# US 2017/0257397 A1 · Identity security and containment based on detected threat events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0257397 A1 - Document ID: US20170257397A1 - Status: Published application - Kind: A1 - Application number: 15/061,846 - Filed: 2016-03-04 - Published: 2017-09-07 - Earliest claimed: 2016-03-04 - Assignees: SecureAuth Corporation - Applicants: SecureAuth Corporation - Inventors: Keith Martin Graham; Stephen Garnett Cox - Web page: https://patentgrep.com/patent/US20170257397A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An alert source issues security alerts to an identity provider, which acts as a gatekeeper to a secure resource. Each security alert is associated with an alert user identity and a security threat. When a user identity requests access to the secure resource, the identity provider may look up security alerts associated with the user identity, such as my matching up the user identity with the alert user identity associated with each alert. Based on any discovered security alerts that correspond to the user identity and a pre-defined security policy, the identity provider may perform various security actions on the user identity. For example, the identity provider may contain a user identity associated with high-risk and/or high fidelity security alerts. The identity provider may deny the user identity access to the secure resource, or the identity provider may request additional authentication factors associated with the user identity before access to the secure resource is provided. The identity provider may provide access to the secure resource without containing the user identity if there are no discovered security alerts associated with the user identity, or if the discovered security alerts pose a minor threat. ## Claims ### Claim 1 A computing appliance for consuming security alerts from an alert source, the system comprising: one or more processors; a computer-readable memory; and an authentication program comprising executable instructions stored in the computer-readable memory, wherein the executable instructions direct the one or more processors to at least: receive, over a computer network, a security alert generated by a threat detection system in response to detecting that a user device logged in with a first user account has been compromised with malware, wherein the security alert is associated with a security threat; determine that the first user account is used to log in to the user device when the user device is compromised with the malware using the security alert; determine a security action to be executed by the one or more processors for controlling access to a secure computer-based resource that requires authentication of a user identity, the security action executed when the first user account is used in an attempt to access the secure computer-based resource, wherein the security action is determined based on the security alert and a security protocol; receive, over the computer network, a request to access the secure computer-based resource, wherein the request comprises an identification of a second user account; determine that the first user account matches the second user account; and execute the determined security action in response to determining that the first user account and the second user account match. ### Claim 2 (depends on 1) The computing appliance of claim 1, wherein the executable instructions further direct the one or more processors to at least classify the security alert into an action category defined in the security protocol, and wherein the security protocol comprises at least two action categories. ### Claim 3 (depends on 2) The computing appliance of claim 2, wherein the at least two action categories in the security protocol comprise: a deny access category for which the security action comprises denying the first user account access to the secure computer-based resource; and a step-up security category for which the security action comprises requesting at least one additional security factor from the first user account. ### Claim 4 (depends on 3) The computing appliance of claim 3, wherein the at least one additional security factor comprises at least one of: a username, a password, a one-time password, or a biometric. ### Claim 5 (depends on 1) The computing appliance of claim 1, wherein the executable instructions further direct the one or more processors to at least provide a third user account with access to the secure computer-based resource if the third user account does not match the first user account. ### Claim 6 (depends on 1) The computing appliance of claim 1, wherein the threat detection system comprises one of a network threat detection system or an endpoint threat detection system. ### Claim 7 A computerized method for providing a derived credential to a target device, the method comprising: by one or more hardware processors executing computing instructions: receiving, over a computer network, a security alert generated by a threat detection system in response to detecting that a user device logged in with a first user account has been compromised with malware, wherein the security alert is associated with a security threat; determining that the first user account is used to log in to the user device when the user device is compromised with the malware using the security alert; determining a security action to be executed by the one or more hardware processors for controlling access to a secure computer-based resource that requires authentication of a user identity, the security action executed when the first user account is used in an attempt to access the secure computer-based resource, wherein the security action is determined based on the security alert and a security protocol; receiving, over the computer network, a request to access the secure computer-based resource, wherein the request comprises an identification of a second user account; determining that the first user account matches the second user account; and executing the determined security action in response to determining that the first user account and the second user account match. ### Claim 8 (depends on 7) The computerized method of claim 7, wherein determining a security action further comprises classifying the security alert into an action category defined in the security protocol, and wherein the security protocol comprises at least two action categories. ### Claim 9 (depends on 8) The computerized method of claim 8, wherein the at least two action categories in the security protocol comprise: a deny access category for which the security action comprises denying the first user account access to the secure computer-based resource; and a step-up security category for which the security action comprises requesting at least one additional security factor from the first user account. ### Claim 10 (depends on 8) The computerized method of claim 8, wherein the at least two action categories in the security protocol comprise: an allow access category for which the security action comprises providing the first user account access to the secure computer-based resource. ### Claim 11 (depends on 9) The computerized method of claim 9, wherein the at least one additional security factor comprises at least one of: a username, a password, a one-time password, or a biometric. ### Claim 12 (depends on 7) The computerized method of claim 7, further comprising providing a third user account with access to the secure computer-based resource if the third user account does not match the first user account. ### Claim 13 (depends on 7) The computerized method of claim 7, wherein the threat detection system comprises one of a network threat detection system or an endpoint threat detection system. ### Claim 14 A computerized method for issuing and consuming a security alert, the method comprising: by one or more hardware processors executing computing instructions: generating a security alert in response to detecting that a user device logged in with a first user account has been compromised with malware, the security alert associated with a security threat; sending the security alert over a computer network; receiving the security alert over the computer network; determining that the first user account is used to log in to the user device when the user device is compromised with the malware using the security alert; determining a security action to be executed by the one or more hardware processors for controlling access to a secure computer-based resource that requires authentication of a user identity, the security action executed when the first user account is used in an attempt to access the secure computer-based resource, wherein the security action is determined based on the security alert and a security protocol; receiving, over the computer network, a request to access the secure computer-based resource, wherein the request comprises an identification of a second user account; determining that the first user account matches the second user account; and executing the determined security action in response to determining that the first user account and the second user account match. ### Claim 15 (depends on 14) The computerized method of claim 14, further comprising detecting the security threat by monitoring malware on the user device, and wherein the user device comprises one of a computing device, a smart phone, a tablet, or a notebook computer. ### Claim 16 (depends on 14) The computerized method of claim 14, wherein determining a security action further comprises classifying the security alert into an action category defined in the security protocol, and wherein the security protocol comprises at least two action categories. ### Claim 17 (depends on 16) The computerized method of claim 16, wherein the at least two action categories in the security protocol comprise: a deny access category for which the security action comprises denying the first user account access to the secure computer-based resource; and a step-up security category for which the security action comprises requesting at least one additional security factor from the first user account. ### Claim 18 (depends on 16) The computerized method of claim 16, wherein the at least two action categories in the security protocol comprise: an allow access category for which the security action comprises providing the first user account access to the security computer-based resource. ### Claim 19 (depends on 17) The computerized method of claim 17, wherein the at least one additional security factor comprises at least one of: a username, a password, a one-time password, or a biometric. ### Claim 20 (depends on 14) The computerized method of claim 14, further comprising providing a third user account with access to the secure computer-based resource if the third user account does not match the first user account.