Consumer computer health validation

• US 20080244724A1
• Filed: 03/26/2007
• Published: 10/02/2008
• Est. Priority Date: 03/26/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Choe, Calvin Choon-Hwan, Mayfield, Paul G.
• Granted Patent: US 8,185,740 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Consumer computers that are not properly configured for safe access to a web service are protected from damage by controlling access to web services based on the health of the client computer. A client health web service receives health information from the client computer, determines the health status of the consumer computer, and issues a token to the consumer computer indicating its health status. The consumer computer can provide this token to other web services, which in turn may provide access to the consumer computer based on the health status indicated in the token. The client health web service may be operated as a web service specifically to determine the health of consumer computers or may have other functions, including providing access to the Internet. Also, the health information may be proxied to another device, such as a gateway device, that manages interactions with the client health web service.

Claims

1. A method of operating a client computer, comprising:

accessing a first web service;

providing a statement of health to the first web service;

receiving a health token from the first web service;

accessing a second web service; and

in response to a challenge from the second web service, providing the health token to a second web service.

2. The method of claim 1,

further comprising configuring the client computer with information on web services authorized to receive health information about the client;

and

wherein providing a statement of health to the first web service comprises selectively providing the statement of health when the first web service is authorized to receive health information about the client.

3. The method of claim 1,

further comprising configuring the client computer with information on web services authorized to receive health information about the client;

and

wherein providing the health token to the second web service comprises selectively providing the health token when the second web service is authorized to receive health information about the client.

4. The method of claim 1, wherein providing a statement of health comprises providing information on at least one of a firewall configuration and antivirus software on the client computer.

5. The method of claim 1, wherein receiving a health token from the first web service comprises receiving an X.509 certificate.

6. The method of claim 1, wherein receiving a health token from the first web service comprises receiving a browser cookie.

7. The method of claim 1, further comprising deleting the token from the client computer at an expiry time.

8. A method of operating a first web service, comprising:

receiving a request for a service from a consumer computer;

requesting from the consumer computer status information relating to the health of the client computer;

accessing a second web service to determine a health status of the consumer computer based on the status information; and

providing a health token to the client computer indicative of the health status of the consumer computer.

9. The method of claim 8, wherein the first web service and the second web service a coupled to the Internet and accessing the second web service comprises providing the status information to the second web service over the Internet.

10. The method of claim 8, wherein providing the health token comprises providing a health token identifying the consumer computer.

11. The method of claim 8, wherein providing the health token comprises providing a health token indicating that the consumer computer does not comply with at least one requirements.

12. The method of claim 11, wherein providing the health token comprises providing a health token indicating that the consumer computer does not comply with at least one of a required antivirus protection and a firewall configuration.

13. The method of claim 11, wherein providing a health token to the client computer comprises a token with information identifying the first web service.

14. A system for controlling access to the Internet by a client computer, comprising:

a gateway device coupled to the client computer, the gateway device being adapted and configured to connect the client computer to the Internet, and the gateway device having gateway computer-readable media having computer-executable instructions for;

receiving health information from the client computer;

determining a validation status of the client computer based on the health information; and

selectively controlling access by the client computer to the Internet based on the validation status.

15. The system of claim 14, wherein the computer-executable instructions for selectively controlling access comprise computer-executable instructions for providing a limited bandwidth connection when the validation status is un-validated.

16. The system of claim 15, wherein the gateway device comprises a modem.

17. The system of claim 14,

further comprising an authentication server coupled to the gateway device;

and

wherein the computer-executable instructions for determining a validation status of the health information comprise computer-executable instructions for providing the health status information to the authentication server.

18. The system of claim 14, wherein the client computer comprises client computer-readable media having computer-executable instructions for:

collecting health information relating to the client; and

providing the health information to the gateway device.

19. The system of claim 18, wherein in the computer-executable instructions for collecting health information comprises a plurality of health agent modules.

20. The system of claim 19, wherein the client computer comprises a consumer computer in a home.