EP4720899A1 - Method of operating a protected computing system and a system therefor - Google Patents

Method of operating a protected computing system and a system therefor

Info

Publication number
EP4720899A1
EP4720899A1 EP24718256.1A EP24718256A EP4720899A1 EP 4720899 A1 EP4720899 A1 EP 4720899A1 EP 24718256 A EP24718256 A EP 24718256A EP 4720899 A1 EP4720899 A1 EP 4720899A1
Authority
EP
European Patent Office
Prior art keywords
credentials
computing system
protected computing
account
unique set
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
EP24718256.1A
Other languages
German (de)
French (fr)
Inventor
Pushpinder CHOUHAN
Behnam Azvine
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
British Telecommunications PLC
Original Assignee
British Telecommunications PLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by British Telecommunications PLC filed Critical British Telecommunications PLC
Publication of EP4720899A1 publication Critical patent/EP4720899A1/en
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2127—Bluffing

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

A computer-implemented method (200) for monitoring security of a credential-based protected computing system (130), said method comprising the steps of: identifying a protected computing system requiring credentials so as to access said protected computing system (210); generating a unique set of credentials for accessing the protected computing system (220); registering an account for the protected computing system using the unique set of credentials; storing, in a database, a mapping between the: protected computing system; account; and registered set of credentials; monitoring for publication of the unique set of credentials (230); detecting publication of the registered unique set of credentials; and determining, in response to said detecting, a breach of the protected computing system associated with the registered unique set of credentials (250).

