US5850516A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for analyzing information systems using stored tree database structures
Assignee: BT Americas Inc
•
Filing: 1996-12-23
•
Granted: 1998-12-15
•
Expires: 2016-12-23
Abstract
Abstract A computer-implemented method and apparatus electronically represent and quantify the security of a system as a logical tree structure including leaf nodes representing attacks against the system and intermediate nodes representing various logical combinations of attacks necessary to mount a successful overall attack. An indication of the overall security of the system is quantified in a value of a root node of the tree. The values of the various nodes can be Boolean or continuous, representing simple binary security attributes such as feasible/infeasible or more complicated attributes such as cost, time or probability. The nodes' attributes and values can also represent defenses as well as attacks. The attack trees can be used to calculate the cost, time or probability of an attack to list the security assumptions of a system, to compare competing systems, to evaluate system modifications, to perform security subsystem analysis, to allocate a security budget, and for many other uses.
Inventors
- 👤 Bruce Schneier
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 12:21
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/14; G; G06; G06F; G06F21/00; G06F21/50; G06F21/57; H04L9/00; H04L9/40; G06F2211/00; G06F2211/007; G06F2211/008; Y; Y10; Y10S; Y10S707/00; Y10S707/99931; Y10S707/99939
Claims Analysis
Total Claims: 78
Claim 1
Independent Claim
146 words
A computer-implemented method for evaluating the security of a system, comprising the steps of: (a) receiving an identifier of a particular system to be evaluated; (b) storing in a computer-readable medium a logic tree data structure representing a security model which corresponds to the selected information protection system, said logic tree including: (i) a plurality of leaf nodes, each of which represents a particular security attribute of the selected system, (ii) a root node representing an overall indication of the security of the system and (iii) at least one intermediate node located between said leaf nodes and said root node, said intermediate node representing a logical relationship between at least two of said particular security attributes; and (c) receiving values for said leaf nodes quantifying said attributes; (d) computing a value of said root node that provides an indication of the overall security of the system.
Claim 2
Dependent Claim
146 words
A computer-implemented method for evaluating the security of a system, comprising the steps of: (a) receiving an identifier of a particular system to be evaluated; (b) storing in a computer-readable medium a logic tree data structure representing a security model which corresponds to the selected information protection system, said logic tree including: (i) a plurality of leaf nodes, each of which represents a particular security attribute of the selected system, (ii) a root node representing an overall indication of the security of the system and (iii) at least one intermediate node located between said leaf nodes and said root node, said intermediate node representing a logical relationship between at least two of said particular security attributes; and (c) receiving values for said leaf nodes quantifying said attributes; (d) computing a value of said root node that provides an indication of the overall security of the system.
Claim 3
Dependent Claim
10 words
The method of claim 1 where said attribute is Boolean-valued.
Claim 4
Dependent Claim
10 words
The method of claim 2 where said attribute is continuous-valued.
Claim 5
Dependent Claim
16 words
The method of claim 3 where said value is a cost associated with said security attribute.
Claim 6
Dependent Claim
13 words
The method of claim 4 where said cost corresponds to a particular attack.
Claim 7
Dependent Claim
15 words
The method of claim 4 where said cost corresponds to defending against a particular attack.
Claim 8
Dependent Claim
16 words
The method of claim 3 where said attribute is a time associated with said security attribute.
Claim 9
Dependent Claim
17 words
The method of claim 1 where said attribute indicates a likelihood of occurrence of said security attribute.
Claim 10
Dependent Claim
17 words
The method of claim 8 where said value indicates a probability of occurrence of said security attribute.
Claim 11
Dependent Claim
14 words
The method of claim 9 where said security attribute pertains to a particular attack.
Claim 12
Dependent Claim
16 words
The method of claim 9 where said security attribute pertains to defending against a particular attack.
Claim 13
Dependent Claim
16 words
The method of claim 9 where said probability reflects an attacker's awareness of said particular attack.
Claim 14
Dependent Claim
16 words
The method of claim 1 where at least one of said nodes also reflects a countermeasure.
Claim 15
Dependent Claim
15 words
The method of claim 13 where said node containing said countermeasure is a leaf node.
Claim 16
Dependent Claim
15 words
The method of claim 13 where said node containing said countermeasure is an intermediate node.
Claim 17
Dependent Claim
20 words
The method of claim 13 where said node containing said countermeasure points to a separate attack tree against that countermeasure.
Claim 18
Dependent Claim
17 words
The method of claim 1 where at least one of said logical relationships includes an algebraic relationship.
