Published Patent Claims

A method for generating quantum-resistant compliance evidence from security telemetry, the method comprising: (a) receiving a plurality of security event records from a managed detection and response platform, each record comprising a security event type, a timestamp, and an actor identifier; (b) computing, for each security event record, a cryptographic hash that incorporates the cryptographic hash of the immediately preceding security event record, thereby forming a hash chain in which any alteration, deletion, or reordering of any record is detectable at the position of alteration; (c) periodically sealing a contiguous sequence of hash-chained records by: (i) generating a first digital signature over a canonical serialization of the sequence using a classical elliptic curve digital signature algorithm; and (ii) generating a second digital signature over the same canonical serialization using a post-quantum digital signature algorithm conforming to NIST FIPS 204; (d) storing the first digital signature, the second digital signature, and corresponding public keys alongside the sealed sequence in a persistent data store; (e) mapping each security event record to one or more compliance control identifiers selected from at least one security compliance framework at the time of record ingestion; and (f) publishing the sealed sequence, the first and second digital signatures, and the corresponding public keys at a network endpoint accessible without authentication credentials, wherein any third party holding the public keys is capable of independently verifying the integrity and authenticity of the sealed sequence without access to the platform's private infrastructure, signing keys, or backend systems.

A system for generating quantum-resistant compliance evidence from security telemetry, the system comprising one or more processors and a non-transitory computer-readable medium storing instructions that, when executed, cause the processors to: (a) receive security event records from a managed detection and response agent operating on one or more endpoint devices; (b) chain each security event record to its predecessor by computing and embedding the cryptographic hash of the predecessor record; (c) seal batches of hash-chained records on a periodic schedule using dual digital signatures comprising a classical signature and a post-quantum signature conforming to NIST FIPS 204; (d) map each security event record to compliance controls of at least one regulatory framework selected from CMMC, NIST SP 800-171, SOC 2, HIPAA, ISO 27001, and NYDFS Part 500; and (e) expose the sealed records and public verification keys at an unauthenticated network endpoint enabling independent chain verification by auditors, insurers, and legal counsel.

A method for detecting unauthorized sub-operating system execution, comprising: establishing, by a non-privileged runtime processing agent executing within a host operating system, a performance baseline of host CPU availability utilizing wall-clock time relative to CPU clock cycles; continuously calculating, via said agent, a runtime delta between said wall-clock time and said CPU clock cycles; detecting an unauthorized sub-operating system execution event when said runtime delta exceeds said performance baseline by a predetermined nanosecond threshold, indicating a System Management Mode (SMM) timing gap leak; and generating an alert payload containing said runtime delta.

The method of Claim 1, further comprising: upon generating said alert payload, automatically executing a cryptographic hashing operation combining said alert payload with a prior ledger sequence hash to create a sequential hash chain; signing said sequential hash chain utilizing a hybrid cryptographic signature consisting of an Ed25519 digital signature and an ML-DSA post-quantum signature; and committing said signed sequential hash chain to an immutable, publicly verifiable audit ledger prior to the execution of any automated operating system containment response.

A method for zero-knowledge credential rotation with cryptographically verified audit evidence, the method comprising: (a) receiving, at a server, a credential value encrypted by a client browser prior to transmission, wherein the encryption key is derived within the client environment from session authentication material and is not transmitted to or stored by the server; (b) storing only the encrypted credential value at the server, such that the server holds ciphertext and cannot recover the plaintext; (c) upon a rotation trigger, transmitting a rotation instruction to a credential rotation module that: (i) creates a new credential at the target platform using that platform's credential management API; (ii) verifies that the new credential is functional; (iii) revokes the prior credential only after successful verification; and (iv) returns the new credential value encrypted under the client-derived key for server storage; (d) sealing a rotation event record to a tamper-evident audit chain with Ed25519 and a post-quantum digital signature conforming to NIST FIPS 204; and (e) mapping the sealed rotation event to one or more credential management compliance controls of at least one security compliance framework.

A system for zero-knowledge credential rotation comprising: (a) a client-side encryption module executing within a web browser encrypting credential values using AES-256-GCM with a key derived from session authentication material, wherein the plaintext is never transmitted to a server; (b) a server-side credential store persisting only ciphertext values; (c) a rotation engine comprising platform-specific rotation modules each implementing a create-verify-revoke sequence; and (d) an audit sealer recording each rotation event to a post-quantum-signed tamper-evident audit chain mapped to compliance control identifiers.