Description

METHOD OF OPERATING A PROTECTED COMPUTING SYSTEM AND A SYSTEM THEREFOR
Field of Invention
The present invention relates to a method for monitoring security of a credential-based protected computing system, and to a system therefor.
Background
Authentication is a process that includes validating that who you are is who you claim to be, and may performed to grant an authorised user access to a protected computing system (e.g. device, website, server, application, etc.)
In general, there are four human authentication techniques: ‘what-you-know’ (knowledge-based password, PIN, passphrase, etc); ‘what-you-have’ (token-based, card ID, document, etc); ‘what- you-are’ (biometrics, fingerprint, iris scan, etc); and ‘what-you-recognise’ (recognition-based keystroke dynamic, signature pattern, etc).
Typically, ‘what-you-know’ authentication (which relies on secrecy) is the least resource-intensive authentication technique, and therefore the easiest to implement. However, credentials (e.g. usernames and passwords) are vulnerable to theft, such as through deception techniques, which may include phishing scams. Occasionally, stolen credentials are illicitly published, which may be used to gain access to protected computing systems.
Users typically reuse the same credentials across different protected computing systems (e.g. devices, websites, applications, etc.). As such, if credentials for a given protected computing system are compromised, then a malicious actor may access more than just the given system using the compromised credentials, and instead all protected computing systems where the credentials are reused.
Having an up-to-date understanding of the security of a protected computing system is invaluable for assessing whether, and how, to utilise the protected computing system. However assessing security is complex.
It is an aim of the present invention to at least alleviate some of the aforementioned problems.
Statements of Invention According to a first aspect of the present invention, there is provided: a computer-implemented method for monitoring security of a credential-based protected computing system, said method comprising the steps of: identifying a protected computing system requiring credentials so as to access said protected computing system; generating a unique set of credentials, by modifying user-input credentials, for accessing the protected computing system; registering an account for the protected computing system using the unique set of credentials; storing, in a database, a mapping between the: protected computing system; account; and registered set of credentials; monitoring for publication of the unique set of credentials; detecting publication of the registered unique set of credentials; and determining, in response to said detecting, a breach of the protected computing system associated with the registered unique set of credentials.
Preferably, the method further comprises the step of generating the unique set of credentials by determining uniqueness of said credentials from a comparison of credentials stored in the database. Preferably, the set of credentials are alphanumeric. Preferably, the set of credentials are universally unique; that is, the set of credentials are unique for all users, user accounts, and/or protected computing systems. Optionally, monitoring the unauthorised publication is performed in response to identifying a security breach of the system. Optionally, the method further comprises the step of increasing the security score in response to an absence of unauthorised publication of the unique set of credentials within a predefined period of time. Optionally, the method further comprises the step of aggregating the security score for a plurality of protected computing systems, thereby to determine an entity security score for an owner, operator, manufacturer and/or administrator of each of the plurality of protected computing systems. Preferably, the credentials comprises a username or identifier and a password, passcode and/or PIN. Optionally, the username and/or the password, passcode and/or PIN is/are unique.
Preferably, the protected computing system is in the form of a/an: website; device; server; database; and/or application. Preferably, the publication of the set of credentials is unauthorised, which may be determined from the source of the publication (e.g. dark web). Preferably, the account is operated by a user and/or the unique set of credentials are stored on a device operated by said user.
Preferably, the method further comprises the step of lowering, in response to determining the breach of the protected computing system, a security score for the protected computing system.
Preferably, the account is a deception account. As used herein, a “deception account” preferably connotes an account used for the principle (or sole) purpose of testing security, and monitoring comprise, of the associated protected computing system, rather than being used by a user and as intended by the protected computing system (e.g. for administration, storage, communication, service access, etc.). The “deception account” may alternatively be referred to as a “honeypot account”, “decoy account”, “bait account”, “trap account” and/or “lure account”. Preferably, the account comprises a plurality of deception accounts, each having associated unique credentials. Preferably, registering the account is performed automatically, without user operation and intervention.
Preferably, the protected computing system is a device, wherein the method further comprises the step of running a virtualisation of said device and then registering the account on said virtualisation. Preferably, the method further comprises the step of accessing the account and protected computer system using said virtualisation. Preferably, the virtualisation is run on a server, and optionally a cloud server.
Preferably, the unique set of credentials comprises a plurality of unique credentials, wherein the account is accessible using any of said unique credentials. Preferably, said protected computing system permits multi-user credentials or shared accounts. Preferably, the account consists only of a single account.
Optionally, the user-input credentials comprise knowledge-based, token-based, biometric, and/or recognition-based credentials. Preferably, the unique set of credentials is generated by combining any of the knowledge-based, token-based, biometric, and/or recognition-based credentials. Optionally, said modifying and/or combining comprises a cryptographic process and/or a hashing function. Preferably, generating the set of credentials is performed by inspecting the database and generating the set of credentials so as to be unique over all entries in the database. Preferably, generating the set of credentials is performed such that said credentials exceed a minimum length and/or complexity requirement, thereby to have a sufficiently high probability of being universally unique.
