Granted Patent B2

US 12,647,449 · App. 18/630,797 · Granted Jun 2, 2026

Inventors: Richard Toohey (Burlington, VT); Peter Bordow (Fountain Hills, AZ); Chao Chen (New York, NY)

Assignee: Wells Fargo Bank, N.A.

H04L63/1433H04L41/0869H04L41/145

Abstract

Claims (88)

1 . A method for estimating a crypto-agility score of a network of computing assets, the method comprising:

receiving, by communications hardware, a network graph comprising a set of network nodes and a set of weights corresponding to the set of network nodes;

selecting, by graph circuitry, a first network node from the set of network nodes;

computing, by upgrade analysis circuitry, an upgrade cost for the first network node based on a set of dependency network nodes comprising dependencies of the first network node;

applying, by the graph circuitry, a weight from the set of weights to the upgrade cost for the first network node to determine a weighted upgrade cost for the first network node;

adding, by the graph circuitry, the weighted upgrade cost for the first network node to a set of weighted upgrade costs;

summing, by the graph circuitry, each weighted upgrade cost from the set of weighted upgrade costs to determine the crypto-agility score for the network of computer assets; and

providing, by the communications hardware, the crypto-agility score to an expert user.

2 . The method of claim 1 , further comprising:

computing, by the upgrade analysis circuitry, an individual upgrade cost associated with an upgrade of the first network node;

determining, by the upgrade analysis circuitry, the set of dependency network nodes representing computing assets that provide dependencies for the upgrade of the first network node;

generating a set of individual upgrade costs associated with the set of dependency network nodes; and

computing, by the upgrade analysis circuitry, a full upgrade cost for the first network node based on a set of upgrade costs associated with dependency network nodes from the set of dependency network nodes,

wherein the upgrade cost is further based on the full upgrade cost.

3 . The method of claim 2 , wherein computing the full upgrade cost for the first network node comprises:

computing, by the upgrade analysis circuitry, a dependency full upgrade cost for a dependency network node from the set of dependency network nodes, wherein the dependency full upgrade cost is based on a set of nested dependency upgrade costs associated with dependencies of the dependency network node; and

adding, by the graph circuitry, the dependency full upgrade cost for the dependency network node to the full upgrade cost for the first network node.

4 . The method of claim 2 , wherein generating the set of individual upgrade costs associated with the dependency network nodes comprises:

selecting, by the graph circuitry, a next network node, wherein the next network node has not previously been selected, wherein the next network node provides a dependency for the upgrade of the first network node;

computing, by the upgrade analysis circuitry, a next individual upgrade cost associated with the next network node; and

adding, by the graph circuitry, the next individual upgrade cost to the set of upgrade costs associated with the dependency network nodes.

5 . The method of claim 1 , further comprising computing the set of weighted upgrade costs by:

selecting, by the graph circuitry, a next network node, wherein the next network node has not previously been selected;

computing, by the upgrade analysis circuitry, a next upgrade cost for the next network node based on a set of next dependency network nodes comprising dependencies of the next network node;

applying, by the graph circuitry, a next weight from the set of weights to the next upgrade cost for the next network node to determine a next weighted upgrade cost for the next network node; and

adding, by the graph circuitry, the next weighted upgrade cost for the next network node to the set of weighted upgrade costs.

6 . The method of claim 1 , further comprising:

causing, by the graph circuitry, a perturbation of the network graph to produce a perturbed network graph;

computing a set of perturbed weighted upgrade costs based on the perturbed network graph; and

summing, by the graph circuitry, each perturbed weighted upgrade cost from the set of perturbed weighted upgrade costs to determine a perturbed crypto-agility score for the perturbed network graph of computer assets.

7 . The method of claim 6 , further comprising:

computing a set of crypto-agility scores comprising the crypto-agility score and the perturbed crypto-agility score; and

selecting a greatest score from the set of crypto-agility scores to designate a locally optimal network configuration, wherein the locally optimal network configuration corresponds to the greatest score.

8 . The method of claim 6 , further comprising:

computing a set of crypto-agility scores comprising the crypto-agility score and the perturbed crypto-agility score, wherein each particular crypto-agility score from the set of crypto-agility scores is associated with a particular network graph from a set of network graphs;

providing, by the communications hardware, the set of crypto-agility scores and the set of network graphs to the expert user; and

receiving, by the communications hardware, an indication of a validation of the set of crypto-agility scores.

9 . The method of claim 8 , further comprising:

modifying, by the graph circuitry, a selected weight from the set of weights based on the validation of the set of crypto-agility scores.

