Enterprise intrusion detection and remediation

Patent metadata

Field	Value
Publication number	US-9967270-B2
Application number	US-201715419012-A
Country	US
Kind code	B2
Filing date	Jan 30, 2017
Priority date	Oct 31, 2014
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

Events are securely packaged and transmitted from peripherals of terminals and from secure input/out modules (SIOMs) of terminals. The events are collected and mined in real time for security risk patterns and dynamic remedial actions are pushed back down to the terminals, peripherals, and SIOMs.

First claim

The invention claimed is:

1. A method, comprising:
receiving, by a hardware server, a security intrusion event securely communicated from a peripheral of a terminal over a network, wherein receiving further includes obtaining the security intrusion event from the peripheral of the terminal, the security intrusion event pushed up to a secure input/output module (SIOM) that is acting as a secure interface for communications to and from the peripheral during a secure session between the peripheral and the SIOM, and wherein the SIOM is independent of the operating system;
accessing, by the hardware server, heuristics and identifying a pattern for the security intrusion event relevant to a security intrusion within the peripheral; and
triggering, by the hardware server, an action based on the pattern and securely pushing the action to the peripheral for dynamic and real-time processing by the peripheral in response to the security intrusion, wherein the peripheral comprises a card reader;
wherein the pattern comprises a failure of the secure session between the terminal and the card reader.

2. The method of claim 1 , wherein the pattern is configurable.

3. The method of claim 1 , wherein the pattern comprises detection of a duplicate secure peripheral identifier.

4. The method of claim 1 , wherein the pattern comprises detection of a secure peripheral identifier that is not in an inventory of peripherals on the SIOM.

5. The method of claim 1 , wherein the pattern comprises detection of duplicate SIOM identifiers.

6. The method of claim 1 , wherein the pattern comprises detection of a revoked or decommissioned peripheral or the SIOM.

7. A method, comprising:
receiving, by a hardware server, a security intrusion event securely communicated from a peripheral of a terminal over a network, wherein receiving further includes obtaining the security intrusion event from the peripheral of the terminal, the security intrusion event pushed up to a secure input/output module (SIOM) that is acting as a secure interface for communications to and from the peripheral during a secure session between the peripheral and the SIOM, and wherein the SIOM is independent of the operating system;
accessing, by the hardware server, heuristics and identifying a pattern for the security intrusion event relevant to a security intrusion within the peripheral; and
triggering, by the hardware server, an action based on the pattern and securely pushing the action to the peripheral for dynamic and real-time processing by the peripheral in response to the security intrusion;
wherein the pattern comprises receipt of an out-of-order secure session message from the peripheral by the SIOM.

8. A method, comprising:
receiving, by a hardware server, a security intrusion event securely communicated from a peripheral of a terminal over a network, wherein receiving further includes obtaining the security intrusion event from the peripheral of the terminal, the security intrusion event pushed up to a secure input/output module (SIOM) that is acting as a secure interface for communications to and from the peripheral during a secure session between the peripheral and the SIOM, and wherein the SIOM is independent of the operating system;
accessing, by the hardware server, heuristics and identifying a pattern for the security intrusion event relevant to a security intrusion within the peripheral; and
triggering, by the hardware server, an action based on the pattern and securely pushing the action to the peripheral for dynamic and real-time processing by the peripheral in response to the security intrusion;
wherein the pattern comprises receipt of an out-of-order secure session message from the SIOM by the peripheral.

9. A method, comprising:
receiving, by a hardware server, a security intrusion event securely communicated from a peripheral of a terminal over a network, wherein receiving further includes obtaining the security intrusion event from the peripheral of the terminal, the security intrusion event pushed up to a secure input/output module (SIOM) that is acting as a secure interface for communications to and from the peripheral during a secure session between the peripheral and the SIOM, and wherein the SIOM is independent of the operating system;
accessing, by the hardware server, heuristics and identifying a pattern for the security intrusion event relevant to a security intrusion within the peripheral; and
triggering, by the hardware server, an action based on the pattern and securely pushing the action to the peripheral for dynamic and real-time processing by the peripheral in response to the security intrusion;
wherein the pattern comprises a failure to pair with the peripheral by the SIOM.

10. A method, comprising:
receiving, by a hardware server, a security intrusion event securely communicated from a peripheral of a terminal over a network, wherein receiving further includes obtaining the security intrusion event from the peripheral of the terminal, the security intrusion event pushed up to a secure input/output module (SIOM) that is acting as a secure interface for communications to and from the peripheral during a secure session between the peripheral and the SIOM, and wherein the SIOM is independent of the operating system;
accessing, by the hardware server, heuristics and identifying a pattern for the security intrusion event relevant to a security intrusion within the peripheral; and
triggering, by the hardware server, an action based on the pattern and securely pushing the action to the peripheral for dynamic and real-time processing by the peripheral in response to the security intrusion;
wherein the pattern comprises receipt of the secure session message for the secure session that is no longer active by the SIOM.

11. A method, comprising:
receiving, by a hardware server, a security intrusion event securely communicated from a peripheral of a terminal over a network, wherein receiving further includes obtaining the security intrusion event from the peripheral of the terminal, the security intrusion event pushed up to a secure input/output module (SIOM) that is acting as a secure interface for communications to and from the peripheral during a secure session between the peripheral and the SIOM, and wherein the SIOM is independent of the operating system;
accessing, by the hardware server, heuristics and identifying a pattern for the security intrusion event relevant to a security intrusion within the peripheral; and
triggering, by the hardware server, an action based on the pattern and securely pushing the action to the peripheral for dynamic and real-time processing by the peripheral in response to the security intrusion;
wherein the pattern comprises a mismatch between a SIOM pairing request issued by a provisioning server and provisioning events on the SIOM.

12. A method, comprising:
receiving, by a hardware server, a security intrusion event securely communicated from a peripheral of a terminal over a network, wherein receiving further includes obtaining the security intrusion event from the peripheral of the terminal, the security intrusion event pushed up to a secure input/output module (SIOM) that is acting as a secure interface for communications to and from the peripheral during a secure session between the peripheral and the SIOM, and wherein the SIOM is independent of the operating system;
accessing, by the hardware server, heuristics and identifying a pattern for the security intrusion event relevant to a security intrusion within the peripheral; and
triggering, by the hardware server, an action based on the pattern and securely pushing the action to the peripheral for dynami

Assignees

• Ncr Corp

Inventors

• Kobres Erick
• Antonakakis Stavros

Classifications

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title