Device Communication Based On Device Trustworthiness

• US 20140173686A1
• Filed: 12/19/2013
• Published: 06/19/2014
• Est. Priority Date: 12/19/2012
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Kgil, Taeho, Aissi, Selim
• Granted Patent: US 9,386,045 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

Techniques for assessing the trustworthiness of a target device that a user device is attempting to communicate with are described. A user device may request one or more trustworthiness attributes of a target device before exchanging data with the target device. The user device may receive the one or more trustworthiness attributes of the target device, and determine, based on the received one or more trustworthiness attributes of the target device, a set of one or more security policies to enforce on a communication channel used for exchanging data between the user device and the target device. A communication channel between the user device and the target device can then be established according to the set of one or more security policies.

Claims

1. A method comprising:

requesting, by a user device, one or more trustworthiness attributes of a target device before exchanging data with the target device;

receiving the one or more trustworthiness attributes of the target device;

determining, based on the received one or more trustworthiness attributes of the target device, a set of one or more security policies to enforce on a communication channel used for exchanging data between the user device and the target device; and

establishing the communication channel between the user device and the target device according to the set of one or more security policies.

2. The method of claim 1, further comprising:

performing an authentication process between the user device and the target device before requesting the one or more trustworthiness attributes.

3. The method of claim 2, further comprising:

after receiving the one or more trustworthiness attributes of the target device, requesting additional credentials from the target device before establishing the communication channel.

4. The method of claim 1, further comprising:

determining a trustworthiness score of the target device based on the received one or more trustworthiness attributes of the target device; and

comparing the trustworthiness score of the target device against a set of trustworthiness thresholds to determine the set of one or more security policies to enforce on the communication channel.

5. The method of claim 1, wherein when the user device is at a first location, the one or more trustworthiness attributes being requested before exchanging data with the target device includes a first set of trustworthiness attributes, and when the user device is at a second location, the one or more trustworthiness attributes being requested before exchanging data with the target device includes a second set of trustworthiness attributes having at least one trustworthiness attribute that is not in the first set of trustworthiness attributes.

6. The method of claim 1, wherein the one or more trustworthiness attributes being requested before exchanging data with the target device vary depending on a device type of the target device.

7. The method of claim 1, wherein the one or more trustworthiness attributes includes a plurality of trustworthiness attributes, and each of the plurality of trustworthiness attributes is requested and received serially.

8. The method of claim 1, wherein the one or more trustworthiness attributes include at least one of an ownership of the target device, an integrity measurement of the target device, or a trustworthiness reputation of the target device.

9. The method of claim 1, wherein the set of one or more security policies include at least one of an access rule, an encryption rule, or a digital signature rule for the data being exchanged on the communication channel.

10. A user device comprising:

communication circuitry for implementing a communication channel used for exchanging data with a target device;

one or more processors; and

one or more memories coupled to the one or more processors and including executable code which when executed by the one or more processors causes the user device to;

request one or more trustworthiness attributes of a target device before establishing the communication channel with the target device;

receive the one or more trustworthiness attributes of the target device;

determine, based on the received one or more trustworthiness attributes of the target device, a set of one or more security policies to enforce on the communication channel when exchanging data with the target device;

establish the communication channel using the communication circuitry after determining the set of one or more security policies; and

enforce the set of one or more security policies on the communication channel when exchanging data with the target device.

11. The user device of claim 10, wherein the one or more memories further include executable code which when executed by the one or more processors causes the user device to:

determine a trustworthiness score of the target device based on the received one or more trustworthiness attributes of the target device; and

compare the trustworthiness score of the target device against a set of trustworthiness thresholds to determine the set of one or more security policies to enforce on the communication channel.

12. The user device of claim 11, wherein the one or more memories further include executable code which when executed by the one or more processors cause the user device to store the trustworthiness score of the target device in a known-device database, wherein the stored trustworthiness score is used instead of requesting the one or more trustworthiness attributes when establishing a subsequent communication channel with the target device.

13. The user device of claim 12, wherein the stored trustworthiness score is valid for a predetermined time period, and the stored trustworthiness score is not used for establishing a subsequent communication channel with the target device after the predetermined time period has elapsed.

14. The user device of claim 10, wherein when the user device is at a first location, the one or more trustworthiness attributes being requested before establishing the communication channel includes a first set of trustworthiness attributes, and when the user device is at a second location, the one or more trustworthiness attributes being requested before establishing the communication channel includes a second set of trustworthiness attributes having at least one trustworthiness attribute that is not in the first set of trustworthiness attributes.

15. The user device of claim 10, wherein when the one or more trustworthiness attributes being requested before establishing the communication channel vary depending on a device type of the target device.

16. The user device of claim 10, wherein the one or more trustworthiness attributes include at least one of an ownership of the target device, an integrity measurement of the target device, or a trustworthiness reputation of the target device.

17. The user device of claim 10, wherein the set of one or more security policies include at least one of an access rule, an encryption rule, or a digital signature rule for the data being exchanged on the communication channel.

18. A method comprising:

receiving, by a target device, a request from a user device for one or more trustworthiness attributes of the target device before exchanging data with a user device;

determining the one or more trustworthiness attributes of the target device;

sending the determined one or more trustworthiness attributes of the target device to the user device;

receiving one or more security policies to enforce on a communication channel used for exchanging data between the user device and the target device; and

establishing the communication channel between the user device and the target device according to the one or more security policies.

19. The method of claim 18, wherein the one or more trustworthiness attributes include at least one of an ownership of the target device, an integrity measurement of the target device, or a trustworthiness reputation of the target device.

20. The method of claim 19, wherein the set of one or more security policies include at least one of an access rule for one or more memory regions of the user device, an encryption rule for the data being exchanged on the communication channel, or a digital signature rule for the data being exchanged on the communication channel.