A method for generating cryptographically verified proof of security control effectiveness, the method comprising: (a) generating a plurality of synthetic security event records each representing a simulated attack technique mapped to at least one technique identifier in a threat intelligence framework; (b) submitting each synthetic record directly to a live detection engine function that processes real production security events, not a separate simulation environment; (c) receiving a detection verdict for each synthetic record; (d) atomically generating, for each synthetic record and verdict, a sealed proof record comprising the technique, verdict, timestamp, compliance control identifiers, and a post-quantum digital signature conforming to NIST FIPS 204; (e) appending the sealed proof record to a hash-chained audit ledger; and (f) repeating steps (a) through (e) on a periodic schedule without human intervention.

A system for continuous automated verification of security control effectiveness comprising: (a) a probe generator producing synthetic security event records representing attack techniques; (b) a detection engine interface submitting each synthetic record to the same detection evaluation function used for production security events; (c) an atomic evidence sealer recording the probe identifier, detection verdict, timestamp, and compliance control mapping into a post-quantum-signed hash-chained audit ledger in a single transaction; and (d) a scheduler executing the probe-evaluate-seal cycle on a configurable periodic interval without human intervention.

A method for generating compliance documentation from live security telemetry, the method comprising: (a) continuously ingesting security event records from one or more endpoint agents; (b) mapping each ingested record to one or more compliance control identifiers at the time of ingestion; (c) accumulating, for each compliance control identifier, sealed audit evidence records demonstrating control operation; (d) computing a control coverage state for each compliance control identifier from cryptographically sealed audit evidence rather than human-provided attestation; (e) generating a System Security Plan in which each compliance control is classified as implemented or not implemented based on computed control coverage state; and (f) generating a Plan of Action and Milestones comprising entries for each control classified as not implemented or having insufficient evidence, derived from the absence or inadequacy of sealed audit evidence rather than human-identified gaps, wherein both documents update automatically as new security event records are ingested and evidence accumulates or expires.

A system for real-time compliance document generation comprising: (a) a telemetry ingestion pipeline receiving security event records and mapping each to compliance control identifiers at ingestion time; (b) a control coverage calculator computing evidence coverage state from accumulated sealed audit records without reliance on human attestation; (c) a System Security Plan generator producing a compliance document reflecting actual control coverage from live evidence; and (d) a Plan of Action and Milestones generator producing remediation entries derived from real detected gaps in control coverage.

A method for limiting the blast radius of a compromised security agent component, the method comprising: (a) executing a first agent process under a high-privilege system account collecting security telemetry from privileged operating system sources including kernel event tracing, security event logs, hardware sensor interfaces, and firmware-observable signal channels; (b) writing collected telemetry records exclusively to a named inter-process communication channel, wherein the first agent process does not initiate any outbound network connections; (c) executing a second agent process under a low-privilege isolated user account reading from the named channel and transmitting records to a remote management platform; (d) restricting network egress of the second agent process at the operating system level to outbound connections on port 443 using HTTPS and outbound DNS queries only, denying all other outbound network connections; (e) preventing the second agent process from reading from any privileged operating system source directly; and (f) sealing the startup state, user account identity, and network policy state of the second agent process to a tamper-evident audit record at process initialization, wherein compromise of the second agent process does not grant an attacker access to privileged telemetry sources, internal network resources, or any network destination other than the designated management platform.

A security agent system with bounded compromise blast radius comprising: (a) a collector process executing under a system-level privileged account reading from privileged security telemetry sources and writing exclusively to a local inter-process communication channel without initiating outbound network connections; (b) a shipper process executing under a restricted user account with operating-system-enforced network egress limited to HTTPS port 443 and DNS, reading from the inter-process communication channel and transmitting records to a remote platform; and (c) an audit sealer recording the identity, privilege level, and network policy state of the shipper process to a cryptographically sealed tamper-evident ledger at initialization and on any detected configuration change.

A method for maintaining cryptographically continuous security audit records across periods of cloud connectivity loss, the method comprising: (a) monitoring connectivity between an endpoint security agent and a remote managed detection and response platform; (b) upon detecting connectivity has been unavailable for more than a threshold duration, entering autonomous detection mode by: (i) sealing a defiance-activation event record to a local tamper-evident hash-chained audit ledger comprising the timestamp of connectivity loss and autonomous mode activation; and (ii) activating a set of locally compiled detection rules that evaluate security events without requiring communication with the remote platform; (c) during autonomous detection mode: (i) evaluating each security event against the locally compiled detection rules; (ii) storing each security event record in a local persistent queue wherein each queued record preserves its original timestamp and is chained to its predecessor by cryptographic hash; and (iii) continuing to evaluate and queue security events without time limit until connectivity is restored; (d) upon restoration of connectivity: (i) sealing a connectivity-restoration event record; (ii) transmitting queued records in original sequence order, preserving original timestamps; (iii) sealing each transmitted record to the remote tamper-evident audit chain in sequence order; and (iv) sealing a queue-drain-completion event record referencing the defiance-activation event, thereby bounding the autonomous period in the audit chain; and (e) maintaining cryptographic hash chain continuity across the defiance-activation event, all queued events, the connectivity-restoration event, and the queue-drain-completion event, such that the audit chain contains no gap corresponding to the autonomous operation period.

