EVALUATING A SECURITY STACK IN REPSONSE TO A REQUEST TO ACCESS A SERVICE

• US 20140033272A1
• Filed: 07/30/2012
• Published: 01/30/2014
• Est. Priority Date: 07/30/2012
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Harris, Timothy E., Cath, Jeremy E.
• Granted Patent: US 9,075,996 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A process to evaluate a request to access a service received from a user'"'"'s computing device having a software stack and a software stack provider over a computer network is disclosed. Prior to providing access to the service, a determination is made as to whether the software stack meets a set of conditions. If the set of conditions are met, the software stack provides verification information. The software stack provider is asked to validate the verification information. Access to the service if the software stack provider validates that the set of conditions are met.

Claims

1. A process to evaluate a request to access a service received from a computing device having a software stack and including a software stack provider over a network, the process comprising:

determining from the computing device whether a set of conditions are met with the software stack prior to providing access to the service;

receiving verification information from the software stack if the set of conditions are claimed to be met;

requesting validation from the software stack provider using the verification information from the software stack if the set of conditions are claimed to be met with the software stack; and

providing access to the service if the software stack provider validates the set of conditions are met.

2. The process of claim 1 wherein the service determines whether user claims to meets the set of conditions and whether the software stack provider validates the set of conditions are met.

3. The process of claim 1 wherein determining from the computing device whether the set of conditions are claimed to be met is in response to a request to access the service.

4. The process of claim 3 wherein the request to access the service is an interface with the service after log in.

5. The process of claim 1 wherein interactions between the service, the computing device, and the software stack provider occur via Hypertext Transfer Protocol Secure.

6. The process of claim 5 wherein the service, the computing device, and the software stack provider can validate certificates with a certificate authority.

7. The process of claim 1 wherein notice of installation of the software stack is delivered to the software stack provider prior to the request to access the service.

8. The process of claim 1 wherein software stack includes an address of the software stack provider.

9. The process of claim 8 wherein the verification information includes the address and the set of conditions the software stack claims to meet.

10. The process of claim 9 wherein the request to access is denied if one of the address and the set of conditions the software stack claims to meet is unacceptable to the service.

11. The process of claim 1 wherein the software stack provider responds to the request for validation by interrogating the software stack.

12. The process of claim 11 wherein the software stack provider notifies the service as to whether the conditions are met can be validated.

13. A process to evaluate a request to access a service received from a computing device having a software stack and including a software stack provider over a network, the process comprising:

in response to a request from the computing device to access the service, determining whether the software stack meets a set of conditions;

if the software stack meets the set of conditions, receiving verification information from the software stack including the set of conditions the software stack claims to meet and an address of the software stack provider;

requesting the software stack provider at the address determine to validate the verification information; and

providing computing device access to the service if the software stack provider validates the verification information.

14. The process of claim 13 and further comprising denying access to the service if the software stack fails to meet the set of conditions or if the software stack provider fails to validate the verification information.

15. The process of claim 13 wherein determining whether the software stack meets the set of conditions includes sending tags including the set of conditions to be met and receiving a response to the tags.

16. The process of claim 15 wherein tags are interpreted by one of a group consisting of a Hypertext Transfer Protocol stack, a trusted proxy, and a web browser.

17. The process of claim 15 wherein the software stack delivers the verification information to the software stack provider.

18. The process of claim 17 wherein the software stack further delivers to the software stack provider a listener address and a session identifier received from the service.

19. A process to evaluate a request a user'"'"'s computing device to access a service, wherein the user'"'"'s computing device includes a security software stack and including a software stack provider over a network, the process comprising:

in response to the request to access the service, providing a set of tags to be interpreted by the user'"'"'s computing device to determine whether the security software stack meets a set of conditions of the service;

receiving a response to the tags from the user'"'"'s computing device, the response including verification information if the set of conditions are claimed to be met, wherein verification information includes the set of conditions claimed to be met and an address of the software stack provider;

responding to the verification information by including a listener address of the service to be delivered to the software stack provider;

requesting validation of the verification information from the software stack provider if the set of conditions are met wherein validation includes the software stack provider interrogating the software stack to determine whether the conditions are met and providing results of the validation to the service over the listener address; and

providing access to the service if the software stack provider validates the set of conditions are met.

20. The process of claim 19 wherein the responding to the verification information by further including a session identifier for the user request to access the service.