# US 2020/0401692 A1 · Method to prevent root level access attack and measurable sla security and compliance platform

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401692 A1
- Document ID: US20200401692A1
- Status: Published application
- Kind: A1
- Application number: 16/907,305
- Filed: 2020-06-21
- Published: 2020-12-24
- Earliest claimed: 2019-06-21
- Assignees: Cyemptive Technologies, Inc.
- Applicants: Cyemptive Technologies, Inc.
- Inventors: Robert Pike; Gary Zelanko; Bryan Greene
- Web page: https://patentgrep.com/patent/US20200401692A1

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
- H04L 41/5019: Ensuring fulfilment of SLA
- H04L 43/065: related to network devices
- H04L 43/16: Threshold monitoring
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment}
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2115: Third party
- G06F 2221/2127: Bluffing
- G06F 2221/2139: Recurrent verification
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A management system detects a change at the target device. The management system transmits a request message to authorization devices of the authorization users of the multi-user authorization pool to from the authorization users an indication of whether the detected change is approved. The management system receives a plurality of response messages from authorization devices of the multi-user authorization pool indicating whether the detected change is approved by the corresponding authorization user, and based on at least three of the plurality of response messages indicating a disapproval, that the detected change is disapproved. In response to the determination that the change is disapproved, an instruction message is sent to a target managed device to instruct the target managed device to rollback to an earlier state.

## Claims

### Claim 1

A system comprising:
a target device;
a multiple custody approval subsystem comprising:
a multi-user authorization pool including a plurality of authorization users to approve of any detected change at the target device;
a management system configured to:
monitor the target device;
detect a change at the target device;
in response to a detection of the change at the target device:
transmit a request message to authorization devices of the authorization users of the multi-user authorization pool, the request message requesting from the authorization users an indication of whether the detected change is approved;
receive a plurality of response messages from authorization devices of the multi-user authorization pool, each of the plurality of response messages indicating whether the detected change is approved by the corresponding authorization user;
determine, based on at least three of the plurality of response messages indicating a disapproval, that the detected change is disapproved; and
transmit, in response to the determination that the change is disapproved, an instruction message to the target device to instruct the target device to rollback to an earlier state.

### Claim 2 (depends on 1)

The system of claim 1, wherein the target device further comprises:
a processor configured to execute non-transitory computer readable instructions related to an operating system;
a management library configured to:
inject one or more detection executables into the operating system, the one or more detection executables executed by the processor to monitor change occurring in the operating system;
receive an alert from the one or more detection executables indicating a change detected in the operating system that falls outside an exception list; and
transmit a message to the management system indicating detection of a change, the message including a description of the detected change.

### Claim 3 (depends on 1)

The system of claim 1, wherein the target device further comprises:
a processor configured to execute non-transitory computer readable instructions related to an operating system, the non-transitory computer readable instructions of the operating system stored in an associated electronic storage;
a management library configured to:
receive from the management system the instruction message to rollback the target device; and
replace a current copy of the operating system at the electronic storage with a previously recorded copy of the operating system that is of a known good state.

### Claim 4 (depends on 1)

The system of claim 1, wherein each authorization device is a computing device that provides an output interface to an authorization user to provide a description of the change, and which includes an input interface to allow the authorization user to indicate whether the change is approved or disapproved.

### Claim 5 (depends on 1)

The system of claim 1, wherein the change is an access of a resource provided by the operating system of the target device by a user account with root privileges.

### Claim 6 (depends on 1)

The system of claim 1, wherein the change is a cessation of an encrypted heartbeat signal from the target device.

### Claim 7 (depends on 1)

The system of claim 1, wherein the change is a disconnection in one or more connections from the management system to the target device.

### Claim 8 (depends on 1)

The system of claim 1, wherein the management system is further configured to:
determine that an authorization user disapproves of a change if no response message is received from the authorization device associated with the authorization user within a threshold time period.

### Claim 9 (depends on 1)

The system of claim 1, wherein the management system is further configured to:
determine that the detected change is disapproved in response to at least three response messages indicating disapproval of the change.

### Claim 10 (depends on 1)

The system of claim 1, wherein the management system is further configured to:
detect a second change at the target device;
in response to detecting the second change at the target device:
transmit a second request message to the authorization devices of the authorization users of the multi-user authorization pool, the second request message requesting from the authorization users an indication of whether the detected second change is approved;
receive one or more second response messages from the authorization devices; and
in response to determining that at least three of the one or more second response messages indicate that the detected second change is approved, transmit a message to the target device indicating to allow the second change.

### Claim 11

A method comprising:
monitoring a target device;
detecting a change at the target device;
in response to detecting the change at the target device:
transmitting a request message to authorization devices of authorization users of a multi-user authorization pool, the request message requesting from the authorization users an indication of whether the detected change is approved, the multi-user authorization pool including a plurality of authorization users to approve of any detected change at the target device;
receiving a plurality of response messages from authorization devices of the multi-user authorization pool, each of the plurality of response messages indicating whether the detected change is approved by the corresponding authorization user;
determining, based on at least three of the plurality of response messages indicating a disapproval, that the detected change is disapproved; and
transmitting, in response to the determination that the change is disapproved, an instruction message to the target device to instruct the target device to rollback to an earlier state.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
wherein the target device injects one or more detection executables into the operating system, the one or more detection executables executed by the processor to monitor change occurring in the operating system;
wherein the target device receives an alert from the one or more detection executables indicating a change detected in the operating system that falls outside an exception list; and
wherein the target device transmits a message to the management system indicating detection of a change, the message including a description of the detected change.

### Claim 13 (depends on 11)

The method of claim 11, further comprising:
wherein the target device receives from the management system the instruction message to rollback the target device; and
wherein the target device replaces a current copy of the operating system at the electronic storage with a previously recorded copy of the operating system that is of a known good state.

### Claim 14 (depends on 11)

The method of claim 11, wherein each authorization device is a computing device that provides an output interface to an authorization user to provide a description of the change, and which includes an input interface to allow the authorization user to indicate whether the change is approved or disapproved.

### Claim 15 (depends on 11)

The method of claim 11, wherein the change is an access of a resource provided by the operating system of the target device by a user account with root privileges.

### Claim 16 (depends on 11)

The method of claim 11, wherein the change is a cessation of an encrypted heartbeat signal from the target device.

### Claim 17 (depends on 11)

The method of claim 11, wherein the change is a disconnection in one or more connections from the management system to the target device.

### Claim 18 (depends on 11)

The method of claim 11, further comprising
determining that an authorization user disapproves of a change if no response message is received from the authorization device associated with the authorization user within a threshold time period.

### Claim 19 (depends on 11)

The method of claim 11, further comprising:
determining that the detected change is disapproved in response to at least three response messages indicating disapproval of the change.

### Claim 20 (depends on 11)

The method of claim 11, further comprising:
detecting a second change at the target device;
in response to detecting the second change at the target device:
transmitting a second request message to the authorization devices of the authorization users of the multi-user authorization pool, the second request message requesting from the authorization users an indication of whether the detected second change is approved;
receiving one or more second response messages from the authorization devices; and
in response to determining that at least three of the one or more second response messages indicate that the detected second change is approved, transmit a message to the target device indicating to allow the change.