Patent ID: 7603714
Filing Date: 2009-10-13
Classification: G06F,H04L

Abstract:
1. A method comprising: generating, by a first vulnerability analysis and fortification (VAF) agent operating in a hardware-based system, a first process representation of a first process, wherein the first process comprises a series of sequential operations that are represented by multiple nodes in the first process representation, and wherein the first VAF agent monitors the first process for security exposures; defining legal and illegal interfaces between the multiple nodes in the first process representation, wherein a legal interface between a first node and a second node in the first process representation reflects an authorization for operations represented by the first node and the second node to be linked, and wherein an illegal interface reflects a lack of authorization for operations represented by the first node and the second node to ever be directly linked; generating, by a second VAF agent, a second process representation of a second process; comparing nodes from the first process representation to nodes of the second process representation, wherein the second VAF agent monitors the second process for security exposures; and in response to the nodes of the first process representation matching nodes in the second process representation, sending an alert from the first VAF agent to the second VAF agent, wherein the alert identifies the illegal interfaces between nodes in the first process representation as potential illegal interfaces between nodes in the second process representation.