Granted Patent B2

US 12,615,283 · App. 18/416,368 · Granted Apr 28, 2026

Inventors: Shlomo Yanay (Rockville, MD); Ankur Panchbudhe (Maharashtra, IN)

Assignee: AUTHMIND INC.

H04L63/1441G06N20/00H04L63/0457H04L63/083H04L63/102H04L63/20

Abstract

Claims (72)

1 . A method comprising:

monitoring dataflow streams in a network comprising multiple computing nodes;

determining network security characteristics for a dataflow stream, from the monitored dataflow streams, relating to security, authentication, and access events for accessing, via the dataflow stream, one or more of the multiple nodes of the network; and

determining potential violations by the dataflow stream of one or more security policies defined for operation of the network, access functionality for the network, or identity attributes used by the network, based, at least in part, on the determined network security characteristics for the dataflow stream, and based on network-operation data comprising one or more of network security data, network identity data, and network access data, with the network-operation data being stored in one or more data storage units in the network, and configured to control network access and operation for the multiple computing nodes of the network, including to perform one or more: validate requests from users to access any of the multiple nodes, or determine violations of security policies by data flows corresponding to the requests from the users;

wherein the network-operation data stored in the one or more data storage units in the network is stored in one or more network-operation data directories implemented in the network, and wherein determining the potential violations by the dataflow stream comprises:

analyzing, by a sensor configured to monitor the dataflow streams, based, in part, on the network-operation data retrieved by the sensor from the one or more network-operation data directories, an access request associated with the dataflow stream to validate the access request in response to determining that one or more of the access request or the associated dataflow stream do not violate security policies associated with the network,

determining a set of services from services identified in the network-operation data stored on the one or more network operation data directories, for which the validated access request meets respective security requirements for each service in the determined set of services, and

authorizing, by another sensor, two or more network services in the set of services that the validated access request is granted access to.

2 . The method of claim 1 , wherein the network operation data comprises data relating to one or more of: user authentication and authorization information for a plurality of users accessing the network, the identity and access security policies, user identification information for the plurality of users, or node information relating to characteristics of the multiple computing nodes of the network.

3 . The method of claim 1 , wherein monitoring the dataflow streams comprises:

deriving map data of at least some of the monitored dataflow streams in the network, including deriving path and access information, for the at least some of the monitored dataflow streams, between respective groups of nodes in the network.

4 . The method of claim 3 , further comprising:

generating, based on one or more of the map data, the network operation data, the determined network security characteristics, or the determined potential violations, a dynamic graph representative of dataflow access activity, at any particular time instance, within the network, the dynamic graph including information representative of one or more of: i) a number of the at least some of the monitored dataflow streams, ii) classes of destination nodes being accessed by the at least some of the multiple nodes, or iii) information representative of potential violations by the at least some of the multiple nodes of the security policies of the network.

5 . The method of claim 1 , further comprising:

performing one or more mitigation actions in response to a determination of a security policy violation by the dataflow stream.

6 . The method of claim 5 , wherein performing the one or more mitigation actions comprises one or more of:

a) sending a notification to the user associated with the dataflow stream or one or more of the nodes to establish new security credentials for accessing one or more of the multiple computing nodes of the network;

b) suspending access of the user associated with the dataflow stream;

c) establishing a multi-factor authentication procedure for the dataflow stream or for the user associated with the dataflow stream;

d) randomizing a password of the user;

e) modifying access privileges of the user to services and one or more of the multiple computing nodes on the network;

f) modifying security parameters for the one or more of the multiple computing nodes; or

g) modifying security parameters of the network.

7 . The method of claim 1 , wherein determining the network security characteristics comprises:

determining the security characteristics using one or more learning and artificial intelligence-based engines.

8 . The method of claim 1 , wherein the network includes one or more portals to manage network access between the network and remote nodes associated with different one or more networks, and wherein determining the potential violations by the dataflow stream comprises:

identifying unmanaged access between one of the remote nodes and one of the multiple computing nodes of the network that bypasses the one or more portals.

9 . The method of claim 1 , wherein determining potential violations by the dataflow stream of one or more security policies comprises one or more of:

determining whether an identity access was initiated from a real user account or from a machine-run service/robo account;

determining anomalous behavior associated with an access attempt of the network;

determining that user-attempted access of a service implemented on the network requires credential randomization for an accessing user; or

determining existence of dormant and forgotten accounts.

10 . A system comprising:

a network comprising multiple computing nodes; and

processor-based circuitry configured to:

monitor dataflow streams in the network;

determine network security characteristics for a dataflow stream, from the monitored dataflow streams, relating to security, authentication, and access events for accessing, via the dataflow stream, one or more of the multiple computing nodes of the network; and

determine potential violations by the dataflow stream of one or more security policies defined for operation of the network, access functionality for the network, or identity attributes used by the network, based, at least in part, on the determined network security characteristics for the dataflow stream, and based on network-operation data comprising one or more of network security data, network identity data, and network access data, with the network-operation data being stored in one or more data storage units in the network, and configured to control network access and operation for the multiple computing nodes of the network, including to perform one or more: validate requests from users to access any of the multiple nodes, or determine violations of security policies by data flows corresponding to the requests from the users;

wherein the network-operation data stored in the one or more data storage units in the network is stored in one or more network-operation data directories implemented in the network, and wherein the processor-based circuitry configured to determine the potential violations by the dataflow stream is configured to:

analyze, by a sensor configured to monitor the dataflow streams, based, in part, on the network-operation data retrieved by the sensor from the one or more network-operation data directories, an access request associated with the dataflow stream to validate the access request in response to determining that one or more of the access request or the associated dataflow stream do not violate security policies associated with the network,

determine a set of services from services identified in the network-operation data stored on the one or more network operation data directories, for which the validated access request meets respective security requirements for each service in the determined set of services, and

authorize, by another sensor, two or more network services in the set of services that the validated access request is granted access to.

