Environment integrity assured transactions

• US 7,587,754 B2
• Filed: 12/24/2002
• Issued: 09/08/2009
• Est. Priority Date: 12/24/2002
• Status: Expired due to Term

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Good, Thomas E., DiFalco, Robert A.
• Primary Examiner(s): Nalven; Andrew L
• Application Number:
  US10/328,957
• Publication Number:
  US 20040123133A1
• Time in Patent Office: 2,450 Days
• Field of Search: 713/200, 713/201, 709/224, 709/217, 726/4
• US Class Current: 726/4
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

In a networked computing environment, a server is equipped to assure the integrity of the service components of a service, including the direct service providing component and one or more supporting components as requested, and a client is equipped to request on behalf of an application in need of the service the integrity assurance. The client is further equipped to either request or accept the service, only upon receiving the integrity assurance. In one embodiment, the request for integrity assurance, and the subsequent conditional request or acceptance of the service is performed in real time.

Claims

1. In a networked computing environment, a method of operation comprising:

a client, having a need for a service of a server with the service to be provided from the server by a plurality of service providing components residing and to be executed on the server including a direct service providing component and one or more supporting components supporting the direct service providing component in providing the service, requesting the server to assure the integrity of the service providing components including the direct service providing component and the one or more supporting components;

the client either requesting the service to be provided or accepting the requested service only upon receiving the requested integrity assurance from the server; and

the server verifying the integrity of the service providing components including the direct service providing component and the one or more supporting components periodically;

wherein said server verifying the integrity of the service providing components including the direct service providing component and the one or more supporting components periodically comprises the server verifying the integrity of the direct service providing component and a first subset of the one or more supporting components with one periodicity, and a second subset of the one or more supporting components with another periodicity.

2. The method of claim 1, wherein said client requesting of the server to assure integrity of the service providing components comprises the client requesting the server to assure the integrity of the direct service providing component and the one or more supporting components, said supporting components being up to n level(s) removed from the direct service providing component, where n is an integer equal to or greater than one.

3. The method of claim 2, wherein n is greater than one.

4. The method of claim 1, wherein said client requesting of the server to assure integrity of the service providing components comprises an application environment integrity assurance manager of the client requesting on behalf of an application in need of the service, an application environment integrity assurance manager of the server to assure on behalf of the service providing components, the integrity of the service providing components, including the direct service providing component and the one or more supporting components as requested.

5. The method of claim 4, wherein the method further comprises the application environment integrity assurance manager of the server assuring, on behalf of the service providing components, the application environment integrity assurance manager of the client, the integrity of the service providing components, including at least the direct service providing component and the one or more supporting components requested by the application environment integrity assurance manager of the client, on behalf of the application in need of the service.

6. The method of claim 5, wherein the application environment integrity assurance managers of the client and the server request and assure the other through a secure transport layer of the client and a secure transport layer of the server.

7. The method of claim 1, wherein the method further comprises the server assuring the client the integrity of the service providing components including at least the direct service providing component and the one or more supporting components requested by the client.

8. The method of claim 1, wherein the method further comprises the server verifying the integrity of the direct service providing component and the one or more supporting components requested by the client in real time.

9. A networked computing environment comprising:

a server having stored thereon a plurality of service providing components to provide a service from the server including a direct service providing component and one or more supporting components supporting the direct service providing component in providing the service from the server, the server further including an ability, when requested, to assure the integrity of the service providing components, including the direct service providing component and the one or more supporting components as requested, the plurality of service providing components to be executed on the server; and

a client coupled to the server, and equipped to request the integrity assurance and either request the service or accept the requested service only upon receiving the requested integrity assurance;

wherein the server is further equipped to verify the integrity of the service providing components including the direct service providing component and a plurality of supporting components periodically; and

wherein the server is equipped to verify the integrity of the direct service providing component and a first subset of the supporting components with one periodicity, and a second subset of the supporting components with another periodicity.

10. The networked computing environment of claim 9, wherein the server is equipped to assure the integrity of the direct service providing component and supporting components up to n level(s) removed from the direct service providing component, where n is an integer equal to or greater than one, and the client is equipped to so request for integrity assurance.

11. The networked computing environment of claim 10, wherein n is greater than one.

12. The networked computing environment of claim 9, wherein said server is equipped with an application environment integrity assurance manager to assure on behalf of the service providing components, the integrity of the service providing components, including the direct service providing component and at least one of the supporting components, as requested, and the client is also equipped with an application environment integrity assurance manager to so request, on behalf of an application in need of the service, the application environment integrity assurance manager of the server for integrity assurance.

