# US 8,544,099 B2 · Method and device for questioning a plurality of computerized devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,099 B2 - Document ID: US8544099B2 - Status: Granted - Kind: B2 - Application number: 12/785,259 - Filed: 2010-05-21 - Published: 2010-09-16 - Granted: 2013-09-24 - Earliest claimed: 2004-10-04 - Assignees: Promisec Ltd. - Applicants: Ron Shay Suchowski; Hilik Kotler - Inventors: Ron Shay Suchowski; Hilik Kotler - Web page: https://patentgrep.com/patent/US8544099B2 ## CPC - H04L 41/046: comprising network management agents or mobile agents therefor - G06F 21/40: by quorum, i.e. whereby two or more security principals are required - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/102: {Entity profiles} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 69/14: Multichannel or multilink protocols - G06F 2221/2103: Challenge-response - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Some embodiments of the present invention may relate to a device and a method of questioning computerized devices within an organization's network. The device, in accordance with some embodiments of the present invention, may include a questioning module and an agentless module. The questioning module may be adapted to receive data specifying a plurality of computerized devices to be questioned, and to receive data indicating which one or more questioning subjects are selected to be questioned on the specified computerized devices. The agentless module may be adapted to invoke and configure at least a remote access process, to question at least a registry of a remote computerized device. In accordance with some embodiments of the present invention, the questioning module may be adapted to utilize multiple threads of the agentless module to invoke and configure a plurality of remote access processes to question in parallel and without using agents at least a registry of the specified computerized devices, in accordance with the selected questioning subjects. ## Claims ### Claim 1 A central device for questioning a plurality of computerized devices in an organization's network, said device comprising: a microprocessor coupled to a computer-readable medium encoded with a computer program, wherein the microprocessor is programmed to: receive data specifying the plurality of computerized devices to be questioned; receive data indicating which one or more questioning subjects are to be questioned within the plurality of computerized devices, at least one of the questioning subjects is associated with one or more specific locations within a computerized device; and invoke and configure a plurality of threads of a remote access process running locally within the central device to remotely question in parallel and without using agents a plurality of the specified computerized devices according to respective questioning subjects. ### Claim 2 (depends on 1) The device according to claim 1, wherein the questioning subjects are associated with security threats. ### Claim 3 (depends on 2) The device according to claim 2, wherein the questioning subjects are associated specific locations within at least the registry of a computerized device, where an indication of a security threat may be found during questioning. ### Claim 4 (depends on 1) The device according to claim 1, wherein said microprocessor is programmed to invoke and configure a substantially large number of the remote access process to thereby remotely question without using agents and in parallel a substantially large number of the specified plurality of computerized devices. ### Claim 5 (depends on 1) The device according to claim 1, wherein said microprocessor is programmed to select which one or more of the questioning subjects are to be questioned on each one of the specified plurality of computerized devices. ### Claim 6 (depends on 5) The device according to claim 5, further comprising a user interface to enable a user to select, either directly or indirectly, one or more of the specified plurality of computerized devices. ### Claim 7 (depends on 6) The device according to claim 6, wherein said user interface may further enable a user to select, either directly or indirectly, which one or more questioning subjects are to be questioned on one or more of the specified plurality of computerized devices. ### Claim 8 (depends on 1) The device according to claim 1, wherein said microprocessor is programmed to determine a number of threads of the remote access process to be invoked and configured to remotely question the specified plurality of computerized devices. ### Claim 9 (depends on 8) The device according to claim 8, wherein said microprocessor is programmed to determine the number of threads of the remote access process to be invoked and configured in accordance with one or more of the following: a number of computerized devices to be questioned in parallel, a desired questioning speed, one or more network performance parameters, subjects to be questioned, and a subject's severity. ### Claim 10 (depends on 1) The device according to claim 1, wherein said microprocessor is programmed to assign to each thread of the remote access process one or more of the specified plurality of computerized devices. ### Claim 11 (depends on 10) The device according to claim 10, wherein said microprocessor is programmed to assign to each thread of said remote access process one or more questioning subjects selected to be questioned on one or more of the specified plurality of computerized devices that have been assigned to that thread of said remote access process. ### Claim 12 (depends on 11) The device according to claim 11, wherein said microprocessor is programmed to configure each invoked thread of said remote access process to question one or more specific locations within the computerized devices assigned to that thread, in accordance with the respective one or more questioning subjects selected for each of the computerized devices and which have been assigned to that thread. ### Claim 13 (depends on 12) The device according to claim 12, wherein said microprocessor is programmed to configure each invoked thread of said remote access process to question one or more specific locations within at least a registry of the computerized devices assigned to that thread, in accordance with the respective one or more questioning subjects selected for each of the computerized devices and which have been assigned to that thread. ### Claim 14 (depends on 12) The device according to claim 12, wherein said microprocessor is programmed to assign to