Patent Application
20210126937
Some embodiments disclosed herein relate to computing elements and, more particularly, to cyber-security improvement platform that utilizes a secure, distributed transaction ledger.
A computing element (e.g., a cloud-based software application or an industrial control system) may be the subject of a cyber-attack. For example, the computing element might encounter a computer virus, worm, Trojan horse, etc. Such attacks may cause significant financial damage, release personal information, shut down the operation of a factory or business, etc. These types of attacks are often the result of unintentional vulnerabilities found in software code, Operating System (“OS”) files, etc. but identifying such vulnerabilities can be a time consuming and expensive task. Moreover, even after a vulnerability is identified, the creation of a fix to improve the cyber-security of the computing element can also be a difficult job (e.g., especially when there are a substantial number of identified vulnerabilities and/or the computing elements are unusually complete) and manually performing these functions may be impractical and inefficient. It would therefore be desirable to provide systems and methods to efficiently arrange cyber-security improvements for computing elements.
Some embodiments provide a system to facilitate cyber-security improvements. A cyber-security improvement platform database may store electronic records including information, received from remote submitting devices, associated with vulnerability data for computing elements. Information associated with first vulnerability data for a first computing element may be retrieved from the database and verified. Information about the first vulnerability data may then be recorded in a secure, distributed transaction ledger, and a crypto-currency payment may be transferred in connection with the recorded information. Similarly, the electronic records may further include fix data for computing elements. In this case, first fix data associated with the first vulnerability data may be retrieved, verified, and applied in connection with the first computing element. Additional information, about the first fix data, may then be recorded in the transaction ledger and an additional crypto-currency payment may be transferred in connection with the recorded additional information.
Some embodiments comprise: means for retrieving, from a cyber-security improvement platform database, first fix data associated with a first computing element, wherein the cyber-security improvement platform database stores electronic records including information, received from remote submitting devices, associated with fix data for computing elements; means for verifying the first fix data; means for arranging for the first fix data to be applied in connection with the first computing element; and means for recording information about the first fix data in the secure, distributed transaction ledger, wherein a crypto-currency payment is transferred in connection with the recorded information.
Some embodiments comprise means for retrieving, by a cyber-security improvement platform computer processor, information associated with first vulnerability data associated with the first fix data from a cyber-security improvement platform database; means for verifying the first vulnerability data; and means for recording additional information about the first vulnerability data in the secure, distributed transaction ledger, wherein an additional crypto-currency payment is transferred in connection with the recorded additional information.
Technical effects of some embodiments of the invention are improved ways to efficiently arrange cyber-security improvements for computing elements. With these and other advantages and features that will become hereinafter apparent, a more complete understanding of the nature of the invention can be obtained by referring to the following detailed description and to the drawings appended hereto.
In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of embodiments. However, it will be understood by those of ordinary skill in the art that the embodiments may be practiced without these specific details. In other instances, well-known methods, procedures, components and circuits have not been described in detail so as not to obscure the embodiments.
One or more specific embodiments of the present invention will be described below. In an effort to provide a concise description of these embodiments, all features of an actual implementation may not be described in the specification. It should be appreciated that in the development of any such actual implementation, as in any engineering or design project, numerous implementation-specific decisions must be made to achieve the developers' specific goals, such as compliance with system-related and business-related constraints, which may vary from one implementation to another. Moreover, it should be appreciated that such a development effort might be complex and time consuming, but would nevertheless be a routine undertaking of design, fabrication, and manufacture for those of ordinary skill having the benefit of this disclosure.
It may generally be desirable to efficiently arrange cyber-security improvements for computing elements.
Some embodiments described herein may improve cyber-security using a secure, distributed transaction ledger (e.g., blockchain)—but not in the traditional way of securing events and data in the chain. Instead, some embodiments use the incentive of a crypto-currency that is based on improving the cyber-security quality software and associated infrastructure. For example, blockchain and crypto-currency technologies may be brought together with the security community to form a new crypto-currency that not only secures transactions but may also improve the cyber-security stance of existing software infrastructure. To accomplish this, a new crypto-currency may be built on distributed ledger technology and replace the typical class of “Proof of Work” consensus algorithms used by other currencies with an algorithm that incentivizes reduction of software vulnerabilities.
Note that BITCOIN® and other public blockchains have become popular because they offer alternative approaches to securing transactions. Moreover, this can be accomplished in a decentralized manner (and with varying levels of autonomy). BITCOIN® in particular has gained a lot of attention because of the way it incentives the securing of its distributed ledger through the use of what is called a Bitcoin. A Bitcoin is a financial instrument or crypto-currency that has a value that (like other currencies) may rise or fall in value. A Bitcoin can be purchased like many currencies or it can be earned by what is called “mining.” The result of this mining is the execution of a consensus algorithm that guards against three types of attack that might assail the distributed ledger. The first protection it provides is Byzantine Fault Tolerance (where some number of nodes in the distributed ledger network go rogue and try to modify the ledger in a way that doesn't reflect the transactions that have been legitimately applied). Second, mining lets any node participate (and no identity required). Third, mining provides a means to protect against spam or denial of service attacks. This type of approach is referred to as a Proof of Work consensus algorithm (although in the case of Bitcoin the algorithm is computationally difficult, but the results aren't useful for any other purpose). In fact, there are other approaches which are not nearly as wasteful and are computationally more efficient at securing the distributed ledger (but don't necessarily prevent spamming and denial of service attack protection as effectively). Some embodiments described herein offer protection and get useful, reusable work from a similar system.
