# US 2019/0319987 A1 · Interface for network security marketplace

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0319987 A1
- Document ID: US20190319987A1
- Status: Published application
- Kind: A1
- Application number: 16/383,439
- Filed: 2019-04-12
- Published: 2019-10-17
- Earliest claimed: 2018-04-13
- Assignees: Sophos Limited
- Applicants: Sophos Limited
- Inventors: Joseph H. Levy; Andrew J. Thomas; Daniel Salvatore Schiappa; Kenneth D. Ray
- Web page: https://patentgrep.com/patent/US20190319987A1

## CPC

- G06F 21/45: Structures or tools for the administration of authentication
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)}
- G06F 16/285: {Clustering or classification}
- G06F 16/93: Document management systems
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06N 3/0675: {using electro-optical, acousto-optical or opto-electronic means}
- G06N 5/046: Forward inferencing; Production systems
- G06N 5/048: Fuzzy inferencing
- G06N 20/00: Machine learning
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/16: the keys or algorithms being changed during operation
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 9/3271: {using challenge-response}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 41/20: {Network management software packages}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 2221/034: Test or assess a computer or a system
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 2463/082: applying multi-factor authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An interface for a threat management facility of an enterprise network supports the use of third-party security products within the enterprise network by providing access to relevant internal instrumentation and/or a programmatic interface for direct or indirect access to local security agents on compute instances within the enterprise network.

## Claims

### Claim 1

A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on a threat management facility for an enterprise network, performs the steps of:
providing a first interface of the threat management facility for monitoring activity on a plurality of compute instances associated with the enterprise network;
providing a second interface of the threat management facility for communications with local security agents on the compute instances that provide local security to the compute instances against malicious network activity;
providing a third interface of the threat management facility providing programmatic access to the threat management facility by one or more resources outside the enterprise network; and
providing a security system for use of third party security resources within the enterprise network, the security system configured to controllably expose data available through the first interface to a remote user accessing the threat management facility through the third interface, and the security system further configured to controllably expose configuration of the local security agents accessible through the second interface to the remote user through the third interface.

### Claim 2 (depends on 1)

The computer program product of claim 1 wherein the remote user includes a cloud service.

### Claim 3 (depends on 1)

The computer program product of claim 1 wherein the remote user includes a human resources system provider for the enterprise network.

### Claim 4 (depends on 1)

The computer program product of claim 1 wherein the threat management facility includes an authentication facility for controlling access to the enterprise network by the remote user.

### Claim 5 (depends on 4)

The computer program product of claim 4 wherein the authentication facility is a multifactor authentication facility requiring two or more factors for authentication of the remote user.

### Claim 6 (depends on 1)

The computer program product of claim 1 wherein the threat management facility includes a metering facility.

### Claim 7 (depends on 6)

The computer program product of claim 6 wherein the metering facility supports payments by the remote user to the threat management facility for access to the enterprise network.

### Claim 8 (depends on 6)

The computer program product of claim 6 wherein the metering facility supports payments by the threat management facility to the remote user for access to services of a remote resource of the remote user by the compute instances associated with the enterprise network.

### Claim 9 (depends on 1)

The computer program product of claim 1 wherein the threat management facility includes an event collection facility accessible to the remote user through the third interface.

### Claim 10

A method comprising:
monitoring activity on a plurality of compute instances associated with an enterprise network through a first interface of a threat management facility;
communicating with local security agents on the compute instances through a second interface of the threat management facility;
providing programmatic access to the threat management facility by one or more resources outside the enterprise network through a third interface of the threat management facility; and
operating a security system on the threat management facility, the security system configured to controllably expose data available through the first interface to a remote user accessing the threat management facility through the third interface, and the security system further configured to controllably expose configuration of the local security agents accessible through the second interface to the remote user through the third interface.

### Claim 11 (depends on 10)

The method of claim 10 wherein the remote user includes a cloud service.

### Claim 12 (depends on 11)

The method of claim 11 wherein the remote user includes a human resources system provider for the enterprise network.

### Claim 13 (depends on 10)

The method of claim 10 further comprising controlling access to the enterprise network by the remote user through an authentication facility of the threat management facility.

### Claim 14 (depends on 13)

The method of claim 13 wherein the authentication facility is a multifactor authentication facility requiring two or more factors for authentication of the remote user.

### Claim 15 (depends on 10)

The method of claim 10 further comprising charging for services provided through the first interface, the second interface, and the third interface of the threat management facility with a metering facility of the threat management facility.

### Claim 16 (depends on 15)

The method of claim 15 wherein the metering facility supports payments by the remote user to the threat management facility for access to the enterprise network.

### Claim 17 (depends on 15)

The method of claim 15 wherein the metering facility supports payments by the threat management facility to the remote user for access to services of a remote resource of the remote user by the compute instances associated with the enterprise network.

### Claim 18 (depends on 10)

The method of claim 10 further comprising storing an event stream for the enterprise network at an event collection facility of the threat management facility.

### Claim 19 (depends on 18)

The method of claim 18 further comprising providing access to the event collection facility for remote resources through the third interface.

### Claim 20

A system comprising:
a threat management facility for compute instances in an enterprise network;
a first interface of the threat management facility for monitoring activity on the compute instances;
a second interface of the threat management facility for communications with local security agents on the compute instances that provide local security to the compute instances against malicious network activity;
a third interface of the threat management facility providing programmatic access to the threat management facility by one or more resources outside the enterprise network; and
a security system within the threat management facility, the security system configured to controllably expose data available through the first interface to a remote user accessing the threat management facility through the third interface, and the security system further configured to controllably expose configuration of the local security agents accessible through the second interface to the remote user through the third interface.