Claim 19
Dependent Claim
19 words
The method of claim 1 where at least one of said logical relationships is expressed with a relational operator.
Claim 20
Dependent Claim
17 words
The method of claim 1 where at least one of said logical relationships includes a Boolean relationship.
Claim 21
Dependent Claim
21 words
The method of claim 1 where at least one of said nodes has children representing different possible attacks against the node.
Claim 22
Dependent Claim
20 words
The method of claim 20 where said at least one of said nodes reflects a minimum of said children's values.
Claim 23
Dependent Claim
23 words
The method of claim 1 where at least one of nodes has children representing different parts of a single attack against said node.
Claim 24
Dependent Claim
20 words
The method of claim 22 where said at least one of said nodes reflects a sum of its children's values.
Claim 25
Dependent Claim
22 words
The method of claim 22 where said at least one of said nodes reflects a value exhibited by all of its children.
Claim 26
Dependent Claim
16 words
The method of claim 1 where said root node indicates the overall attackability of said system.
Claim 27
Dependent Claim
19 words
The method of claim 25 where said value of said root node represents a cost to attack said system.
Claim 28
Dependent Claim
19 words
The method of claim 25 where said value of said root node represents a probability of attacking said system.
Claim 29
Dependent Claim
16 words
The method of claim 1 where said root node indicates an overall defendability of said system.
Claim 30
Dependent Claim
20 words
The method of claim 28 where said value of said root node indicates a cost to de fend said system.
Claim 31
Dependent Claim
19 words
The method of claim 28 where said value of said root node indicates a probability of defending said system.
Claim 32
Dependent Claim
17 words
The method of claim 1 where at least one of said nodes represents a plurality of attributes.
Claim 33
Dependent Claim
17 words
The method of claim 31 where said attributes are represented directly by said at least one node.
Claim 34
Dependent Claim
16 words
The method of claim 32 where said attribute of said at least one node is vector-valued.
Claim 35
Dependent Claim
16 words
The method of claim 31 where said plurality of attributes are represented by a sub-tree structure.
Claim 36
Dependent Claim
22 words
The method of claim 1 where at least one of said nodes represents an attack about which there is currently no information.
Claim 37
Dependent Claim
25 words
The method of claim 1 where said value of at least one said leaf nodes is propagated through said intermediate nodes to said root node.
Claim 38
Dependent Claim
16 words
The method of claim 1 where said security attribute pertains to the safety of said system.
Claim 39
Dependent Claim
16 words
The method of claim 1 where said security attribute pertains to the reliability of said system.
Claim 40
Dependent Claim
105 words
A computer-readable medium storing a logic data tree structure comprising: (a) a plurality of leaf nodes, each of which represents a particular security attribute of a system; (b) a root node representing an overall indication of the security of said system; and (c) at least one intermediate node located between said leaf nodes and said root node, said intermediate node representing a between at least two of said particular security attributes; and said leaf nodes having values quantifying said attributes whereby a value of said root node provides said indication of said security of said system for use in evaluating said security of said system.
Claim 41
Dependent Claim
105 words
A computer-readable medium storing a logic data tree structure comprising: (a) a plurality of leaf nodes, each of which represents a particular security attribute of a system; (b) a root node representing an overall indication of the security of said system; and (c) at least one intermediate node located between said leaf nodes and said root node, said intermediate node representing a between at least two of said particular security attributes; and said leaf nodes having values quantifying said attributes whereby a value of said root node provides said indication of said security of said system for use in evaluating said security of said system.
Claim 42
Dependent Claim
11 words
The computer-readable medium of claim 39 wherein said attribute is Boolean-valued.
Claim 43
Dependent Claim
11 words
The computer-readable medium of claim 40 wherein said attribute is continuous-valued.
Claim 44
Dependent Claim
17 words
The computer-readable medium of claim 41 wherein said value is a cost associated with said security attribute.
Claim 45
Dependent Claim
14 words
The computer-readable medium of claim 42 wherein said cost corresponds to a particular attack.
Claim 46
Dependent Claim
16 words
The computer-readable medium of claim 42 wherein said cost corresponds to defending against a particular attack.
Claim 47
Dependent Claim
17 words
The computer-readable medium of claim 41 wherein said attribute is a time associated with said security attribute.
Claim 48
Dependent Claim
18 words
The computer-readable medium of claim 39 wherein said attribute indicates a likelihood of occurrence of said security attribute.
