# US 2019/0318128 A1 · Chain of custody for enterprise documents

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0318128 A1
- Document ID: US20190318128A1
- Status: Published application
- Kind: A1
- Application number: 16/165,417
- Filed: 2018-10-19
- Published: 2019-10-17
- Earliest claimed: 2018-04-13
- Assignees: Sophos Limited
- Applicants: Sophos Limited
- Inventors: Karl Ackerman; Russell Humphries; Daniel Salvatore Schiappa; Kenneth D. Ray; Andrew J. Thomas
- Web page: https://patentgrep.com/patent/US20190318128A1

## CPC

- G06F 21/45: Structures or tools for the administration of authentication
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)}
- G06F 16/285: {Clustering or classification}
- G06F 16/93: Document management systems
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06N 3/0675: {using electro-optical, acousto-optical or opto-electronic means}
- G06N 5/046: Forward inferencing; Production systems
- G06N 5/048: Fuzzy inferencing
- G06N 20/00: Machine learning
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/16: the keys or algorithms being changed during operation
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 9/3271: {using challenge-response}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 41/20: {Network management software packages}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 2221/034: Test or assess a computer or a system
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 2463/082: applying multi-factor authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A ledger stores chain of custody information for files throughout an enterprise network. By identifying files with a homologous identifier such as a fuzzy hash that permits piecewise evaluation of similarity, the ledger can be used to track a chain of custody over a sequence of changes in content, ownership, and file properties. The ledger can be used, e.g., to evaluate trustworthiness of a file the first time it is encountered by an endpoint, or to apply enterprise policies based on trust.

## Claims

### Claim 1

A system comprising:
a plurality of endpoints storing a plurality of documents;
an enterprise network interconnecting the plurality of endpoints; and
a server coupled in a communicating relationship with the enterprise network, the server storing a ledger with a chain of custody for each of the plurality of documents, the chain of custody for each one of the plurality of documents including one or more fuzzy hashes, each associated with a user of the one of the plurality of documents and contents of the one of the plurality of documents, the server configured to respond to an information request containing a first fuzzy hash, by matching the first fuzzy hash to one or more of the fuzzy hashes stored in the ledger and providing chain of custody information to a requestor for at least one of the plurality of documents corresponding to the one or more of the fuzzy hashes, the server further configured to respond to an update request containing a second fuzzy hash by matching the second fuzzy hash to a matching one of the plurality of documents and adding the second fuzzy hash and related information to the chain of custody in the ledger for the matching one of the plurality of documents.

### Claim 2

A method comprising:
generating a first fuzzy hash for a file;
requesting chain of custody information for the file from a ledger for an enterprise network based on the first fuzzy hash;
receiving a modification to the file;
generating a second fuzzy hash for the file; and
transmitting the second fuzzy hash to the ledger for inclusion in a chain of custody for the file.

### Claim 3 (depends on 2)

The method of claim 2 wherein the file includes a document selected from a group consisting of a word processing document, a spreadsheet, an image, an audio file, and a video file.

### Claim 4 (depends on 2)

The method of claim 2 wherein the file includes computer executable code selected from a group consisting of source code, byte code, compiled code, and script.

### Claim 5 (depends on 2)

The method of claim 2 wherein receiving the modification includes receiving the modification from a user different than an author of the file.

### Claim 6 (depends on 2)

The method of claim 2 wherein the ledger is stored in database hosted at a threat management facility for the enterprise network.

### Claim 7 (depends on 2)

The method of claim 2 wherein the ledger is stored in a cloud resource remotely accessible from the enterprise network.

### Claim 8 (depends on 2)

The method of claim 2 wherein the ledger is a distributed ledger.

### Claim 9 (depends on 2)

The method of claim 2 wherein the chain of custody information includes an author and one or more users associated with a number of versions of the file.

### Claim 10 (depends on 2)

The method of claim 2 wherein the chain of custody information include at least one item that is cryptographically signed for authentication using a certificate from a trust authority.

### Claim 11 (depends on 10)

The method of claim 10 wherein the trust authority includes a trusted platform module or a remote third party trust authority.

### Claim 12 (depends on 2)

The method of claim 2 wherein the first fuzzy hash and the second fuzzy hash include context triggered piecewise hashes.

### Claim 13

A method comprising:
generating a homologous file identifier for a file;
requesting chain of custody information for the file from a ledger for an enterprise network based on the homologous file identifier;
evaluating a trustworthiness of the file based on the chain of custody information; and
applying an enterprise policy to the file based on the trustworthiness.

### Claim 14 (depends on 13)

The method of claim 13 wherein evaluating the trustworthiness of the file includes determining an amount of change to the file from one or more other files identified in the ledger based on a similarity of the homologous file identifier for the file to one or more other homologous file identifiers for the one or more other files identified in the ledger.

### Claim 15 (depends on 13)

The method of claim 13 wherein evaluating the trustworthiness of the file includes evaluating a trustworthiness of one or more users associated with the file in the chain of custody information.

### Claim 16 (depends on 13)

The method of claim 13 wherein the homologous file identifier includes a first fuzzy hash.

### Claim 17 (depends on 16)

The method of claim 16 further comprising receiving a modification to the file, generating a second fuzzy hash for the file, transmitting the second fuzzy hash to the ledger for inclusion in a chain of custody for the file.

### Claim 18 (depends on 13)

The method of claim 13 wherein applying the enterprise policy includes blocking or allowing access to the file at an endpoint in the enterprise network.

### Claim 19 (depends on 13)

The method of claim 13 wherein applying the enterprise policy includes blocking or allowing a transmittal of the file through the enterprise network.

### Claim 20 (depends on 13)

The method of claim 13 wherein applying the enterprise policy includes deploying a remedial measure based on a low trustworthiness of the file.