# US 9,292,881 B2 · Social sharing of security information in a group

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,292,881 B2
- Document ID: US9292881B2
- Status: Granted
- Kind: B2
- Application number: 13/538,439
- Filed: 2012-06-29
- Published: 2014-01-02
- Granted: 2016-03-22
- Earliest claimed: 2012-06-29
- Assignees: CrowdStrike, Inc.
- Applicants: Dmitri Alperovitch; George Robert Kurtz; David F. Diehl; Sven Krasser; Adam S. Meyers
- Inventors: Dmitri Alperovitch; George Robert Kurtz; David F. Diehl; Sven Krasser; Adam S. Meyers
- Web page: https://patentgrep.com/patent/US9292881B2

## CPC

- H04L 63/104: {Grouping of entities}
- G06Q 10/42: Determination of affinities or common interests between users
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06Q 10/00: Administration; Management
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Techniques for social sharing security information between client entities forming a group are described herein. The group of client entities is formed as a result of a security server providing one or more secure mechanisms for forming a group among client entities, the client entities each belonging to a different organization. The security service then automatically shares security information of a client entity in the group with one or more other client entities in the group.

## Claims

### Claim 1

A computer-implemented method comprising:
forming, by a group formation module of security service computing device(s), a group including multiple client entities, each client entity being associated with a different security organization and each client entity having one or more computing devices, each computing device configured with an executable security agent; and
automatically sharing, by a sharing module of the security service computing device(s), security information generated by the executable security agent(s) of a client entity in the group with the executable security agent(s) of computing device(s) of one or more other client entities in the group,
wherein the security information is generated by the executable security agent(s) of the client entity based on monitoring of execution activities of the computing device(s) of the client entity,
wherein the security information is indicative of whether the client entity is experiencing a security threat, and
wherein each client entity is able to impose a security scheme or policy on its computing device(s) but is unable to impose the security scheme or policy on computing device(s) of other client entities.

### Claim 2 (depends on 1)

The method of claim 1, further comprising enabling a client entity of the multiple client entities to invite another client entity to join the group by providing a unique identifier of the other client entity to the security service.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
providing a blind search mechanism that enables a client entity of the multiple client entities to provide identifying information for an entity to the security service;
determining based at least in part on the identifying information whether the entity is a client entity; and
in response to determining that the entity is a client entity, inviting the entity to join the group.

### Claim 4 (depends on 3)

The method of claim 3, wherein the inviting is performed conditionally based on whether the entity has performed a blind search for the searching client entity.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
enabling a client entity of the multiple client entities to search for other client entities and to receive, in return, a list of client entities matching a search query; and
enabling the searching client entity to invite one or more of the client entities included in the list of client entities to join or form a group with the searching client entity.

### Claim 6 (depends on 1)

The method of claim 1, further comprising inviting client entities associated with a security threat to join the group.

### Claim 7 (depends on 1)

The method of claim 1, wherein the forming further comprises creating the group and inviting the client entities to join the group based at least in part on preferences specified by the client entities.

### Claim 8 (depends on 1)

The method of claim 1, wherein the forming further comprises creating the group and associating the group with at least one of an industry sector of the client entities, a geographic location of the client entities, a size range of the client entities, or interests of the client entities.

### Claim 9 (depends on 8)

The method of claim 8, further comprising inviting the client entities to join the group or opening the group to the public.

### Claim 10 (depends on 8)

The method of claim 8, further comprising assigning the client entities to the group and providing the client entities with an option to opt out of the group.

### Claim 11 (depends on 1)

The method of claim 1, wherein the forming further comprises creating the group based at least in part on complementary behaviors of the client entities.

### Claim 12 (depends on 1)

The method of claim 1, wherein the forming further comprises creating the group based at least in part on one or more social network groups.

### Claim 13 (depends on 1)

The method of claim 1, wherein the group is associated with a setting that allows the client entities to be anonymous with respect to each other.

### Claim 14 (depends on 1)

The method of claim 1, wherein the group is associated with a trusted moderator or group of moderators who controls admission to the group.

### Claim 15 (depends on 1)

The method of claim 1, further comprising enabling one or more of the client entities of the group to specify sharing parameters and policy parameters for the group.

### Claim 16 (depends on 1)

The method of claim 1, wherein the automatic sharing involves utilizing one or more of keys, hashing, certificates from a certificate authority, an identity verification mechanism, or other security features to prevent identity spoofing and secure the shared security information.

### Claim 17 (depends on 1)

The method of claim 1, wherein the shared security information is viewable by the client entity sharing the security information and the client entities receiving the security information and is not viewable by the security service or other parties.

### Claim 18 (depends on 1)

The method of claim 1, further comprising enabling a client entity to set system-wide or group-based sharing parameters for the client entity.

### Claim 19 (depends on 1)

The method of claim 1, further comprising enabling a client entity to advertise security information for sharing in exchange for security information from another client entity.

### Claim 20 (depends on 1)

The method of claim 1, wherein the automatic sharing includes sharing security information from third party sources with the client entities of the group.

### Claim 21 (depends on 1)

The method of claim 1, further comprising sharing the security information with a third party security product or service.

### Claim 22 (depends on 1)

The method of claim 1, further comprising associating one or more of the client entities with merit indicia based at least in part on contributions of the one or more client entities to a security ecosystem of the security service or to the group.

### Claim 23 (depends on 1)

The method of claim 1, further comprising providing the client entities with client entity profiles and enabling the client entities to modify their corresponding client entity profiles and to set access restrictions to their corresponding client entity profiles.

### Claim 24 (depends on 1)

The method of claim 1, wherein the security information includes at least one of threat information, remediation information, policies, attack data, vulnerability information, reverse engineering information, packet data, network flow data, protocol descriptions, victim information, threat attribution information, incident information, proliferation data, user feedback, or information on software or systems.

### Claim 25 (depends on 1)

The method of claim 1, wherein the security service is a public service open to interested client entities or a private service open to specific client entities.

### Claim 26 (depends on 1)

The method of claim 1, further comprising enabling manual sharing of security information between the client entities in the group.

### Claim 27 (depends on 1)

The method of claim 1, further comprising providing, to a client entity, an indication of available security information through a user interface and providing the available security information to the client entity responsive to that client entity electing to share security information of the client entity with another client entity that is associated with the available security information.

### Claim 28 (depends on 27)

The method of claim 27, wherein the available security information indicated through the user interface is selected for the client entity based on security information possessed or provided by the client entity.

### Claim 29 (depends on 1)

The method of claim 1, wherein the group belongs to one or more hierarchies of groups, each hierarchy of groups being associated with access controls to security information or with policies pushed to member client entities.

### Claim 30

A system comprising:
a plurality of computing devices associated with a plurality of entities, wherein the entities belong to a group of entities that share security information with each other and each entity is associated with a different security organization; and
a plurality of security agents respectively implemented on the plurality of computing devices, the security agents observing execution activities of their respective computing devices, generating the security information based on the observed execution activities, sharing the security information with one another, and utilizing the security information in observing or reacting to further execution activities of the computing devices on which they are implemented,
wherein the security information is indicative of whether the security agents are experiencing a security threat, and
wherein each entity is able to impose a security scheme or policy on its computing device(s) but is unable to impose the security scheme or policy on computing device(s) of other entities.

### Claim 31 (depends on 30)

The system of claim 30, further comprising a security service to form the group of entities and to automatically share the security information received from one of the plurality of security agents with the other security agents of the plurality of security agents.

### Claim 32 (depends on 30)

The system of claim 30, wherein the security agents observe and react to the execution activities of their respective computing devices in parallel with respect to each other.