A system for cryptographically continuous security audit records across cloud connectivity loss comprising: (a) a connectivity monitor detecting loss of communication with a remote managed detection and response platform; (b) a local detection engine comprising compiled detection rules that evaluate security events without remote platform access; (c) a local persistent queue storing security event records with original timestamps in hash-chained order during connectivity loss periods; (d) a defiance bookend sealer sealing defiance-activation and queue-drain-completion events to the audit chain; and (e) a queue drain manager transmitting queued records to the remote platform in original sequence order upon connectivity restoration and sealing each record to the remote tamper-evident audit chain.

A method for enforcing security and verifying platform integrity natively within a firmware execution environment prior to operating system initialization, comprising: initializing a security module compiled as a native Driver Execution Environment (DXE) driver within a Unified Extensible Firmware Interface (UEFI) space of a host device during a pre-operating system boot phase; executing, via said DXE security module, a hardware interrogation routine to extract physical machine states directly from underlying CPU and platform architecture registers; measuring, via a high-resolution firmware timer loop, an early-stage baseline of System Management Interrupt (SMI) timing durations and execution frequencies within said pre-operating system boot phase; compiling said physical machine states and said SMI timing durations into a local firmware-resident baseline map; and caching said firmware-resident baseline map within a protected, volatile firmware memory region allocated exclusively to the UEFI pre-boot runtime environment.

A system for autonomously intercepting unauthorized modifications within a pre-boot environment, comprising: a processor; a non-volatile flash memory storing a Unified Extensible Firmware Interface (UEFI) architecture; and a firmware-resident security module executing as a DXE driver within said UEFI architecture prior to the execution of a host operating system bootloader, configured to: intercept an event vector attempting a modification to a target firmware configuration structure within the pre-boot environment; dynamically calculate a delta between a state change proposed by said event vector and a trusted firmware-resident baseline map; execute an autonomous firmware-containment protocol to abort the system boot sequence if said delta exceeds a verified security threshold; and append a cryptographically signed verification voucher detailing the blocked event vector to an architectural log space within a hardware Trusted Platform Module (TPM) before any subsequent boot-phase execution occurs.

A method for generating cryptographically sealed compliance artifacts from a two-layer firmware and operating system security detection architecture, the method comprising: (a) establishing, by a monitoring module executing within the UEFI Driver Execution Environment phase prior to operating system load, a cryptographic baseline of firmware state comprising memory region checksums, ACPI table hashes, UEFI variable namespace contents, CPUID hypervisor state, and system management interrupt timing measurements; (b) transmitting detection events from the firmware-resident monitoring module to an operating system layer security agent via a named UEFI runtime variable, wherein the variable functions as a unidirectional evidence channel from firmware layer to operating system layer; (c) continuously ingesting, by the operating system layer security agent, security telemetry from both the UEFI runtime variable channel and operating system signal channels; (d) for each ingested telemetry event, atomically performing in a single transaction: (i) computing a cryptographic hash of the event record incorporating the hash of the immediately preceding record; (ii) generating a first digital signature using a classical elliptic curve algorithm; (iii) generating a second digital signature using a post-quantum digital signature algorithm conforming to NIST FIPS 204; (iv) mapping the event record to compliance control identifiers from each of a plurality of security compliance frameworks simultaneously; and (v) persisting the signed, hash-chained, multi-framework-mapped record to a tamper-evident audit ledger; (e) computing, from accumulated sealed audit evidence records, a coverage state for each compliance control in each mapped framework; and (f) generating autonomously, without human intervention, a plurality of compliance artifacts comprising at least a System Security Plan, a Plan of Action and Milestones, and a numerical security posture score, wherein each artifact derives its content from the computed coverage states of sealed audit evidence, wherein the method produces a continuous, unbroken cryptographic record spanning firmware-layer detection events, operating system-layer security telemetry, and compliance artifact generation within a single tamper-evident evidence chain.