13. The networked computing environment of claim 12, wherein each of the server and the client further comprises a secure transport layer, and the application environment integrity assurance managers of the server and the client are further equipped to assure and request the other through the secure transport layers of the server and the client.

14. The networked computing environment of claim 9, wherein the server is further equipped to verify the integrity of the direct service providing component and the supporting components requested by the client in real time.

15. In a server, a method of operation comprising:

receiving a request to assure the integrity of service providing components of a service provided from the server, including at least a direct service providing component and at least one other supporting component residing and to be executed on the server, the at least one other supporting component supporting the direct service providing component in providing the service from the server;

in response, assuring the requestor the integrity of the service providing components of the service, including at least the direct service providing component and at least the supporting component(s) requested; and

verifying the integrity of the service providing components including the direct service providing component and a plurality of supporting components periodically;

wherein said verifying of the integrity of the service providing components including the direct service providing component and a plurality of supporting components periodically comprises verifying the integrity of the direct service providing component and a first subset of the supporting components with one periodicity, and a second subset of the supporting components with another periodicity.

16. The method of claim 15, wherein said request requesting integrity assurance of the direct service providing component and supporting components up to n level(s) removed from the direct service providing component, where n is an integer equal to or greater than one.

17. The method of claim 16, wherein n is greater than one.

18. The method of claim 15, wherein said receiving comprises receiving by an application environment integrity assurance manager of the server, on behalf of the service providing components, from an application environment integrity assurance manager of the client, the request, requesting on behalf of an application in need of the service, assurance of the integrity of the service providing components including the direct service providing component and at least one of the supporting components.

19. The method of claim 18, wherein said assuring comprises the application environment integrity assurance manager of the server assuring on behalf of the service providing components, the application in need of the service, via the application environment integrity assurance manager of the client, the integrity of the service providing components including at least the direct service providing component and the supporting components requested by the application environment integrity assurance manager of the client.

20. The method of claim 19, wherein the application environment integrity assurance managers of the client and the server request and assure the other through a secure transport layer of the client and a secure transport layer of the server.

21. The method of claim 15, wherein the method further comprises verifying the integrity of the direct service providing and the supporting components requested in real time.

22. A computing apparatus comprising:

storage medium having stored therein a plurality of programming instructions designed to enable the computing apparatus to

receive a request to assure the integrity of service providing components of a service provided from the computing apparatus, including at least a direct service providing component and at least one other supporting component residing and to be executed on the computing apparatus, the at least one other supporting component supporting the direct service providing component in providing the service from the computing apparatus;

in response, assure the requestor the integrity of the service providing components of the service, including at least the direct service providing component and at least the supporting component(s) requested;

verify the integrity of the service providing components including the direct service providing component and a plurality of supporting components periodically; and

a processor coupled to the storage medium to execute the programming instructions;

wherein the programming instructions are further designed to perform said verifying of the integrity of the service providing components including the direct service providing component and a plurality of supporting components periodically by verifying the integrity of the direct service providing component and a first subset of the supporting components with one periodicity, and a second subset of the supporting components with another periodicity.

23. The apparatus of claim 22, wherein said request requesting integrity assurance of the direct service providing component and supporting components up to n level(s) removed from the direct service providing component, where n is an integer equal to or greater than one.

24. The apparatus of claim 23, wherein n is greater than one.

25. The apparatus of claim 22, wherein the programming instructions implement an application environment integrity assurance manager to receive, on behalf of the service providing components, the request, from an application environment integrity assurance manager of the client, requesting on behalf of an application in need of the service, assurance of the integrity of the service providing components including the direct service providing component and at least one of the supporting components.

26. The apparatus of claim 25, wherein the programming instructions are further designed to implement the application environment integrity assurance manager to assure, on behalf of the service providing components, the application in need of the service, via the application environment integrity assurance manager of the client, the integrity of the service providing components including at least the direct service providing component and the supporting components requested by the application environment integrity assurance manager of the client.

27. The apparatus of claim 26, wherein the programming instructions are further designed to implement the application environment integrity assurance manager to accept the request from, and provide the assurance to the application environment integrity assurance manager of the client, through a secure transport layer of the client and a secure transport layer of the apparatus.

28. The apparatus of claim 22, wherein the programming instructions are further designed to verify the integrity of the direct service providing and the supporting components requested in real time.