10 . The method of claim 8 , further comprising:

modifying, by the graph circuitry, a selected upgrade cost associated with a particular network node from the set of network graphs based on the validation of the set of crypto-agility scores.

11 . The method of claim 1 , wherein the network graph is a knowledge graph.

12 . The method of claim 11 , wherein computing the upgrade cost is based on one or more subject-predicate-object relationships between the first network node and a dependency network node from the set of dependency network nodes.

13 . An apparatus for estimating a crypto-agility score of a network of computing assets, the apparatus comprising:

communications hardware configured to:

receiving a network graph comprising a set of network nodes and a set of weights corresponding to the set of network nodes;

graph circuitry configured to:

select a first network node from the set of network nodes; and

upgrade analysis circuitry configured to:

compute an upgrade cost for the first network node based on a set of dependency network nodes comprising dependencies of the first network node,

wherein the graph circuitry is further configured to:

apply a weight from the set of weights to the upgrade cost for the first network node to determine a weighted upgrade cost for the first network node;

add the weighted upgrade cost for the first network node to a set of weighted upgrade costs; and

sum each weighted upgrade cost from the set of weighted upgrade costs to determine the crypto-agility score for the network of computer assets;

wherein the communications hardware is further configured to provide the crypto-agility score to an expert user.

14 . The apparatus of claim 13 , wherein the upgrade analysis circuitry is further configured to:

compute an individual upgrade cost associated with an upgrade of the first network node;

determine the set of dependency network nodes representing computing assets that provide dependencies for the upgrade of the first network node;

generate a set of individual upgrade costs associated with the set of dependency network nodes; and

compute a full upgrade cost for the first network node based on a set of upgrade costs associated with dependency network nodes from the set of dependency network nodes,

wherein the upgrade cost is further based on the full upgrade cost.

15 . The apparatus of claim 14 , wherein the upgrade analysis circuitry is further configured to compute the full upgrade cost for the first network node by:

computing a dependency full upgrade cost for a dependency network node from the set of dependency network nodes, wherein the dependency full upgrade cost is based on a set of nested dependency upgrade costs associated with dependencies of the dependency network node; and

adding the dependency full upgrade cost for the dependency network node to the full upgrade cost for the first network node.

16 . The apparatus of claim 14 , wherein the graph circuitry is further configured to generate the set of individual upgrade costs associated with the dependency network nodes by:

selecting a next network node, wherein the next network node has not previously been selected, wherein the next network node provides a dependency for the upgrade of the first network node;

computing a next individual upgrade cost associated with the next network node; and

adding the next individual upgrade cost to the set of upgrade costs associated with the dependency network nodes.

17 . The apparatus of claim 13 , wherein the graph circuitry is further configured to compute the set of weighted upgrade costs by:

selecting a next network node, wherein the next network node has not previously been selected;

computing a next upgrade cost for the next network node based on a set of next dependency network nodes comprising dependencies of the next network node;

applying a next weight from the set of weights to the next upgrade cost for the next network node to determine a next weighted upgrade cost for the next network node; and

adding the next weighted upgrade cost for the next network node to the set of weighted upgrade costs.

18 . The apparatus of claim 13 , wherein the graph circuitry is further configured to:

cause a perturbation of the network graph to produce a perturbed network graph;

computing a set of perturbed weighted upgrade costs based on the perturbed network graph; and

sum each perturbed weighted upgrade cost from the set of perturbed weighted upgrade costs to determine a perturbed crypto-agility score for the perturbed network graph of computer assets.

19 . The apparatus of claim 18 , wherein the graph circuitry is further configured to:

compute a set of crypto-agility scores comprising the crypto-agility score and the perturbed crypto-agility score; and

select a greatest score from the set of crypto-agility scores to designate a locally optimal network configuration, wherein the locally optimal network configuration corresponds to the greatest score.

20 . A computer program product for estimating a crypto-agility score of a network of computing assets, the computer program product comprising at least one non-transitory computer-readable storage medium storing software instructions that, when executed, cause an apparatus to:

receive a network graph comprising a set of network nodes and a set of weights corresponding to the set of network nodes;

select a first network node from the set of network nodes;

compute an upgrade cost for the first network node based on a set of dependency network nodes comprising dependencies of the first network node;

apply a weight from the set of weights to the upgrade cost for the first network node to determine a weighted upgrade cost for the first network node;

add the weighted upgrade cost for the first network node to a set of weighted upgrade costs;

sum each weighted upgrade cost from the set of weighted upgrade costs to determine the crypto-agility score for the network of computer assets; and

provide the crypto-agility score to an expert user.

Assignments (1)

Continuity (1)

References Cited (31)