Pki smart-card threat detection and endpoint use visibility

A system (100) to detect targeted Public Key Infrastructure (PKI) threats and attacks on an end-point (10) communicatively coupled to an authenticator device (5) providing PKI based Multi-Factor Authentication (MFA), the system comprising:

• on a local side:
• a Middleware (14) connecting one or more Applications (15) to the authenticator device (5) by way of an Operating system (OS)(13) there in between, said Middleware comprising:
• an Event Generator (22) to generate events (50) related to access and usage of the authenticator device (5) by the one or more apps executing on the end-point;
• an Event Viewer (23) that makes visible events related to certificate based PKI authenticator device interactions by the one or more apps;
• and
• an Event Uploader (24) to upload the events;
• on a server side, communicatively coupled to the local side:
• an Event Receiver (31) to receive the events (50) presented by the Event Uploader;
• an Event Parser (32) to parse and categorize the events, from the Event Receiver, specific to each of the one or more apps executing on the end-point;
• an App Inventory Manager (44) coupled to the Event Parser to correlate the events with the one or more apps and keep records of the correlations in a Database (40);
• an Analytics Engine (48), coupled to the Inventory Manager and Database (40), that
• identifies an application useage status of the authenticator device (5) in view of the correlations;
• builds analytics on usage patterns from the application useage status on PKI authenticator device interactions by the one or more apps;
• identifies anamolies and potential atttacks on the authenticator device in view of the analytics and produces an event threat analysis;
• and,
• an Event Viewer (33) that reports event threat analysis, and makes visible to system administrators events related to user and attacker interactions with the authenticator device.