Securing Communication over a Network Using Client Integrity Verification

• US 20140223513A1
• Filed: 03/11/2013
• Published: 08/07/2014
• Est. Priority Date: 02/01/2013
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Vidder, Inc. (Verizon Communications Inc.)
• Inventors: Islam, Junaid, Bilger, Brent, Schroeder, Ted
• Granted Patent: US 9,282,120 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/562 Brokering proxy services

Abstract

A method for protecting application servers from network-based attacks and verifying the security posture of end client systems is disclosed. A trust broker system receives a request from a user agent associated with a client system remote from the trust broker to connect to applications and resources associated with the trust broker. The trust broker system verifies the integrity of the client system and verifies the identity of a user of the client system. The trust broker system then determines the access level permitted to the identified user and based on the access level. The trust broker system establishes a connection with the user agent and transmits session information to the server system. The trust broker system sends the user agent connection information, wherein the connection information enables the requesting user agent to connect to the requested server system.

Claims

1. A method for securing communication over a network, comprising:

at a trust broker system having one or more processors and memory storing one or more programs for execution by the one or more processors;

receiving a request from a user agent associated with a client system remote from the trust broker to connect to applications and resources associated with the trust broker;

in response to the request to connect with the server system;

verifying the integrity of the client system;

verifying the identity of a user of the client system, and

in response to verifying the identity of the user and the integrity of the client system;

determining the access level permitted to the identified user;

based on the access level, determining which applications and resources the identified user is authorized to access;

in accordance with a determination that the user is authorized to access the requested applications and resources;

establishing a connection with the user agent;

transmitting session information to the server system that provides the requested applications and resources, wherein the transmitted session information identifies the requesting user agent; and

sending the user agent connection information, wherein the connection information enables the requesting user agent to connect to the requested server system.

2. The method of claim 1, wherein verifying the identity of the user of a client system includes:

receiving a unique user identifier from the user agent; and

determining, based on the unique user identifier, the identity of the requesting user.

3. The method of claim 2, wherein verifying the identity of the client system includes:

receiving, from the user agent, a generated system fingerprint for the client system; and

determining, based on the generated system fingerprint, the specific device that is currently executing the user agent.

4. The method of claim 3, wherein the trust broker system includes a user device database that associates specific users with devices and wherein verifying the identity of the user further includes:

determining whether the identified user is associated with the determined specific device currently executing the user agent.

5. The method of claim 1, wherein verifying the identity of the client system includes determining the geographic location of the client system.

6. The method of claim 1, wherein the server system and the trust broker system are components in a secure network.

7. The method of claim 1, wherein the specific device is one of a personal computer, smart phone, a laptop, and a tablet computer.

8. An electronic device for securing communication over a network, comprising:

one or more processors;

memory storing one or more programs to be executed by the one or more processors;

the one or more programs comprising instructions for;

receiving a request from a user agent associated with a client system remote from the trust broker to connect to applications and resources associated with the trust broker;

in response to the request to connect with the server system;

verifying the integrity of the client system;

verifying the identity of a user of the client system, and

in response to verifying the identity of the user and the integrity of the client system;

determining the access level permitted to the identified user;

based on the access level, determining which applications and resources the identified user is authorized to access;

in accordance with a determination that the user is authorized to access the requested applications and resources;

establishing a connection with the user agent;

transmitting session information to the server system that provides the requested applications and resources, wherein the transmitted session information identifies the requesting user agent; and

sending the user agent connection information, wherein the connection information enables the requesting user agent to connect to the requested server system.

9. The device of claim 8, wherein the instructions for verifying the identity of the user of a client system include instructions for:

receiving a unique user identifier from the user agent; and

determining, based on the unique user identifier, the identity of the requesting user.

10. The device of claim 9, wherein the instructions for verifying the identity of the client system includes instructions for:

receiving, from the user agent, a generated system fingerprint for the client system; and

determining, based on the generated system fingerprint, the specific device that is currently executing the user agent.

11. The device of claim 10, wherein the trust broker system includes a user device database that associates specific users with devices and wherein the instructions for verifying the identity of the user further include instructions for:

determining whether the identified user is associated with the determined specific device currently executing the user agent.

12. The device of claim 8, wherein verifying the identity of the client system includes determining the geographic location of the client system.

13. The device of claim 8, wherein the server system and the trust broker system are components in a secure network.

14. The device of claim 8, wherein the specific device is one of a personal computer, smart phone, a laptop, and a tablet computer.

15. A non-transitory computer readable storage medium storing one or more programs configured for execution by an electronic device with a camera, the one or more programs comprising instructions for:

receiving a request from a user agent associated with a client system remote from the trust broker to connect to applications and resources associated with the trust broker;

in response to the request to connect with the server system;

verifying the integrity of the client system;

verifying the identity of a user of the client system, and

in response to verifying the identity of the user and the integrity of the client system;

determining the access level permitted to the identified user;

based on the access level, determining which applications and resources the identified user is authorized to access;

in accordance with a determination that the user is authorized to access the requested applications and resources;

establishing a connection with the user agent;

transmitting session information to the server system that provides the requested applications and resources, wherein the transmitted session information identifies the requesting user agent; and

sending the user agent connection information, wherein the connection information enables the requesting user agent to connect to the requested server system.

16. The non-transitory computer readable storage medium of claim 15, wherein the instructions for verifying the identity of the user of a client system include instruction for:

receiving a unique user identifier from the user agent; and

determining, based on the unique user identifier, the identity of the requesting user.

17. The non-transitory computer readable storage medium of claim 16, wherein the instructions for verifying the identity of the client system include instruction for:

receiving, from the user agent, a generated system fingerprint for the client system; and

determining, based on the generated system fingerprint, the specific device that is currently executing the user agent.

18. The non-transitory computer readable storage medium of claim 17, wherein the trust broker system includes a user device database that associates specific users with devices and wherein the instructions for verifying the identity of the user further include instructions for:

determining whether the identified user is associated with the determined specific device currently executing the user agent.

19. The non-transitory computer readable storage medium of claim 15, wherein verifying the identity of the client system includes determining the geographic location of the client system.

20. The non-transitory computer readable storage medium of claim 15, wherein the server system and the trust broker system are components in a secure network.