Claim 49
Dependent Claim
18 words
The computer-readable medium of claim 46 wherein said value indicates a probability of occurrence of said security attribute.
Claim 50
Dependent Claim
15 words
The computer-readable medium of claim 47 wherein said security attribute pertains to a particular attack.
Claim 51
Dependent Claim
17 words
The computer-readable medium of claim 47 wherein said security attribute pertains to defending against a particular attack.
Claim 52
Dependent Claim
17 words
The computer-readable medium of claim 47 wherein said probability reflects an attacker's awareness of said particular attack.
Claim 53
Dependent Claim
17 words
The computer-readable medium of claim 39 wherein at least one of said nodes also reflects a countermeasure.
Claim 54
Dependent Claim
16 words
The computer-readable medium of claim 51 wherein said node containing said countermeasure is a leaf node.
Claim 55
Dependent Claim
16 words
The computer-readable medium of claim 51 wherein said node containing said countermeasure is an intermediate node.
Claim 56
Dependent Claim
21 words
The computer-readable medium of claim 51 wherein said node containing said countermeasure points to a separate attack tree against that countermeasure.
Claim 57
Dependent Claim
18 words
The computer-readable medium of claim 39 wherein at least one of said logical relationships includes an algebraic relationship.
Claim 58
Dependent Claim
20 words
The computer-readable medium of claim 38 wherein at least one of said logical relationships is expressed with a relational operator.
Claim 59
Dependent Claim
18 words
The computer-readable medium of claim 39 wherein at least one of said logical relationships includes a Boolean relationship.
Claim 60
Dependent Claim
22 words
The computer-readable medium of claim 39 wherein at least one of said nodes has children representing different possible attacks against the node.
Claim 61
Dependent Claim
21 words
The computer-readable medium of claim 58 wherein said at least one of said nodes reflects a minimum of said children's values.
Claim 62
Dependent Claim
24 words
The computer-readable medium of claim 39 wherein at least one of nodes has children representing different parts of a single attack against said node.
Claim 63
Dependent Claim
21 words
The computer-readable medium of claim 60 wherein said at least one of said nodes reflects a sum of its children's values.
Claim 64
Dependent Claim
23 words
The computer-readable medium of claim 60 wherein said at least one of said nodes reflects a value exhibited by all of its children.
Claim 65
Dependent Claim
17 words
The computer-readable medium of claim 39 wherein said root node indicates the overall attackability of said system.
Claim 66
Dependent Claim
20 words
The computer-readable medium of claim 63 wherein said value of said root node represents a cost to attack said system.
Claim 67
Dependent Claim
20 words
The computer-readable medium of claim 63 wherein said value of said root node represents a probability of attacking said system.
Claim 68
Dependent Claim
17 words
The computer-readable medium of claim 39 wherein said root node indicates an overall dependability of said system.
Claim 69
Dependent Claim
20 words
The computer-readable medium of claim 65 wherein said value of said root node indicates a cost to defend said system.
Claim 70
Dependent Claim
20 words
The computer-readable medium of claim 65 wherein said value of said root node indicates a probability of defending said system.
Claim 71
Dependent Claim
18 words
The computer-readable medium of claim 39 wherein at least one of said nodes represents a plurality of attributes.
Claim 72
Dependent Claim
18 words
The computer-readable medium of claim 69 wherein said attributes are represented directly by said at least one node.
Claim 73
Dependent Claim
17 words
The computer-readable medium of claim 70 wherein said attribute of said at least one node is vector-valued.
Claim 74
Dependent Claim
17 words
The computer-readable medium of claim 69 wherein said plurality of attributes are represented by a sub-tree structure.
Claim 75
Dependent Claim
23 words
The computer-readable medium of claim 39 wherein at least one of said nodes represents an attack about which there is currently no information.
Claim 76
Dependent Claim
26 words
The computer-readable medium of claim 39 wherein said value of at least one said leaf nodes is propagated through said intermediate nodes to said root node.
Claim 77
Dependent Claim
17 words
The computer-readable medium of claim 38 wherein said security attribute pertains to the safety of said system.
Claim 78
Dependent Claim
17 words
The computer-readable medium of claim 38 wherein said security attribute pertains to the reliability of said system.
References Cited (Backward Citations)
US5542024A
Cited
US5630076A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-12-14 | 2002-06-15 | 2002-12-15 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-12-14 | 2006-06-15 | 2006-12-15 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-12-14 | 2010-06-15 | 2010-12-15 | $7700.00 | Window Closed / Lapsed |