Preferably, the unique set of credentials is generated without user operation and intervention. Preferably, the method further comprises the step of taking a security remediation action in response to identifying publication of the unique set of credentials.
Preferably, the remediation action comprises alerting an entity of the determined breach of the protected computing system. Preferably, the remediation action comprises alerting an entity of the lowered security score. Preferably, said entity comprises: a, the, or each user of the protected computing system; an owner of the protected computing system; and/or an operator of the protected computing system. Preferably, the remediation action comprises blocking access to and/or use of the protected computing system. Preferably, blocking access comprises blacklisting the protected computing system; and/or deactivating (e.g. uninstalling) the protected computing system. Preferably, said blocking is performed for the account. Preferably, said blocking access is performed using a network reconfiguration of the protected computing system. Preferably, said remediation action comprises: alerting the user; increasing a security requirement for the user; preventing use of the, or other, account/s, device/s and/or secure computing system/s by the user.
Preferably, the remediation action comprises reconfiguring the protected computing system. Preferably, said reconfiguring comprises: updating software and/or firmware associated with the protected computing system; and/or changing the set of credentials. Preferably, the database is updated in response to changing the set of credentials.
Preferably, the steps of identifying, generating, registering, storing, monitoring, detecting, and/or determining are performed by a computing system other than the protected computer system. Preferably, said computing system is separate to, independent of, and/or remote from, the protected computer system. Accordingly, the computing system may interact with the protected computer system via an Application Programming Interface.
According to another aspect of the invention, there is provided a computer-readable carrier medium comprising a computer program, which, when the computer program is executed by a computer, causes the computer to carry out the steps of any one of the afore-described methods.
According to yet another aspect of the invention, there is provided a computing system for monitoring security of a credential-based protected computing system, comprising: a protected computing system; a processor configured to: identify the protected computing system as requiring credentials so as to access said protected computing system; generating a unique set of credentials, by modifying user-input credentials, for accessing the protected computing system; registering an account for the protected computing system using the unique set of credentials; a database configured to store a mapping between the: protected computing system; account; and registered set of credentials; a controller configured to: monitor for publication of the unique set of credentials; detect publication of the registered unique set of credentials; and determine, in response to detecting the publication, a breach of the protected computing system associated with the registered unique set of credentials. Optionally, the database is provided remotely from the device, and is co-located with the processor. The invention includes any novel aspects described and/or illustrated herein. The invention also extends to methods and/or apparatus substantially as herein described and/or as illustrated with reference to the accompanying drawings. The invention is also provided as a computer program and/or a computer program product for carrying out any of the methods described herein and/or for embodying any of the apparatus features described herein, and a computer-readable medium storing thereon a program for carrying out any of the methods and/or for embodying any of the apparatus features described herein. Features described as being implemented in hardware may alternatively be implemented in software, and vice versa.
Any apparatus feature may also be provided as a corresponding step of a method, and vice versa. As used herein, means plus function features may alternatively be expressed in terms of their corresponding structure, for example as a suitably-programmed processor.
Any feature in one aspect of the invention may be applied, in any appropriate combination, to other aspects of the invention. Any, some and/or all features in one aspect can be applied to any, some and/or all features in any other aspect, in any appropriate combination. Particular combinations of the various features described and defined in any aspects of the invention can be implemented and/or supplied and/or used independently.
As used throughout, the word 'or' can be interpreted in the exclusive and/or inclusive sense, unless otherwise specified.
The invention extends to a method and a system as described herein and/or substantially as illustrated with reference to the accompanying drawings. The present invention is now described, purely by way of example, with reference to the accompanying diagrammatic drawings, in which: Figure 1 shows a schematic system for monitoring security of a protected computing system; and Figure 2 shows a process for monitoring security of a protected computing system.
Specific Description
Figure 1 schematically shows an exemplary computing system 100 comprising a/an: user 110; Credential Security System 120 (herein “CSS”); Protected Computing System 130 (herein “PCS”); telecommunications network 140; and a database 150.
The PCS 130 is a secure and credential-based network device (e.g. a smartphone, tablet, server, computer, laptop, loT device, router, smart device, etc.) and/or a network data system e.g. website, email, application, software, database, network connection, virtual machine or virtualisation of any aforementioned network device, etc.). The PCS 130 is available to be accessed via at least one user account that is associated with the user 110 (which represents at least one individual).
