System, method and software for supplying activation information to a subsystem

• US 20020112179A1
• Filed: 03/29/2001
• Published: 08/15/2002
• Est. Priority Date: 03/30/2000
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Riordan, James F., Alessandri, Dominique
• Granted Patent: US 7,516,490 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

The invention provides a form of reacting on security or vulnerability information relevant for a system comprising computer software and/or hardware or electronics, wherein a service provider with a first subsystem (1) is providing activation tokens to be received by a customer with a second subsystem (2). The activation tokens including activation information and naming of system characteristics in machine readable and filterable manner. The second subsystem (2) comprises receiving means (11) for controlling the receiving of the activation tokens, checking means (12) for automatically determining whether the activation information is relevant for the second subsystem (2) by checking whether the second subsystem has characteristics corresponding to the naming of an activation token, and transforming means (13) for transforming relevant activation information into at least one activation measure for the second subsystem (2). The activation measures will reduce the vulnerability of the second subsystem.

Claims

1. A service provider system with a first subsystem (1) comprising:

means for providing activation tokens (6, 7, 8) to be transmitted to at least one customer with a second subsystem (2) for receiving said activation tokens, said means for providing activation tokens (6, 7, 8) including means for providing activation information (7) and means for naming of system characteristics in machine readable and filterable manner (6),

wherein the relevance of said activation information to said second subsystem (2) can be determined by checking whether said second subsystem (2) has characteristics corresponding to said naming of said activation token.

2. Service provider system as claimed in claim 1, wherein said means for providing activation tokens (6, 7, 8) include cryptographic means (8) for encrypting the activation tokens and signing means for producing a verification information like a signature, to be verified by said second subsystem (2) of said customer.

3. A customer system with a second subsystem (2) for receiving activation tokens provided by a service provider with a first subsystem (1), said activation tokens including activation information and naming of system characteristics in machine readable and filterable manner,

said second subsystem (2) comprising:

receiving means (11) for controlling said receiving of said activation tokens,

checking means (12) for automatically determining whether said activation information is relevant for said second subsystem (2) by checking whether said second subsystem (2) has characteristics corresponding to said naming of an activation token, and

transforming means (13) for transforming relevant activation information into at least one activation measure for said second subsystem (2).

4. Customer system as claimed in claim 3, wherein said receiving means (11) include cryptographic means for verifying said service provider as being the provider of said activation token and/or admitting means for controlling whether said service provider is legitimated to send activation tokens to said customer.

5. Customer system as claimed in claim 3, wherein said transforming means (13) include at least one set of filter parameters to enable transforming of said relevant activation information into at least one acceptable activation measure.

6. Customer system as claimed in claim 3, wherein said second subsystem (2) includes implementation means (14) for implementing at least one activation measure, and/or wherein said second subsystem (2) is a webserver.

7. Customer system as claimed in claim 6, wherein said implementation means (14) include at least one reporting means for reporting implemented activation measures.

8. Customer system as claimed in claim 3, wherein said checking means (12) is checking whether said second subsystem (2) has a version, platform and/or a configuration corresponding to said naming of an activation token.

9. Customer system as claimed in claim 3, wherein said receiving means (11), checking means (12) and transforming means (13) of said second subsystem (2) are part of an apoptosis system realized by at least one means out of the group of a daemon, a kernel module, an inittab, an inetd, tcp-wrapper, a rpcbind, a resource manager, a network management, like Tivoli or HP Openview, and a hardware device.

10. A system for supplying activation information to a subsystem, said system comprising:

a service provider with a first subsystem (1) for providing activation tokens and at least one customer with a second subsystem (2) for receiving said activation tokens,

said activation tokens including activation information and naming of system characteristics in machine readable and filterable manner,

wherein said second subsystem (2) comprises

receiving means (11) for controlling said receiving of said activation tokens,

checking means (12) for automatically determining whether said activation information is relevant for said second subsystem (2) by checking whether said second subsystem (2) has characteristics corresponding to said naming of an activation token, and

transforming means (13) for transforming relevant activation information into at least one activation measure for said second subsystem (2).

11. System as claimed in claim 10, wherein said receiving means (11) include cryptographic means for verifying said service provider as being the provider of said activation token, and/or wherein said receiving means (11) include admitting means for controlling whether said service provider is legitimated to send activation tokens to said customer.

12. System as claimed in claim 10, wherein said transforming means (13) include at least one set of filter parameters to enable transforming of said relevant activation information into at least one acceptable activation measure.

13. System as claimed in claim 10, wherein said second subsystem (2) includes implementation means (14) for implementing at least one activation measure.

14. System as claimed in claim 13, wherein said implementation means (14) include at least one reporting means for reporting implemented activation measures.

15. System as claimed in claim 10, wherein said naming includes the specification of a version, platform and a configuration corresponding to said second subsystem (2).

16. System as claimed in claim 10, wherein said receiving means (11), checking means (12) and transforming (13) means of said second subsystem (2) are part of an apoptosis system realized by at least one means out of the group of a daemon, a kernel module, an inittab, an inetd, tcp-wrapper, a rpcbind, a resource manager, a network management, like Tivoli or HP Openview, and a hardware device.

17. System as claimed in claim 13, wherein said system is reducing the vulnerability of said second subsystem (2) by automatically implementing activation measures at said second subsystem (2).

19. Method as claimed in claim 18, wherein said step of providing activation tokens includes a cryptographic step for encrypting the activation tokens and/or a signing step for producing a verification information like a signature, to be verified by said second subsystem (2) of said customer.

20. Method as claimed in claim 18, wherein the step of providing activation tokens further comprises

the step of naming by specifying a version, platform and a configuration and/or the step of structuring activation information.

18. A method for providing activation information by a service provider with a first subsystem (1) to a customer with a second subsystem (2) comprising the step of:

providing activation tokens by said service provider, wherein said activation tokens include readable activation information and naming of corresponding system characteristics in machine readable and filterable manner.

28. A computer program comprising program code means for performing the method of any one of the claims 18 to 27 when said program is run on a computer.

29. A computer program product comprising program code means stored on a computer readable medium for performing the method of any one of the claims 18 to 27 when said program product is run on a computer.

21. A method for using activation information by a customer with a second subsystem (2), said activation information being provided by service provider with a first subsystem (1) in the form of activation tokens including said activation information and naming of corresponding system characteristics in machine readable and filterable manner, said method comprising the steps of:

receiving said activation tokens by said second subsystem (2),

automatically determining whether said activation information is relevant for the second subsystem (2) by automatically checking by said second subsystem (2) whether said second subsystem (2) has characteristics corresponding to said naming of an activation token, and

transforming relevant activation information into at least one activation measure for said second subsystem (2).

22. Method as claimed in claim 21, further comprising the step of verifying at said second subsystem (2) whether said activation token is provided by said service provider and/or whether said service provider is legitimated to send activation tokens to said customer.

23. Method as claimed in claim 21, wherein said transforming includes filtering of said activation information by at least one set of filter parameters to get at least one acceptable activation measure.

24. Method as claimed in claim 21, further comprising the step(s) of implementing at least one activation measure and/or reporting implemented activation measures.

25. Method as claimed in claim 21, wherein said checking by said second subsystem (2) includes checking whether said second subsystem (2) has a version, platform and/or a configuration corresponding to said naming of an activation token.

26. Method as claimed in claim 21, further comprising a step of automatically implementing at least one activation measure at said second subsystem (2).

27. Method as claimed in claim 26, wherein the step of automatically implementing at least one activation measure leads to a reduction of vulnerability of said second subsystem (2) and/or enables a shutdown of a service of said second subsystem (2).