SERVER-TO-SERVER INTEGRITY CHECKING

• US 20100153781A1
• Filed: 12/15/2008
• Published: 06/17/2010
• Est. Priority Date: 12/15/2008
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: HANNA, Stephen R.
• Granted Patent: US 7,996,713 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method performed by a primary server includes receiving integrity criteria and sending a health check request to a secondary server based on the received integrity criteria. The method also includes receiving integrity information from the secondary server and checking the integrity information against the integrity criteria. The method further includes initiating a non-compliance action if the integrity information does not comply with the integrity criteria.

Claims

1. A method performed by a primary server, the method comprising:

receiving integrity criteria;

sending a health check request to a secondary server based on the received integrity criteria;

receiving integrity information from the secondary server;

checking the integrity information against the integrity criteria; and

initiating a non-compliance action if the integrity information does not comply with the integrity criteria.

2. The method of claim 1, where the integrity criteria is selected for the primary server.

3. The method of claim 1, where the integrity criteria is selected for the secondary server.

4. The method of claim 1, where the integrity criteria is selected for a group of servers in a private network including the primary server.

5. The method of claim 1, where sending the health check request is triggered by a type of information to be transmitted between the primary server and the secondary server.

6. The method of claim 1, where sending the health check request is triggered by a particular number of requests between the primary server and the secondary server.

7. The method of claim 1, where sending the health check request is triggered by a change in system status of the primary server or the secondary server.

8. The method of claim 1, where the non-compliance action includes switching to an alternative secondary server to accomplish a data exchange.

9. The method of claim 1, where the non-compliance action includes one or more of:

generating a logging event,

sending a notification to a network administrator,

sending a notification to a client, or

aborting a data exchange with the secondary sever.

10. The method of claim 1, where the non-compliance action includes one or more of:

limiting a data transmission with the secondary server, and

initiating an automatic repair of the secondary server.

11. The method of claim 1, further comprising:

sending integrity information for the primary server in response to a health check request from the secondary server.

12. A system, comprising:

a health check verifier included in a primary device to;

obtain integrity criteria particularly selected for the primary device,

send a health check request to a secondary device based on the integrity criteria,

receive integrity information from the secondary device in response to sending the health check request to the secondary device,

check the integrity information against the integrity criteria, and

initiate a non-compliance action if the integrity information does not comply with the integrity criteria; and

a health check agent included in the secondary device to send integrity information to the primary device in response to the health check request.

13. The system of claim 12, where the secondary device is a peripheral device or another server located in a same private network as the primary sever.

14. The system of claim 12, where the primary server and the secondary device are connected by a private network.

15. The system of claim 12, where the primary server is a web server.

16. The system of claim 15, where the secondary device is one of a file server, a database server, an e-mail server, or a voice-over-Internet-protocol (VoIP) server.

17. The system of claim 12, further comprising:

a central management system within a private network to provide integrity criteria to the primary server.

18. The system of claim 12, further comprising:

an alternative secondary device, where the non-compliance action includes the primary server switching to the alternative secondary device to accomplish a data transmission.

19. A computer-readable memory comprising computer-executable instructions, the computer-readable memory comprising:

one or more instructions to store integrity criteria;

one or more instructions to send a health check request to a secondary device based on the stored integrity criteria;

one or more instructions to receive integrity information from the secondary device;

one or more instructions to compare the integrity information from the secondary device with the integrity criteria;

one or more instructions to initiate a non-compliance action if the integrity information from the secondary device does not comply with the integrity criteria; and

one or more instructions to send different integrity information to the secondary device in response to a health check request from the secondary device.

20. The computer-readable memory of claim 19, where the one or more instructions to send a health check request to the secondary device includes one or more instructions to send the health check request based on a type of information sought to be transmitted between the primary server and the secondary server.

21. A device, comprising:

means for storing integrity criteria for a primary device;

means for sending a health check request from the primary device to a secondary device based on the stored integrity criteria;

means for receiving, in response to the health check request, integrity information from the secondary device at the primary device;

means for comparing the integrity information from the secondary device with the stored integrity criteria; and

means for initiating a non-compliance action if the integrity information does not comply with the integrity criteria.

22. The device of claim 21, further comprising:

means for sending integrity information relating to the primary device to the secondary device in response to a health check request from the secondary device.