To access and/or use the PCS 130 e.g. by the user 1 10) and the associated user account, authentication is required using credentials; these credentials are, at least, knowledge-based, and comprise a password (and/or a PIN, passcode, etc.), and optionally also an identifier (e.g. a PIN, email, username, etc.). The user account of the PCS is available to be accessed using a set of only one credentials (i.e. one-to-one mapping of account-to-credentials), or using a set of a plurality of different credentials (i.e. one-to-many mapping of account-to-credentials), using so- called shared accounts.
The PCS 130 is configured to be accessed by the telecommunications network 140 and the CSS 120, and the PCS 130 is configured to access the telecommunications network 140 so as to access network services.
The telecommunications network 140 comprises a wide area network, and is available to comprise the Internet. In turn, the database 150 is accessible via the telecommunications network 140. For example, the database 150 forms part of a cloud-storage system or a network server. The database 150 is a known or suspected repository for leaked credentials for protected computing systems, such as those accessible via the so-called Dark Web.
As described in more detail below, the CSS 120 is configured to help identify compromised credentials for the PCS 130, thereby to help determine security of the PCS 130. Although Figure 1 shows only a single user and PCS, the CSS 120 is configured to interact with a plurality of users and PCSs, and the principles described below are extendable to any number of such users and PCSs.
The CSS 120 is in communication with the user 110, PCS 130 and the telecommunications network 140. The CSS 120 comprises a: Credentials and Account Generator 120-1 (CAG); Credentials and Account Database 120-2 (CAD); Credentials Monitor 120-3 (CM); and Protected Computing Systems Assessor 120-4 (PCSA). The CSS 120 is provided as part of a stand-alone tool, where each component of CSS is available to be deployed at premisses or in a cloud computing system. The CAG 120-1 is in communication with the CAD 120-2 and CM 120-3, and the CAG is configured automatically to generate unique credentials for the PCS 130, and then to register said credentials with the PCS, thereby to generate the user account for the user 1 10.
The CAG 120-1 is therefore configured to interface with the PCS 130, for example using an appropriate Application Programming Interface or automation (e.g. macro), so as to register the generated credentials with the PCS. In this way, the CAG is configured to register credentials generated for the PCS with the PCS, so that the PCS is then accessible using said generated credentials.
The user 1 10 is available to be a real human user or a nominal virtual user (or a “bot”). As such, the CAG 120-1 is operated using human inputs seeking to register with the PCS 130 or, where there is no human user, the user account is generated as a so-called “deception account”, having no real human user, and merely created to track compromised credentials.
The CAG 120-1 is configured to generate locally unique credentials that do not match existing credentials stored in the CAD 120-2 (as described in more detail below). Credentials generated by the CAG 120-1 are also generated so as to have a sufficiently high probability of being universally unique, by using sufficiently long and complex credentials (based on predetermined thresholds). In this way, the probability that published credentials for the PCS 130 are acquired through breach of the PCS, rather than by coincidentally matching credentials for another PCS, can be improved, thereby improving accuracy with which security of the PCS is measured.
Generation of credentials by the CAG 120-1 is available to be performed based on a seed provided by a human user e.g. a password from a human user), or without any human user input. For example, the automatic generation of credentials for the PCS 130 by the CAG 120-1 is performed using techniques as disclosed in: F. Al Maqbali and C. J. Mitchell, "AutoPass: An automatic password generator," 2017 International Carnahan Conference on Security Technology (ICCST), 2017, pp. 1-6, doi: 10.1109/CCST.2017.8167791 ; Yuhua Yin, Julian Jang- Jaccard, Nilufar Baghaei, Passlmg: A Secure Password Generation and Management Scheme without Storing, Proceedings of the 2022 IEEE 25th International Conference on Computer Supported Cooperative Work in Design, 2022; and M. Horsch, M. Schlipf, J. Braun, and J. A. Buchmann, “Password requirements markup language” in Proc. ACISP 2016, ser. LNCS, J. K. Liu and R. Steinfeld, Eds., vol. 9722. Springer-Verlag, 2016, pp. 426- 439, the contents of which are herein incorporated by reference. The CAD 120-2 is in communication with the CAG 120-1 , CM 120-3 and the PCSA 120-4. Once the CAG 120-1 detects that credentials are registered with the PCS 130, the CAG reports the registered credentials to the CAD 120-2. The CAD is configured to receive the registered credentials from the CAG and then to store said registered credentials in association with the PCS. Registered credentials and the associated PCS are stored in the form of a database. For example, Table 1 below illustrates an exemplary table of data forming a part of the CAD for a plurality of different users (identified as users “1 ”, “2”, “3”, “4”, “5”), and protected computing systems.
Table 1
With reference to Table 1 , protected computing system “Server Account 1 ” facilitates shared accounts, such that different users (/.e. “2” and “3”) can both access “Server Account 1 ” using different credentials, protected computing system “Device Account 1 ” is a virtual machine mimicking a real device, whereas protected computing system “Device Account 2” is provided on a real device, and both have credentials formed only of a password (and no username).
The information stored in the CAD 120-2 is therefore available automatically to login users, including the user 110, into a given protected computing system (e.g. user “1 ” into protected computing system “Email Account 1 ”) by retrieving the appropriate associated credentials. As such, the CSS 120 is available to be used as a password manager.
For security, contents of the CAD 120-2 are encrypted and/or segregated so as to ensure access by only authorised users.
By using universally unique credentials the CAD 120-2 is used to identify which user, user account and protected computing system may have been compromised (e.g. the leaked username and password “JDFH1957’ and “)5MAg{,Bh{m,Ot,e” suggests a breach of the user account of user “2” for protected computing system “Application Account 1 ”).
The CM 120-3 is configured to access the database 150 via the telecommunications network 140 and to search the database for publication of each of the credentials stored in the CAD. For example, such searching is performed using web scraping or harvesting processes.