11 . The system of claim 10 , wherein the network operation data comprises data relating to one or more of: user authentication and authorization information for a plurality of users accessing the network, the identity and access security policies, user identification information for the plurality of users, or node information relating to characteristics of the multiple computing nodes of the network.

12 . The system of claim 10 , wherein the processor-based circuitry configured to monitor the dataflow streams is configured to:

derive map data of at least some of the monitored dataflow streams in the network, including deriving path and access information, for the at least some of the monitored dataflow streams, between respective groups of nodes in the network.

13 . The system of claim 12 , wherein the processor-based circuitry is further configured to:

generate, based on one or more of the map data, the network operation data, the determined network security characteristics, or the determined potential violations, a dynamic graph representative of dataflow access activity, at any particular time instance, within the network, the dynamic graph including information representative of one or more of: i) a number of the at least some of the monitored dataflow streams, ii) classes of destination nodes being accessed by the at least some of the multiple nodes, or iii) information representative of potential violations by the at least some of the multiple nodes of the security policies of the network.

14 . The system of claim 10 , wherein the processor-based circuitry is further configured to:

perform one or more mitigation actions in response to a determination of a security policy violation by the dataflow stream.

15 . The system of claim 14 , wherein the processor-based circuitry configured to perform one or more mitigation actions is configured to perform one or more of:

a) send a notification to the user associated with the dataflow stream or one or more of the nodes to establish new security credentials for accessing one or more of the multiple computing nodes of the network;

b) suspend access of the user associated with the dataflow stream;

c) establish a multi-factor authentication procedure for the dataflow stream or for the user associated with the dataflow stream;

d) randomize a password of the user;

e) modify access privileges of the user to services and one or more of the multiple computing nodes on the network;

f) modify security parameters for the one or more of the multiple computing nodes; or

g) modify security parameters of the network.

16 . The system of claim 10 , wherein the processor-based circuitry configured to determine the network security characteristics is configured to:

determine the security characteristics using one or more learning and artificial intelligence-based engines.

17 . The system of claim 10 , wherein the network includes one or more portals to manage network access between the network and remote nodes associated with different one or more networks, and wherein the processor-based circuitry configured to determine the potential violations by the dataflow stream is configured to:

identify unmanaged access between one of the remote nodes and one of the multiple computing nodes of the network that bypasses the one or more portals.

18 . Non-transitory computer-readable media comprising computer instructions executable on one or more processor-based circuitries to:

monitor dataflow streams in a network comprising multiple computing nodes;

determine network security characteristics for a dataflow stream, from the monitored dataflow streams, relating to security, authentication, and access events for accessing, via the dataflow stream, one or more of the multiple nodes of the network; and

determine potential violations by the dataflow stream of one or more security policies defined for operation of the network, access functionality for the network, or identity attributes used by the network, based, at least in part, on the determined network security characteristics for the dataflow stream, and based on network-operation data comprising one or more of network security data, network identity data, and network access data, with the network-operation data being stored in one or more data storage units in the network, and configured to control network access and operation for the multiple computing nodes of the network, including to perform one or more: validate requests from users to access any of the multiple nodes, or determine violations of security policies by data flows corresponding to the requests from the users;

wherein the network-operation data stored in the one or more data storage units in the network is stored in one or more network-operation data directories implemented in the network, and wherein the computer instructions to determine the potential violations by the dataflow stream include one or more instructions to:

analyze, by a sensor configured to monitor the dataflow streams, based, in part, on the network-operation data retrieved by the sensor from the one or more network-operation data directories, an access request associated with the dataflow stream to validate the access request in response to determining that one or more of the access request or the associated dataflow stream do not violate security policies associated with the network,

determining a set of services from services identified in the network-operation data stored on the one or more network operation data directories, for which the validated access request meets respective security requirements for each service in the determined set of services, and

authorize, by another sensor, two or more network services in the set of services that the validated access request is granted access to.

19 . The non-transitory computer-readable media of claim 18 , wherein the network operation data comprises data relating to one or more of: user authentication and authorization information for a plurality of users accessing the network, the identity and access security policies, user identification information for the plurality of users, or node information relating to characteristics of the multiple computing nodes of the network.

20 . The non-transitory computer-readable media of claim 18 , wherein the computer instructions to determine the network security characteristics include one or more computer instructions to:

determine the security characteristics using one or more learning and artificial intelligence-based engines.

Assignments (1)

Continuity (3)

References Cited (14)