Network Client Software and System Validation

• US 20140223514A1
• Filed: 03/11/2013
• Published: 08/07/2014
• Est. Priority Date: 02/01/2013
• Status: Abandoned Application

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Islam, Junaid, Bilger, Brent, Schroeder, Ted
• Application Number:
  US13/794,607
• Publication Number:
  US 20140223514A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/562 Brokering proxy services

Abstract

A method for validating a client system is disclosed. A trust broker system receives a request to connect to a server system from a previously authorized client system, wherein the client system has an associated user agent. The trust broker system determines the machine fingerprint associated with the client system, wherein the fingerprint is a digital value that represents all software installed on the client system. Based on the machine finger print, the trust broker determines whether the client system has software installed since the previous authorization. In accordance with a determination that the client system does have newly installed software, the trust broker system transmits instructions to evaluate the newly installed software and receives the results of the evaluation from the client system establishes an encrypted connection with the first client system.

Claims

1. A method for validating a client system, comprising:

at a trust broker system having one or more processors and memory storing one or more programs for execution by the one or more processors;

receiving a request to connect to a server system from a previously authorized client system, wherein the client system has an associated user agent;

determining a machine fingerprint associated with the client system, wherein the fingerprint is a digital value that represents all software installed on the client system;

based on the machine fingerprint, determining whether the client system has software installed since the previous authorization; and

in accordance with a determination that the client system does have newly installed software;

transmitting instructions to evaluate the newly installed software; and

receiving the results of the evaluation from the client system.

2. The method of claim 1, further including:

in accordance with a determination that the client system does not have newly installed software, determining that the client system is secure.

3. The method of claim 1, wherein the instructions to evaluate the newly installed software scan the software for malicious code.

4. The method of claim 1, wherein the instructions to evaluate the newly installed software determine whether the newly installed software is upgraded to the most recent authorized version of that software.

5. The method of claim 1, further including:

determining whether the received results indicates that the newly install software includes malicious code; and

in accordance with a determination that the newly installed software includes malicious code;

terminating the connection with the client system; and

notifying the client system of the malicious code.

6. The method of claim 1, wherein the machine fingerprint is a hash value.

7. The method of claim 1, wherein determining whether the client system has newly installed software further includes:

comparing the machine fingerprint associated with the client system with a second, previously received machine fingerprint.

8. An electronic device for validating a client system, comprising:

one or more processors;

memory storing one or more programs to be executed by the one or more processors;

the one or more programs comprising instructions for;

receiving a request to connect to a server system from a previously authorized client system, wherein the client system has an associated user agent;

determining a machine fingerprint associated with the client system, wherein the fingerprint is a digital value that represents all software installed on the client system;

based on the machine fingerprint, determining whether the client system has software installed since the previous authorization; and

in accordance with a determination that the client system does have newly installed software;

transmitting instructions to evaluate the newly installed software; and

receiving the results of the evaluation from the client system.

9. The device of claim 8, further including instructions for:

in accordance with a determination that the client system does not have newly installed software, determining that the client system is secure.

10. The device of claim 8, wherein the instructions to evaluate the newly installed software scan the software for malicious code.

11. The device of claim 8, wherein the instructions to evaluate the newly installed software determine whether the newly installed software is upgraded to the most recent authorized version of that software.

12. The device of claim 8, further including instructions for:

determining whether the received results indicates that the newly install software includes malicious code; and

in accordance with a determination that the newly installed software includes malicious code;

terminating the connection with the client system; and

notifying the client system of the malicious code.

13. The device of claim 8, wherein the machine fingerprint is a hash value.

14. The device of claim 8, wherein determining whether the client system has newly installed software further includes:

comparing the machine fingerprint associated with the client system with a second, previously received machine fingerprint.

15. A non-transitory computer readable storage medium storing one or more programs configured for execution by an electronic device with a camera, the one or more programs comprising instructions for:

receiving a request to connect to a server system from a previously authorized client system, wherein the client system has an associated user agent;

determining a machine fingerprint associated with the client system, wherein the fingerprint is a digital value that represents all software installed on the client system;

based on the machine fingerprint, determining whether the client system has software installed since the previous authorization; and

in accordance with a determination that the client system does have newly installed software;

transmitting instructions to evaluate the newly installed software; and

receiving the results of the evaluation from the client system.

16. The non-transitory computer readable storage medium of claim 15, further including instructions for:

in accordance with a determination that the client system does not have newly installed software, determining that the client system is secure.

17. The non-transitory computer readable storage medium of claim 15, wherein the instructions to evaluate the newly installed software scan the software for malicious code.

18. The non-transitory computer readable storage medium of claim 15, wherein the instructions to evaluate the newly installed software determine whether the newly installed software is upgraded to the most recent authorized version of that software.

19. The non-transitory computer readable storage medium of claim 15, further including instructions for:

determining whether the received results indicates that the newly install software includes malicious code; and

in accordance with a determination that the newly installed software includes malicious code;

terminating the connection with the client system; and

notifying the client system of the malicious code.

20. The non-transitory computer readable storage medium of claim 15, wherein the machine fingerprint is a hash value.