As such, the CM 120-3 performs a comparison of registered credentials stored in the CAD 120-2 against credentials accessible from the database 150. When the CM 120-3 identifies credentials in the database that match registered credentials in the CAD 120-2, the CM identifies, at least, the registered credentials to the PCSA 120-4. For example, if CM 120-3 identifies the string “68465138:QBzV@B$rGq.tArUYaCqtarG62ld=cP’ in the database 150, then the CM alerts the PCSA 120-4 that protected computing system “Server Account 1 ” has been breached, and specifically the user account for user “2”.
The PCSA 120-4 is in communication with the CM 120-3 and the CAD 120-2, and is configured to take remedial action in response to identifying leaked registered credentials.
In response to the CM 120-3 identifying leaked registered credentials for the PCS 130, the PCSA 120-4 communicates an alert to the user associated (as determined from the CAD 120-2) with the leaked registered credentials. Furthermore, the CM is configured also to communicate an instruction to the CAG 120-1 to re-generate and then re-register new credentials for the PCS, and replaces the leaked registered credentials stored in the CAD with the re-registered new credentials. Still further, the PCSA 120-4 is configured to prevent user access to the PCS (and/or a corresponding PCS).
For each protected computing system, the PCSA 120-4 is also configured to calculate a security score by compiling statistics on instances of leaked registered credentials, as determined by the CM 120-3. In this way, security of each protected computing systems is trackable.
The security score for each protected computing system is stored in the PCSA 120-4. Using appropriate rules, the PCSA is then available to take different actions based on the associated security score.
Where the security score of a protected computing system is below a threshold value, then the PCSA 120-4 is configured to: deny the CAG 120-1 from registering a user account for said protected computing system; require more stringent authentication for accessing the protected computing system; and/or enforce additional security policies when accessing the protected computing system.
In this way, there is provided a feedback mechanism such that the CSS 120 is configured to measure security of protected computing systems by detecting breaches, and then to establish proportionate levels of security for accessing each protected computing system in the future.
Figure 2 shows a process 200 in which the system 100 is operated to detect and assess credential theft and distribution by an adversary for the PCS 130.
At a first step 210, the PCS 130 is identified to the CSS 120 as requiring credentials for accessing PCS by the user 110. Identification of the PCS is, for example, provided by the user or by the CSS (e.g. when instantiating the PCS by the CSS, for example as a virtual device for a deception account).
At a next step 220, for the user 110 and the identified PCS 130, the CAG 120-1 generates unique credentials (based on an inspection of credentials stored in the CAD 120-2) that are compliant with the requirements of the PCS e.g. as determined using Password Requirements Markup Language, PRML, and Username Requirement Markup Language, URML), and then registers the credentials with the PCS, thereby generating a user account. The registered credentials are communicated by the CAG 120-1 to the CAD 120-2, and the registered credentials are then stored in the CAD in association with the PCS.
At a subsequent step 230, the CM 120-3 monitors the database 150 for disclosures of the registered credentials. A determination is made by the CM 120-3 whether the credentials have been disclosed 240. Steps 230 and 240 reiterate until a disclosure of the credentials is identified by the CM, which is then communicated to the PCSA 120-4.
At a final step 250, in response to receiving an input that the registered credentials have been disclosed, the PCSA 120-4 takes a remediation action in respect of the PCS 130 associated with the registered credentials (which is determined from the CAD 120-2).
As described above, the remediation action is available to include:
• generating and communicating a message alerting of the disclosure of the registered credentials, and therefore of a breach of the PCS 130, including communicating the alert to: the user 110; and/or an owner, administrator, operator and/or manufacturer of the PCS; • blocking the PCS 130, including: deactivating the PCS {e.g. powering-down, uninstallation, ceasing a virtualisation) and/or user account; and/or reconfiguring network setting to prevent access to or from the PCS {e.g. via a firewall blacklisting); and/or
• reconfiguring the PCS 130, including: updating software and/or firmware; and/or updating security policies.
The PCSA 120-4 also reduces the security score of the PCS 130 in response detecting disclosure of the registered credentials. The security score is then available to inform future use and configuration of the PCS 130. For example, where the security score is below a threshold value, then a remediation action is available to be taken in respect of the PCS and in respect of future attempts to register a user account with the PCS e.g. blocking such future registration), which is available to be escalated to higher-security actions with decreasing security score.
After step 240, the process is available to re-iterate to generate new unique credentials for the PCS.
Alternatives and Modifications
In an alternative, the PCSA 120-4, additionally or alternatively, monitors the relationship between compromised credentials and individual users. That is, the PCSA 120-4 calculates a security score of the user 1 10, which is reduced with instances of credential compromise. The PCSA 120- 4 is then configured to take tailored remedial action for each user based on their security score, for example by offering, or forcing, users with lower security scores to re-generate credentials more frequently, use more complex credentials and/or higher-standards of authentication, or to block access to a protected computing system 130 and/or certain network connections.
In an alternative, the step of calculating and lowering the security score (for the PCS and/or user) is optional, and instead the system 100 is used only to determine that a breach has occurred or to take a remediation action independently of calculating a security score.
Each feature disclosed herein, and (where appropriate) as part of the claims and drawings may be provided independently or in any appropriate combination.
Any reference numerals appearing in the claims are for illustration only and shall not limit the scope of the claims.