A system for continuous cryptographically signed telemetry ingestion and autonomous multi-framework compliance artifact generation comprising: (a) a firmware-resident detection layer comprising a UEFI DXE phase driver establishing cryptographic baselines of firmware state before operating system initialization; (b) a cross-layer communication channel implemented as a named UEFI runtime variable through which the firmware-resident detection layer passes forensic evidence to an operating system layer agent; (c) an operating system layer security agent sealing each event to a hash-chained audit ledger with dual classical and post-quantum digital signatures and simultaneously mapping each event to compliance control identifiers from multiple security frameworks in a single atomic operation; and (d) a compliance artifact generator producing System Security Plans, Plans of Action and Milestones, and security posture scores derived entirely from accumulated sealed audit evidence without human attestation, and publishing the sealed evidence chain at an unauthenticated verification endpoint.

A method for detecting firmware-layer security threats using two coordinated firmware-resident security modules, the method comprising: (a) initializing a first security module as a UEFI DXE driver prior to operating system load, the first module: (i) computing CRC checksums across a plurality of firmware memory regions and storing the results as a memory baseline; (ii) planting one or more canary pages in protected firmware memory regions to detect unauthorized write activity; (iii) measuring a RDTSC timing baseline to establish expected CPU cycle behavior during firmware execution; (iv) hooking the UEFI SetVariable boot service to intercept and evaluate all UEFI non-volatile random access memory write operations; and (v) arming a periodic timer to re-evaluate all monitored channels at a configurable interval; (b) initializing a second security module inside System Management Mode, the second module: (i) measuring SMI execution frequency over a baseline window; and (ii) monitoring for anomalous deviations from the baseline SMI rate on a configurable periodic interval; (c) upon detection of baseline deviation by either module, writing a forensic evidence payload to a named UEFI runtime variable accessible from both firmware and operating system contexts; and (d) polling, by an operating system layer security agent, the named UEFI runtime variable at a configurable periodic interval, reading forensic evidence payloads, sealing each payload to a post-quantum-signed tamper-evident audit chain, and clearing the variable upon successful sealing, wherein the named UEFI runtime variable functions as a unidirectional evidence channel from the firmware layer to the operating system layer agent.

A system for firmware-layer security detection comprising: (a) a UEFI DXE driver executing before operating system initialization, establishing memory CRC baselines, planting canary pages, measuring RDTSC timing baselines, and hooking the UEFI SetVariable service; (b) a System Management Mode driver executing at the highest CPU privilege level monitoring SMI execution frequency against an established baseline rate on a configurable periodic interval; (c) a named UEFI runtime variable serving as a unidirectional evidence channel through which both firmware modules communicate forensic payloads to an operating system layer agent; and (d) an operating system layer security agent compiled in a memory-safe programming language, polling the named UEFI runtime variable at a configurable periodic interval, sealing received payloads to a hash-chained audit ledger with Ed25519 and a post-quantum digital signature conforming to NIST FIPS 204, and clearing the variable upon successful sealing.

A method for generating a complete compliance document suite from a single continuous security telemetry stream, the method comprising: (a) receiving a single continuous stream of security event records from one or more endpoint security agents operating across an organization's computing environment, wherein no framework-specific data collection process is required for any individual target compliance framework; (b) mapping each security event record simultaneously to compliance control identifiers from a plurality of distinct security compliance frameworks at the time of ingestion, wherein a single security event record contributes evidence toward multiple distinct frameworks in a single ingestion operation; (c) accumulating cryptographically sealed audit evidence records for each compliance control identifier across all mapped frameworks from the same event record stream; (d) generating, from the accumulated sealed evidence, a complete compliance document suite comprising at minimum: (i) a System Security Plan for each supported compliance framework; (ii) a Plan of Action and Milestones for each supported compliance framework; (iii) a numerical security posture score for each supported compliance framework; (iv) a security control effectiveness certificate; and (v) an independently verifiable audit verification report; (e) deriving each document in the suite from the same underlying sealed evidence chain without requiring separate evidence collection for each document or framework; and (f) updating each document in the suite automatically as new evidence accumulates without human intervention, wherein the complete compliance document suite is produced from a single telemetry ingestion pipeline without requiring framework-specific data collection, human attestation, or separate data gathering processes for each supported framework or document type.

A system for single-stream multi-framework compliance document suite generation comprising: (a) a single telemetry ingestion pipeline receiving security event records from endpoint agents and simultaneously mapping each record to compliance control identifiers from a plurality of distinct security compliance frameworks without framework-specific collection; (b) a shared evidence accumulator maintaining cryptographically sealed audit evidence records for each compliance control identifier across all supported frameworks from the same ingested event stream; (c) a suite generator producing a complete compliance document suite for each supported framework from the shared evidence base without separate evidence collection per framework; and (d) an automatic updater refreshing all documents in the suite as new evidence accumulates or existing evidence expires, without human intervention.