Improving cyber-security for computational systems is a complex topic and there is a need for methods to identify software vulnerabilities quickly, patch or “fix” them, and verify those patches. Doing this, however, can be a difficult and thankless job. Researchers spend a lot of time looking for these vulnerabilities but don't get much reward for this effort. Embodiments described herein may incentivize more people to look for such improvements (and to verify and fix any vulnerabilities that are discovered). For example, the cyber-security improvement system 200 of
The cyber security improvement platform 250 may access information in a data store 220 and/or facilitate the provisional of displays via a Graphical User Interface (“GUI”) 230. The data store 220 might include, for example, electronic data records associated with computing elements 210, including software code, operating specification, circuit designs, etc. By way of an example only, the cyber-security improvement platform 250 might be associated with an application developer, an industry committee, etc.
According to some embodiments, the cyber-security improvement platform 250 records vulnerability and fix data in the secure, distributed transaction ledger 290. For example, the cyber-security improvement platform 250 might record a security flaw or bug, a patch to address a known security problem, or the like via the secure, distributed transaction ledger 290 in accordance with any of the embodiments described herein. The transaction ledger 290 might be associated with, for example, blockchain technology that can be verified via a remote operator or administrator device. According to some embodiments, the distributed transaction ledger might be associated with the HYPERLEDGER® blockchain verification system. According to some embodiments, the transaction ledger 290 may also facilitate cyber-currency payments to submitting devices 240 and/or the improvement platform 250 in exchange for their service.
Note that the platform 250 could be completely de-centralized and/or might be associated with a third party, such as a vendor that performs a service for an enterprise. According to some embodiments, submitting devices 240 might directly access the computing elements 210 to look for problems (as illustrated by the dotted arrow in
The cyber-security improvement platform 250 and/or submitting devices 240 might be, for example, associated with a Personal Computer (“PC”), laptop computer, a tablet computer, a smartphone, an enterprise server, a server farm, and/or a database or other storage devices. According to some embodiments, an “automated” cyber-security improvement platform 250 may automatically record vulnerability and fix information in the transaction ledger 290 via a blockchain verification process. As used herein, the term “automated” may refer to, for example, actions that can be performed with little (or no) intervention by a human.
As used herein, devices, including those associated with the cyber-security improvement platform 250 and any other device described herein, may exchange information via any communication network which may be one or more of a Local Area Network (“LAN”), a Metropolitan Area Network (“MAN”), a Wide Area Network (“WAN”), a proprietary network, a Public Switched Telephone Network (“PSTN”), a Wireless Application Protocol (“WAP”) network, a Bluetooth network, a wireless LAN network, and/or an Internet Protocol (“IP”) network such as the Internet, an intranet, or an extranet. Note that any devices described herein may communicate via one or more such communication networks.
The platform 250 may store information into and/or retrieve information from data stores. The data stores might, for example, store electronic records representing prior transactions, transactions currently in process, digital events, etc. The data stores may be locally stored or reside remote from the platform 250. Although a single cyber-security improvement platform 250 and secure, distributed transaction ledger 290 are shown in
Note that the system 200 of
At S310, a cyber-security improvement platform computer processor may retrieve information associated with first vulnerability data associated with a first computing element from a cyber-security improvement platform database. The first computing element might be associated with, for example, a software element, a hardware element, and a network element, etc. At S320, the first vulnerability data may be verified. For example, the system may determine that an application does, in fact, have the security flaw that was reported by a submitting device (e.g., via web portal).
At S330, the system may record information about the first vulnerability data in a secure, distributed transaction ledger (e.g., via blockchain). Note that the a blockchain ledger might be controlled by a single, centralized entity or by multiple, distributed entities. According to some embodiments, a crypto-currency payment is transferred in connection with the recorded additional information (e.g., a submitter may be rewarded for discovering a network vulnerability). Note that the information recorded in the secure, distributed transaction ledger may represent a Proof of Work algorithm.
At S340, the system may retrieve, from a cyber-security improvement platform database, first fix data associated with the first vulnerability and verify the first fix data at S350. For example, the system may verify that the proposed fix actually removes the cyber-security vulnerability. At S360, the system may arrange for the first fix data to be applied in connection with the first computing element (e.g., by releasing a patch or updated software version). At S370, the system recording information about the first fix data in the secure, distributed transaction ledger. Again, a crypto-currency payment may be transferred in connection with the recorded information (e.g., tor reward the person who authored the proposed fix). According to some embodiments, an entity associated with the cyber-security improvement platform also receives a crypto-currency payment (e.g., in exchange for facilitating the process).
