; determining that the first credential is in an exposed state such that the first credential is a first exposed credential, wherein the first exposed credential, if used, could potentially provide access to a resource; analyzing one or more of the first exposed credential or the first artifact to determine a context that is associated with the first exposed credential; based on the context that is associated with the first exposed credential, identifying the resource; determining a responsible entity that is associated with the resource; triggering transmission of an alert to the responsible entity, wherein the alert includes information detailing how the first exposed credential is in the exposed state; determining a first characteristic of the first exposed credential; identifying a relationship between the first characteristic of the first exposed credential and the resource; storing an indication of the relationship in a data source, said indication being searchable; identifying a second exposed credential having a second characteristic that is determined to be similar to the first characteristic of the first exposed credential; based on the second characteristic being similar to the first characteristic, generating an inference that the second exposed credential is also associated with the resource; and testing the second exposed credential to determine whether the second exposed credential is usable to access the resource.