Method and apparatus for network assessment and authentication

• US 7,634,800 B2
• Filed: 05/08/2006
• Issued: 12/15/2009
• Est. Priority Date: 06/30/2000
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ide, Curtis E., Brass, Philip C., Doty, Theodore R.
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): Jackson; Jenise E
• Application Number:
  US11/430,297
• Publication Number:
  US 20060272011A1
• Time in Patent Office: 1,317 Days
• Field of Search: 726/3
• US Class Current: 726/3
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Providing a user with assurance that a networked computer is secure, typically before completion of the log-in operation. This can be accomplished by extending the local log-in process to perform a host assessment of the workstation prior to requesting the user'"'"'s credentials. If the assessment finds a vulnerability, the log-in process can inform the user that the machine is or may be compromised, or repair the vulnerability, prior to completion of the log-in operation. By performing vulnerability assessment at the level of the workstation, a network server is able to determine whether the workstation is a “trusted” platform from which to accept authentication requests. If the vulnerability assessment shows that the workstation is compromised, or if the possibility of remote compromise is high, the network server can elect to fail the authentication on the grounds that the workstation cannot be trusted. Optionally, a vulnerability assessment tool may be able to repair the vulnerability of the workstation, and then allow the authentication to proceed.

Claims

1. A network security system for authenticating a workstation requesting a network service from a network server via a computer network, comprising:

the network service operative to generate workstation security credentials by completing a vulnerability assessment comprising a scan of the workstation to identity at least one of security vulnerabilities that would compromise the secure operation of the workstation on the computer network and evidence of a compromise, the workstation security credentials comprising one of integrity information describing whether the workstation has been compromised, and security posture information describing the workstation'"'"'s potential for compromise;

the network service further operative to determine whether the workstation should be granted access to a software service of the network based on the workstation security credentials.

2. The network security system of claim 1, further comprising a workstation security policy at the network server, the workstation security policy operative to define security requirements for secure operation of the workstation on the computer network.

3. The network security system of claim 1, wherein the network service is further operative to compare the workstation security credentials to a workstation security policy to determine whether the workstation should be granted access to the software service, the network service operative to authorize access to the software service by the workstation if the workstation security credentials satisfy the workstation security policy.

4. The network security system of claim 1, wherein the network service is further operative to authorize access to a predetermined level of the software service if the workstation security credentials satisfy a portion of a workstation security policy.

5. The network security system of claim 1, wherein the network service is further operative to communicate a service decision from the network server to the workstation via the computer network, the service decision defining whether the workstation is allowed to access the software service or a degraded form of the software service.

6. The network security system of claim 1, wherein a workstation security policy is maintained on the network server and wherein the network service is further operative to compare the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the software service or a degraded form of the software service.

7. The network security system of claim 1, wherein the network service is further operative to communicate a service decision from the network server to the workstation via the computer network, the service decision defining a degraded form of the software service.

8. The network security system of claim 1, wherein completing a vulnerability assessment comprising the scan of the workstation further comprises calculating a score associated with vulnerability of the workstation.

9. The network security system of claim 1, wherein completing a vulnerability assessment comprising a scan of the workstation further comprises calculating a score associated with vulnerability of the workstation and assigning a level of the network service based on the score.

10. A computer-implemented process for authenticating a workstation requesting a network service from a network server via a computer network, comprising the steps:

completing a vulnerability assessment comprising a scan of the workstation to identify at least one of security vulnerabilities that would compromise the secure operation of the workstation on the computer network and evidence of a compromise;

generating workstation security credentials based on the vulnerability assessment, the workstation security credentials comprising one of integrity information describing whether the workstation has been compromised, and security posture information describing the workstation'"'"'s potential for compromise;

comparing the workstation security credentials to a workstation security policy to determine whether the workstation should be granted access to the network service; and

authorizing access to the network service by the workstation if the workstation security credentials satisfy the workstation security policy, otherwise denying access to the network service by the workstation.

11. The computer-implemented process of claim 10, further comprising the step of authorizing access to a predetermined level of the network service if the workstation security credentials satisfy a portion of the workstation security policy.

12. The computer-implemented process of claim 10, wherein completing the vulnerability assessment comprising the scan of the workstation further comprises calculating a score associated with vulnerability of the workstation and assigning a level of the network service based on the score.

13. The computer-implemented process of claim 10, wherein the step of generating the workstation security credentials comprises completing the vulnerability assessment of the workstation by a network workstation assessment service maintained on an assessment server coupled to the computer network, the assessment server operating as a remote server different from the network server, the network workstation assessment service operative to generate the workstation security credentials.

14. The computer-implemented process of claim 10, wherein the step of generating the workstation security credentials comprises completing the vulnerability assessment of the workstation by a local workstation assessment service maintained on the workstation, the local workstation assessment service operative to generate the workstation security credentials.

15. The computer-implemented process of claim 10, wherein the workstation security policy is maintained on the network server, the process further comprising the steps of:

transmitting the workstation security credentials from the network workstation assessment service on an assessment server to the network service on the network server via the computer network; and

comparing at the network server the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the network service.

16. The computer-implemented process of claim 10, further comprising the step of communicating a service decision from the network server to the workstation via the computer network, the service decision defining whether the workstation is allowed to access the network service or a degraded form of the network service.

17. The computer-implemented process of claim 10, wherein the step of generating the workstation security credentials comprises completing the vulnerability assessment of the workstation by the network service on the network server in response to receiving a request for the network service from the workstation via the computer network.

18. The computer-implemented process of claim 10, wherein the workstation security policy is maintained on the network server, the process further comprising the step of comparing at the network server the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the network service or a degraded form of the network service.

19. A network security system for authenticating a workstation requesting a network service from a network server via a computer network, comprising:

a local workstation assessment service, operative on the workstation, for generating workstation security credentials by completing a vulnerability assessment of the workstation comprising a scan to identify at least one of security vulnerabilities that would compromise the secure operation of the workstation on the computer network and evidence of a compromise, the workstation security credentials comprising one of integrity information describing whether the workstation has been compromised, and security posture information describing the workstation'"'"'s potential for compromise; and

a workstation security policy, operative on the workstation, for defining security policy requirements for secure operations by the workstation;

the local workstation assessment service further operative for comparing the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the network service,

the local workstation assessment service further operative to authorize access to the network service by the workstation if the workstation security credentials satisfy the workstation security policy.

20. The network security system of claim 19, wherein the local workstation assessment service is further operative to authorize access to a predetermined level of the network service if the workstation security credentials satisfy a portion of the workstation security policy.