# US 2021/0344667 A1 · Cybersecurity System Having Digital Certificate Reputation System > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344667 A1 - Document ID: US20210344667A1 - Status: Published application - Kind: A1 - Application number: 16/865,176 - Filed: 2020-05-01 - Published: 2021-11-04 - Earliest claimed: 2020-05-01 - Assignees: Forcepoint LLC - Applicants: Forcepoint, LLC - Inventors: Lawrence Bruce Huston, III; David Coffey - Web page: https://patentgrep.com/patent/US20210344667A1 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/101: {Access control lists [ACL]} - H04L 63/126: {the source of the received data} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system, method, and computer-readable medium are disclosed for implementing a cybersecurity system having a digital certificate reputation system. At least one embodiment is directed to a computer-implemented method executing operations including receiving a communication having an internet protocol (IP) address and a digital certificate at a device within the secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing the one or more security policies. Other embodiments include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices. ## Claims ### Claim 1 A computer-implemented method for executing one or more security policies in a secured network, comprising: receiving a communication including an Internet protocol (IP) address and a digital certificate at a device within the secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing the one or more security policies. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the security risk level for the IP address and the security risk level for the digital certificate are used in the execution of the one or more security policies. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: determining whether the IP address has a high-security risk includes determining whether the IP address is on a blacklist of IP addresses; and assigning a high-security risk level to the digital certificate if the IP address is on the blacklist of IP addresses. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: retrieving a user behavior security risk level corresponding to security risk presented by a user, wherein the user is an intended recipient of the communication; and using the security risk level for the IP address, the security risk level for the digital certificate, and the user behavior security risk level for the user to execute one or more security policies. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: increasing a security risk level of the IP address if the digital certificate has been previously used with one or more IP addresses presenting an elevated security risks. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: if the digital certificate is associated with an IP address having a high-security risk level, analyzing the digital certificate to identify one or more digital certificate characteristics; and analyzing other digital certificates to determine whether other digital certificates have one or more of the same digital certificate characteristics. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, further comprising: assigning an elevated security risk level to the other digital certificates having one or more of the same digital certificate characteristics. ### Claim 8 A system comprising: one or more information handling systems, wherein the one or more information handling systems include: a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus; wherein the computer program code included in one or more of the information handling systems is executable by the processor of the information handling system so that the information handling system, alone or in combination with other information handling systems, executes operations comprising: receiving a communication including an Internet protocol (IP) address and a digital certificate at a device within a secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing one or more security policies. ### Claim 9 (depends on 8) The system of claim 8, wherein the security risk level for the IP address and the security risk level for the digital certificate are used in the execution of the one or more security policies. ### Claim 10 (depends on 8) The system of claim 8, wherein determining whether the IP address has a high-security risk includes determining whether the IP address is on a blacklist of IP addresses; and assigning a high-security risk level to the digital certificate if the IP address is on the blacklist of IP addresses. ### Claim 11 (depends on 8) The system of claim 8, wherein the computer program code is further configured for: retrieving a user behavior security risk level corresponding to security risk presented by a user, wherein the user is an intended recipient of the communication; and using the security risk level for the IP address, the security risk level for the digital certificate, and the user behavior security risk level for the user to execute one or more security policies. ### Claim 12 (depends on 8) The system of claim 8, wherein the computer program code is further configured for: increasing a security risk level of the IP address if the digital certificate has been previously used with one or more IP addresses presenting elevated security risks. ### Claim 13 (depends on 8) The system of claim 8, wherein the computer program code is further configured for: if the digital certificate is associated with an IP address having a high-security risk level, analyzing the digital certificate to identify one or more digital certificate characteristics; and analyzing other digital certificates to determine whether other digital certificates have one or more of the same digital certificate characteristics. ### Claim 14 (depends on 13) The system of claim 13, wherein the computer program code is further configured for: assigning an elevated security risk level to the other digital certificates having one or more of the same digital certificate characteristics. ### Claim 15 A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer-executable instructions configured for: receiving a communication including an Internet protocol (IP) address and a digital certificate at a device within a secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing one or more security policies. ### Claim 16 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the security risk level for the IP address and the security risk level for the digital certificate are used in the execution of the one or more security policies. ### Claim 17 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein determining whether the IP address has a high-security risk includes determining whether the IP address is on a blacklist of IP addresses; and assigning a high-security risk level to the digital certificate if the IP address is on the blacklist of IP addresses. ### Claim 18 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the instructions are further configured for: retrieving a user behavior security risk level corresponding to security risk presented by a user, wherein the user is an intended recipient of the communication; and using the security risk level for the IP address, the security risk level for the digital certificate, and the user behavior security risk level for the user to execute one or more security policies. ### Claim 19 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the instructions are further configured for: increasing a security risk level of the IP address if the digital certificate has been previously used with one or more IP addresses presenting an elevated security risk. ### Claim 20 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the instructions are further configured for: if the digital certificate is associated with an IP address having a high-security risk level, analyzing the digital certificate to identify one or more digital certificate characteristics; analyzing other digital certificates to determine whether other digital certificates have one or more of the same digital certificate characteristics; and assigning an elevated security risk level to the other digital certificates having one or more of the same digital certificate characteristics.