Claims

Claims
1. A computer-implemented method for monitoring security of a credential-based protected computing system, said method comprising the steps of: identifying a protected computing system requiring credentials so as to access said protected computing system; generating a unique set of credentials, by modifying user-input credentials, for accessing the protected computing system; registering an account for the protected computing system using the unique set of credentials; storing, in a database, a mapping between the: protected computing system; account; and registered set of credentials; monitoring for publication of the unique set of credentials; detecting publication of the registered unique set of credentials; and determining, in response to said detecting, a breach of the protected computing system associated with the registered unique set of credentials.
2. A method according to Claim 1 , further comprising the step of lowering, in response to determining the breach of the protected computing system, a security score for the protected computing system.
3. A method according to Claim 1 or 2, wherein the account is a deception account.
4. A method according to any preceding claim, wherein the protected computing system is a virtualisation of a device, and wherein the method further comprises the step of registering the account via said virtualisation.
5. A method according to any preceding claim, wherein the unique set of credentials comprises a plurality of unique credentials, wherein the account is accessible using any of said unique credentials.
6. A method according to any of preceding claim, wherein the unique set of credentials is generated without user operation and intervention.
7. A method according to any preceding claim, further comprising the step of taking a security remediation action in response to identifying publication of the unique set of credentials.
8. A method according to Claim 7, wherein the remediation action comprises alerting an entity of the determined breach of the protected computing system.
9. A method according to Claim 7 or 8, wherein the remediation action comprises blocking access to and/or use of the protected computing system.
10. A method according to any of Claims 7 to 9, wherein the remediation action comprises reconfiguring the protected computing system.
11. A method according to any preceding claim, wherein the steps of identifying, generating, registering, storing, monitoring, detecting, and/or determining are performed by a computing system other than the protected computer system.
12. A computer-readable carrier medium comprising a computer program, which, when the computer program is executed by a computer, causes the computer to carry out the steps of any one of the preceding claims.
13. A computing system for monitoring security of a credential-based protected computing system, comprising: a protected computing system; a processor configured to: identify the protected computing system as requiring credentials so as to access said protected computing system; generating a unique set of credentials, by modifying user-input credentials, for accessing the protected computing system; registering an account for the protected computing system using the unique set of credentials; a database configured to store a mapping between the: protected computing system; account; and registered set of credentials; a controller configured to: monitor for publication of the unique set of credentials; detect publication of the registered unique set of credentials; and determine, in response to detecting the publication, a breach of the protected computing system associated with the registered unique set of credentials.
EP24718256.1A 2023-05-31 2024-04-17 Method of operating a protected computing system and a system therefor Pending EP4720899A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
EP23176466 2023-05-31
PCT/EP2024/060384 WO2024245637A1 (en) 2023-05-31 2024-04-17 Method of operating a protected computing system and a system therefor