According to some embodiments, the cyber-security improvement platform computer processor also performs a duplicate vulnerability data check and/or a duplicate fix data check (e.g., to avoid unnecessary re-work). In some cases, the cyber-security improvement platform computer processor automatically verifies the first fix data and in other cases it may use human assistance to verify the first fix data (and might utilze a consensus of a plurality of humans, such as a panel of experts). In either case, an evaluation of multiple fixes that all address a single vulnerability might be performed to select (and reward) the “best” fix. Similarly, human assistance might be utilized to verify the first vulnerability data.
According to some embodiments, the cyber-security improvement platform 450 records vulnerability and fix data in the blockchain 490. For example, the cyber-security improvement platform 450 might record a security flaw or bug, a patch to address a known security problem, or the like via the blockchain 490 in accordance with any of the embodiments described herein. The cyber-security improvement platform 450 and/or blockchain 490 might be, for example, verified or adjusted via a remote operator or administrator device 470. According to some embodiments, the transaction ledger 490 may also facilitate cyber-currency payments to submitting devices 440 and/or the improvement platform 450 in exchange for their service.
Embodiments described herein may comprise a tool to help provide cyber-security improvements and may be implemented using any number of different hardware configurations. For example,
The processor 910 also communicates with a storage device 930. The storage device 930 may comprise any appropriate information storage device, including combinations of magnetic storage devices (e.g., a hard disk drive), optical storage devices, mobile telephones, and/or semiconductor memory devices. The storage device 930 stores a program 912 and a cyber-security improvement engine 914 for controlling the processor 910. The processor 910 performs instructions of the programs 912, 914, and thereby operates in accordance with any of the embodiments described herein. For example, the processor 910 may access electronic records including information, received from remote submitting devices, associated with vulnerability data for computing elements. For example, information associated with first vulnerability data for a first computing element may be retrieved from the database and verified. Information about the first vulnerability data may then be recorded by the processor 910 in a secure, distributed transaction ledger, and a crypto-currency payment may be transferred in connection with the recorded information. Similarly, the electronic records may further include fix data for computing elements. In this case, first fix data associated with the first vulnerability data may be retrieved by the processor 910, verified, and applied in connection with the first computing element. Additional information, about the first fix data, may then be recorded by the processor 910 in the transaction ledger and an additional crypto-currency payment may be transferred in connection with the recorded additional information.
The program 912 may be stored in a compressed, compiled, uncompiled and/or encrypted format. The program 912 may furthermore include other program elements, such as an operating system, a database management system, and/or device drivers used by the processor 910 to interface with peripheral devices.
As used herein, information may be “received” by or “transmitted” to, for example: (i) the platform 900 from another device; or (ii) a software application or module within the platform 900 from another software application, module, or any other source.
In some embodiments (such as shown in
Referring to
The cyber-security improvement identifier 1002 may be, for example, a unique alphanumeric code identifying a specific vulnerability and/or fix that has been identified by the system (and might further include a computing element identifier). The vulnerability identifier 1004 might comprise a pointer or link to a description of a discovered software flaw. The fix identifier 1006 might include code, diagrams, protocol changes, etc. that correct the security flaw. The verified indication 1008 indicates whether a system (or person) was verified that the reported problem and/or solution do, in fact, exist. The date and time 1010 may indicate when the improvement was last updated, and the payment 1012 might indicate an amount of crypto-currency that the provided in exchange for the improvement (as well as who received the payment. The indication of whether or not the improvement was recorded via a blockchain transaction ledger 1014 might indicate that the improvement was recorded, is currently pending, etc.
Thus, embodiments may enable a decentralized verification and increase the number of investigators focused on cyber-security. Embodiments may also provide incentives for disclosure of such vulnerabilities and improve responsiveness. Further note that embodiments may provide a revenue stream for companies to secure all software (not just their own) and result in higher quality computing elements at a lower overall cost.
Embodiments may be associated with any type of distributed transaction ledger having a de-centralized consensus-based network, including those that support smart contracts, digital assets, record repositories, and/or cryptographic security. For example,
The following illustrates various additional embodiments of the invention. These do not constitute a definition of all possible embodiments, and those skilled in the art will understand that the present invention is applicable to many other embodiments. Further, although the following embodiments are briefly described for clarity, those skilled in the art will understand how to make any changes, if necessary, to the above-described apparatus and methods to accommodate these and other embodiments and applications.
Note that the processes described herein might be applicable in other security improvement environments. For example, an improvement platform might improve physical security at an airport, jail, school, etc. Although specific hardware and data configurations have been described herein, note that any number of other configurations may be provided in accordance with embodiments of the present invention (e.g., some of the information described herein may be combined or stored in external systems). Moreover, although embodiments have been described with respect to transaction information processing system, note that embodiments might be associated with other types of processing systems in general. Similarly, the displays shown and described herein are provided only as examples, and other types of displays and display devices may support any of the embodiments. For example,
The present invention has been described in terms of several embodiments solely for the purpose of illustration. Persons skilled in the art will recognize from this description that the invention is not limited to the embodiments described, but may be practiced with modifications and alterations limited only by the spirit and scope of the appended claims.
