Granted Patent B2

US 12,563,079 · App. 18/279,858 · Granted Feb 24, 2026

Inventors: Paolo Debenedetti (Albissola Marina, IT); Gaetano Patria (San Prisco, IT); Luca Baldini (Rome, IT); Giuseppe Celozzi (Naples, IT); Davide Massino (Genoa, IT); Daniele Gaito (Naples, IT)

Assignee: TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

H04L63/1433

Abstract

Claims (50)

1 . A method for determining a vulnerability level of a network node, the method comprising:

a master security management node obtaining security patch information regarding one or more security patches installed on the network node;

the master security management node using the security patch information to determine a first vulnerability value for the network node;

the master security management node obtaining a set of M other vulnerability values for the network node, wherein M is greater than 1 and each other vulnerability value was determined by a different security management node;

the master security management node determining, based on the set of M other vulnerability values, whether or not a consensus regarding the vulnerability level of the network node has been reached; and

as a result of determining that the consensus has been reached, the master security management node assigning the first vulnerability value to the network node.

2 . The method of claim 1 , wherein obtaining the security patch information comprises receiving a vulnerability level request message transmitted by the network node, the vulnerability level request message comprising the security patch information.

3 . The method of claim 2 , wherein a security wallet agent is stored on the network node and is configured to obtain the security patch information and transmit the vulnerability level request message.

4 . The method of claim 1 , further comprising

determining a reputation value for each security management node included in a group of security management nodes; and

using the reputation values to select from the group of security management nodes a particular one of the security management node to function as the master security management node.

5 . The method of claim 4 , further comprising reducing the reputation of the master security management node when the consensus has not been reached.

6 . The method of claim 1 , wherein

determining whether or not a consensus has been reached comprises:

determining whether at least a threshold number of the Mother vulnerability values is equal to the first vulnerability value, or

determining whether at least a threshold number of the M other vulnerability values is greater than the first vulnerability value, or

determining whether at least a threshold number of the M other vulnerability values is less than the first vulnerability value.

7 . The method of claim 6 , further comprising, as a result of determining that at least the threshold number of the M other vulnerability values is equal to the first vulnerability value, increasing a reputation of the master security management node.

8 . The method of claim 6 , further comprising, as a result of determining that at least the threshold number of the M other vulnerability values is greater than or less than the first vulnerability value, decreasing a reputation of the master security management node.

9 . The method of claim 6 , wherein the threshold number is equal to M/2+1.

10 . The method of claim 1 , wherein assigning the first vulnerability value to the network node comprises the master security management node recording the first vulnerability value in a first data store.

11 . The method of claim 10 , wherein assigning the first vulnerability value to the network node further comprises the master security management node triggering each different security management node to record the first vulnerability value in a different data store.

12 . The method of claim 11 , wherein triggering each different security management node to record the first vulnerability value in a different data store comprise broadcasting a message comprising the first vulnerability value and an identifier assigned to the network node.

13 . A non-transitory computer readable storage medium storing a computer program comprising instructions which when executed by processing circuitry of a security management node, causes the security management node to perform the method of claim 1 .

14 . The method of claim 1 , wherein

the method further comprises, as a result of determining that the consensus has been reached, determining whether or not the first vulnerability value is valid, and

determining whether or not the first vulnerability value is valid comprises determining whether the first vulnerability value is greater than a threshold or determining whether the first vulnerability value is not less than a threshold.

15 . The method of claim 14 , wherein

the master security management node assigns the first vulnerability value to the network node based on a determination that the first vulnerability value is valid.

16 . The method of claim 1 , wherein the method further comprises, as a result of determining that the consensus has been reached, increasing a reputation value of the master security management node.

17 . A security management node, the security management node comprising:

processing circuitry; and

a memory, the memory containing instructions executable by the processing circuitry, whereby the security management node is operative to perform a method comprising:

obtaining security patch information regarding one or more security patches installed on a network node;

using the security patch information to determine a first vulnerability value for the network node;

obtaining a set of M other vulnerability values for the network node, wherein M is greater than 1 and each other vulnerability value was determined by a different security management node;

determining, based on the set of M other vulnerability values, whether or not a consensus regarding the vulnerability level of the network node has been reached; and

as a result of determining that the consensus has been reached, the master security management node assigning the first vulnerability value to the network node.

18 . The security management node of claim 17 , wherein obtaining the security patch information comprises receiving a vulnerability level request message transmitted by the network node, the vulnerability level request message comprising the security patch information.

19 . The security management node of claim 17 , wherein the method further comprises:

determining a reputation value for each security management node included in a group of security management nodes; and

using the reputation values to select from the group of security management nodes a particular one of the security management node to function as a master security management node.

20 . The security management node of claim 19 , wherein the method further comprises reducing the reputation of the master security management node when the consensus has not been reached.

21 . The security management node of claim 17 , wherein

determining whether or not a consensus has been reached comprises:

determining whether at least a threshold number of the M other vulnerability values is equal to the first vulnerability value, or

determining whether at least a threshold number of the M other vulnerability values is greater than the first vulnerability value, or

determining whether at least a threshold number of the Mother vulnerability values is less than the first vulnerability value.

22 . The security management node of claim 21 , wherein the method further comprises, as a result of determining that at least the threshold number of the Mother vulnerability values is equal to the first vulnerability value, increasing a reputation of a master security management node.

23 . The security management node of claim 21 , wherein the method further comprises, as a result of determining that at least the threshold number of the M other vulnerability values is greater than or less than the first vulnerability value, decreasing a reputation of the security management node.

Assignments (1)

Continuity (1)

References Cited (19)