one or more threads of said remote access process predefined data corresponding to certain data which may be found in one or more of the specified locations associated with one or more of the questioning subjects assigned to that or these thread or threads. ### Claim 15 (depends on 14) The device according to claim 14, wherein said microprocessor is programmed to configure one or more of the invoked threads of the remote access process to compare actual data associated with one or more of the questioning subjects that was found within the computerized devices assigned to that or these threads against the predefined data associated with the respective questioning subjects. ### Claim 16 (depends on 7) The device according to claim 7, further comprising one or more databases including prestored data corresponding to one or more computerized devices, and wherein as part of specifying the computerized devices to be questioned, prestored data corresponding to computerized devices may be obtained from said database. ### Claim 17 (depends on 7) The device according to claim 7, further comprising one or more databases including prestored data corresponding to one or more questioning subjects, and wherein as part of selecting one or more questioning subjects to be questioned on the specified computerized devices, prestored data corresponding to one or more questioning subjects may be obtained from said database. ### Claim 18 (depends on 1) The device according to claim 1, wherein said microprocessor is programmed to process results received in response to the questioning of one or more of the specified plurality of computerized devices, and to generate a report corresponding to the results. ### Claim 19 (depends on 18) The device according to claim 18, wherein said microprocessor is programmed to compare one or more results relating to actual data found as part of the questioning of one or more of the specified plurality of computerized devices against predefined data. ### Claim 20 (depends on 1) The device according to claim 1, wherein said microprocessor is programmed to utilize one or more threads of the remote access process to modify or delete certain data on one or more of the specified plurality of remote computerized devices which were questioned. ### Claim 21 A method of questioning a plurality of computerized devices in an organization's network using a central questioning device, said method comprising: specifying a plurality of computerized devices to be questioned; selecting one or more questioning subjects to be questioned on the specified plurality of computerized devices; and invoking and configuring a plurality of threads of a remote access process running locally within the central questioning device to remotely question in parallel and without using agents a plurality of the specified computerized devices, in accordance with respective questioning subjects. ### Claim 22 (depends on 21) The method according to claim 21, wherein said selecting one or more questioning subjects further comprises, selecting which one or more of the questioning subjects is to be questioned on each of the specified plurality of computerized devices. ### Claim 23 (depends on 21) The method according to claim 21, wherein said invoking and configuring further comprises assigning to each of the plurality of threads of the remote access process one or more of the specified plurality of computerized devices, and one or more of questioning subjects to be questioned on the one or more computerized devices. ### Claim 24 (depends on 21) The method according to claim 21, further comprising determining a number of threads of the remote access process to be invoked, in accordance with one or more of the following: a number of computerized devices to be questioned in parallel, a desired questioning speed, one or more network performance parameters, subjects to be questioned, and a subject's severity. ### Claim 25 (depends on 23) The method according to claim 23, wherein said assigning further comprises assigning to one or more of the of threads of the remote access process data corresponding to one or more specific locations within the computerized devices assigned to that or these threads, in accordance with one or more of respective questioning subjects selected to be questioned on the computerized devices. ### Claim 26 (depends on 25) The method according to claim 25, further comprising assigning to one or more threads of said remote access process predefined data corresponding to certain data which may be found in one or more of the specified locations associated with one or more of the questioning subjects assigned to that or these thread or threads. ### Claim 27 (depends on 26) The method according to claim 26, further comprising configuring one or more of the invoked threads of the remote access process to compare actual data associated with one or more of the questioning subjects that was found within the computerized devices assigned to that or these threads against the predefined data associated with the respective questioning subjects. ### Claim 28 (depends on 21) The method according to claim 21, further comprising: receiving results in response to the questioning of at least one of the specified plurality of computerized devices; and generating a report corresponding to the results received in response to the questioning of the specified plurality of computerized devices. ### Claim 29 (depends on 21) The method according to claim 21, further comprising utilizing one or more threads of the remote access process to modify or delete certain data on one or more of the remote computerized devices which were questioned. ### Claim 30 A non-transitory program storage device readable by a central questioning device, tangibly embodying a program of instructions executable by the central questioning device to perform a method of internally questioning a plurality of computerized devices in an organization's network, said method comprising: specifying a plurality of computerized devices to be questioned; selecting one or more questioning subjects to be questioned on the specified plurality of computerized devices, at least one of the questioning subjects being associated with one or more specific locations within a computerized device; and invoking and configuring a plurality of threads of a remote access process running locally within the central questioning device to remotely question, in parallel and without using agents, a plurality of the specialized computerized devices in accordance with respective questioning subjects.