Publications (1)

Publication Number Publication Date
EP4720899A1 true EP4720899A1 (en) 2026-04-08

Family

ID=86646619

Family Applications (1)

Application Number Title Priority Date Filing Date
EP24718256.1A Pending EP4720899A1 (en) 2023-05-31 2024-04-17 Method of operating a protected computing system and a system therefor

Country Status (2)

Country Link
EP (1) EP4720899A1 (en)
WO (1) WO2024245637A1 (en)

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10474843B2 (en) * 2017-05-09 2019-11-12 International Business Machines Corporation Identifying stolen databases
US11461458B2 (en) * 2019-02-28 2022-10-04 SpyCloud, Inc. Measuring data-breach propensity
US11829509B2 (en) * 2021-07-15 2023-11-28 AVAST Software s.r.o. Data exfiltration detection

Also Published As

Publication number Publication date
WO2024245637A1 (en) 2024-12-05

Similar Documents

Publication Publication Date Title
US11700264B2 (en) Systems and methods for role-based computer security configurations
US20230353566A1 (en) Device Risk Level Based on Device Metadata Comparison
US9866568B2 (en) Systems and methods for detecting and reacting to malicious activity in computer networks
US20180307832A1 (en) Information processing device, information processing method, and computer readable medium
US11048792B2 (en) Risk based brute-force attack prevention
US9342696B2 (en) Attesting use of an interactive component during a boot process
EP2860657B1 (en) Determining a security status of potentially malicious files
CN112422527B (en) Threat assessment system, method and device for substation power monitoring system
US20260046296A1 (en) Security Threat Monitoring for Network-Accessible Devices
US8973113B1 (en) Systems and methods for automatically resetting a password
EP3874716B1 (en) Detecting and responding to attempts to gain unauthorized access to user accounts in an online system
DE102021127631A1 (en) PROCESS MONITORING BASED ON MEMORY SEARCH
US10848491B2 (en) Automatically detecting a violation in a privileged access session
CN108429746B (en) Privacy data protection method and system for cloud tenants
US8978150B1 (en) Data recovery service with automated identification and response to compromised user credentials
CN120415819A (en) A zero-trust data access control method, system and storage medium
EP4070521B1 (en) Autopilot re-enrollment of managed devices
US12021834B2 (en) Cumulative sum model for IP deny lists
CN118862098B (en) A system and method for detecting security vulnerabilities of open source components
EP4720899A1 (en) Method of operating a protected computing system and a system therefor
KR20200037518A (en) Hacking Defense Contest System That Evaluates Optimization of Vulnerability Patch
US20220156361A1 (en) Detecting and preventing unauthorized command injection
CN116567083B (en) Business data processing methods, devices, equipment and media
CN110602121B (en) Network key obtaining method and device and computer readable storage medium
CN115118456B (en) A method and device for determining unknown attacks on intranet web applications

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20251119

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR