SYSTEM AND METHOD FOR GENERATING TRUST AMONG DATA NETWORK USERS

• US 20130042298A1
• Filed: 12/15/2009
• Published: 02/14/2013
• Est. Priority Date: 12/15/2009
• Status: Abandoned Application

• Current Assignee: Telefonica SA
• Original Assignee: Telefonica SA
• Inventors: Plaza Fonseca, Carlos, Amaya Calvo, Manuel
• Application Number:
  US13/516,519
• Publication Number:
  US 20130042298A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/5064 Customer relationship management
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/20 Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel

Abstract

A system and a method in which a user makes a service request with a service provider through a data network. The service provider receives from trust generating equipment, located in an access provider, an assessment of the security level of the user; said equipment in turn receiving a delivery of information about the trust level provided by said user; and in order for the aforementioned equipment to collect information about the user identity, the network traffic generated by the user, the security status of the user device and the geographical location of the user device, this information being analyzed and summarized in a trust label which is sent to the service provider.

Claims

1-7. -7. (canceled)

8. A system for generating trust among data network users, wherein a user provided with a device makes at a given time a service request to a service provider through a first data network such as the Internet, characterized in that it comprises a trust generating equipment installed in an access provider adapted to access said first data network that the aforementioned user is using, said trust generating equipment being connected to said service provider through a second data network or access provider, and said trust generating equipment being adapted to collect and analyze, through a third data network or internal network of the access provider, information about a security level provided by said user together with said service request, said information about a security level comprising several security information regarding at least the following four fields:

the user identity;

the network traffic generated by the user in a period prior to said service request time during one or more online transactions, for the analysis of his behavior;

the security status of the user device comprising at least a antivirus status, a firewall status of the device, and an operating status of one or more components of the device, which information allows to generate an evaluation of a risk level; and

the geographical location of the user device, for a given user at said given time,

wherein said trust generating equipment comprising a trust label generating module is adapted to generate a trust label or numerical value, based on said at least following four fields of said security information, and adapted to send said trust label or numerical value to the service provider, through said second data network, so that said service provider provides an assessment of the security level of the user and can act accordingly with respect to said service request.

9. The system for generating trust among data network users according to claim 8, characterized in that said trust generating equipment is structured in a trust measurement device, an identity management subsystem and a network access control subsystem;

while the device of the user is a personal computer or an analogous device;

said device and subsystems, constituting a plurality of functional modules communicated by means of a plurality of data flows.

10. The system for generating trust among data network users according to claim 9, characterized in that said plurality of functional modules comprise:

a PC status collection module located in the device of the user that is a computer or analogous user device which is adapted to collect information about the security status of the PC, such as firewall status, antivirus status, remaining component status defined in the policy that is established or others;

said module being integrated directly on the chosen antivirus/firewall solution if this solution has any type of mechanism for informing about the status of the PC, or said module also being implemented by means of dedicated software;

a PC network access authorization module located in the user computer or analogous user device, comprising a component requesting permission from the data network for accessing it and which, as part of the request, adapted to transmit the security status of the PC, reported by means of the PC status collection module on to the internal network of the access provider such that the internal network of the access provider can verify if the PC complies with the security policies and act accordingly giving complete access, restricted access or completely denying access to the PC, depending on what the policy states;

a location service module comprising an external component of the system providing the system with the information about the geographical location of the user device for a specific user at a given time;

such that the location is then made anonymous and included in a historical behavior database as part of a starting line of the behavior of the user;

a network status collection module which is located in the trust measurement device and is adapted to collect statistical data of the use of the first data network for a given user, such that the starting line of the behavior of the user can be modeled so that the system can detect alterations from this starting line and act on them;

a historical behavior database module which is located in the trust measurement device and adapted to store the statistical data of the use of the first data network made anonymous, such that said data will define the starting line of the behavior for the users;

a behavior correlating module which is located in that trust measurement device and adapted to correlate/integrate all the components of the behavior for the users such that a starting line of the behavior can be adapted to establish, allowing the detection of deviations from that starting line;

further enabling the system to detect aberrant behaviors which could indicate problems in the user devices;

a status collection module belonging to the trust measurement device which is adapted to cluster the information about the status of the user device such that it can be requested when the system needs to generate an evaluation of the risk level, thus providing an indicator of the trust level;

said trust label generating module also belonging to the trust measurement device, which is an interface with all the external client systems or service providers and adapted to calculate a single numerical value from all the security information of a given user, including the aforementioned four fields of identity, location, security status and behavior, such that the numerical value calculated will be used to give an idea of the risk level of the user, termed as security level, or trust level, this trust level then being able to be passed on to third parties if the user allows it;

a user/profile management module which is located in the identity management subsystem and allows the end users to manage their profile in the system;

such that it allows a single residential client to manage a user list associated with its subscriber line and, for each of them, it can manage their identities, in different identity providers, to be spread;

a service user module located in the identity management subsystem, comprising a repository of the information of the users for the service;

an authenticating module located in said identity management subsystem comprising a module adapted to validate the user identity according to the authentication mechanism defined for them, including a user/password, a digital certificate, a biometric certificate, or a combination thereof;

an external digital identity provider module which is located in that identity management subsystem and comprising an external digital identity provider module with which the system will have an interface for spreading the user identities;

a first data network access approval module which is located in the network access control subsystem, being a module adapted to validate the network access requests from the user devices, granting different access levels using the security policy of the network, user preferences and the security status itself of the device as input for the decision; and

a policy server module belonging to the first data network access control subsystem, which will be used by the managers or administrator of the system for defining the global security policies for granting network access.

11. A method for generating trust among data network users, wherein a user provided with a device such as a computer PC makes a service request with a service provider through a first data network such as the Internet;

characterized in that the sequence of operations for a user attempting to access any service from the time the user attempts to access said first network is as follows;

a PC network access authorization module, requesting credentials and collecting information about the current security level of the user device;

said PC network access authorization module transmitting information about the security level and the user credentials to a network access approval module checking the credentials and further checking if the security level of the device complies with a policy obtained from a policy server module;

a network access approval module transmitting said security level and said credentials on to a network status collection module, which also grants network access to the user device;

said network status collection module while the user is browsing on the network, creating a statistical behavioral analysis of the user browsing habits, which will be stored in a historical behavior database, data about the location of the user device obtained from an external geographical location service module further being included in said statistical behavioral analysis;

a PC status collection module, in simultaneity with the preceding point, keeping another status collection module informed of any security change in the user device;

said service provider, when the user accesses a service hosted within it, requesting a trust label/security evaluation of the user from a trust label generating module, said trust label generating module in turn requesting the current security level of the user device from said status collection module and requesting information about the current behavior of the user in a browsing session compared with the history from a behavior correlating module; and

said trust label generating module then calculating a numerical value for the security level/trust level of the user taking into account all the fields of collected information, said collected information including at least said user identity, user network traffic behavior, security status of said user device and geographical location of said user device, obtained from said network status collection module and transmitting said numerical value on to said service provider so that said service provider has an assessment of the security level of the user and can act accordingly with respect to said service request by said user.

12. The method for generating trust among data network users according to claim 11, characterized in that said location obtained from an external geographical location service module is made anonymous and included in said historical behavior database as part of a starting line of the behavior of the user.

13. The method for generating trust among data network users according to claim 11, wherein said collection of information about the security level and the credentials of the device used by a user includes mechanisms for assuring the integrity of the data.

14. The method for generating trust among data network users according to claim 11, wherein said PC status collection module will periodically inform said status collection module of the changes in the security level of the user device.