US 11,750,645 B2
Detecting use of compromised security credentials in private enterprise networks
David Endler, Austin, TX (US); Alen Puzic, Austin, TX (US); and Edward Ross, Austin, TX (US)
Assigned to SpyCloud, Inc., Austin, TX (US)
Filed by SpyCloud, Inc., Austin, TX (US)
Filed on Feb. 14, 2022, as Appl. No. 17/671,323.
Application 17/671,323 is a continuation of application No. 16/667,367, filed on Oct. 29, 2019, granted, now 11,283,832.
Claims priority of provisional application 62/753,812, filed on Oct. 31, 2018.
Prior Publication US 2022/0166792 A1, May 26, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1466 (2013.01) [H04L 63/083 (2013.01); H04L 63/101 (2013.01); H04L 63/1425 (2013.01); H04L 63/1433 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
obtaining, with one or more processors, with a domain controller of a private computer network, a set of user-authentication credentials comprising a first username and a first password;
querying, with one or more processors, a credential-monitoring application with a query requesting compromised credentials corresponding to the first username, wherein the credential-monitoring application is external to the private computer network;
receiving, with one or more processors, query results of the querying including one or more passwords associated with the first username;
determining, with one or more processors, with a credential guardian module, that at least some of the one or more passwords in the query results match the obtained first password, wherein the credential guardian module is within the private computer network;
instructing, with the one or more processors, with the credential guardian module, the domain controller to block access to a first user account on the private computer network that is associated with the set of user-authentication credentials;
blocking, with one or more processors, with the domain controller, access to the first user account on the private computer network; and
in response to the determination, causing, with one or more processors, a first user associated with the first user account to be notified to reset the obtained first password.