Systems and methods for using reputation scores in network services and transactions to calculate security risks to computer systems and platforms

• US 8,776,180 B2
• Filed: 07/27/2012
• Issued: 07/08/2014
• Est. Priority Date: 05/01/2012
• Status: Active Grant

• Current Assignee: Taasera Licensing LLC (Quest Patent Research Corporation)
• Original Assignee: Taasera, Inc. (Full Circle Investments, Inc.)
• Inventors: Kumar, Srinivas, Pollutro, Dennis
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US13/559,692
• Publication Number:
  US 20130298192A1
• Time in Patent Office: 711 Days
• Field of Search: 713155-159
• US Class Current: 726/3
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Instrumented networks, computer systems and platforms having target subjects (devices, transactions, services, users, organizations) are disclosed. A security orchestration service generates runtime operational integrity profiles representing and identifying a level of threat or contextual trustworthiness, at near real time, of subjects and applications on the instrumented target platform. Methods and systems are disclosed for calculating security risks by determining subject reputation scores. In an embodiment, a system receives a query for a reputation score of a subject, initiates directed queries to external information management systems to interrogate attributes associated with the subject, and analyzes responses. The system receives a hierarchical subject reputation score based on a calculus of risk and returns a reputation token. In another embodiment, a method provides real time attestation of a subject'"'"'s reputation to a service provider using an endpoint trust agent, and a trust orchestrator comprising a reputation broker and a trust broker.

Claims

1. A reputation scoring system for generating and displaying a hierarchical representation of a reputation score of a subject, the system comprising:

a hardware processor;

a reputation broker configured on the hardware processor to;

process a query for a reputation score of the subject received at a trust broker from a service provider as a result of a device initiated service transaction; and

dispatch a request to a trust orchestrator to generate a hierarchical reputation score for the subject as a measured dynamic assessment of the integrity of monitored applications executing on a device of the subject,

wherein the trust orchestrator is configured to process the received dispatch request for the hierarchical reputation score by;

initiating a plurality of directed queries to information management systems internal or external to an organization to interrogate attributes associated with the subject;

analyzing received responses from the plurality of directed queries;

receiving the generated hierarchical reputation score for the subject based on a calculus of risk; and

sending the generated hierarchical reputation score for the subject to the reputation broker,

wherein the trust orchestrator is further configured to;

receive a reputation token from the reputation broker for the subject in response to the dispatched request; and

send the reputation token to the service provider as a response to the query for the reputation score.

2. The system of claim 1, further comprising:

an authentication service configured to authenticate a user to a computing device by performing an authentication process;

a system event correlator comprising a reputation processor configured to receive subject events from the trust broker including an integrity profile of a subject with subject alerts;

a risk correlator configured to populate a risk correlation matrix based upon real-time correlation of normalized, collated subject events received in endpoint assessment reports from a plurality of collaboration services;

a reputation score generator configured to generate the hierarchical reputation score for the subject, the reputation score generator comprising a scoring application module configured to calculate a hierarchical reputation score based upon one or more of a transaction score, a user score, a service score, a social score, a professional score, a device score, an organization score, and an application score;

a log management application module configured to respond to a subject activity query from the trust broker;

a role management application system configured to respond to a subject attribute query from the trust broker; and

an identity management application module configured to respond to the subject attribute query from the trust broker.

3. The system of claim 2, wherein the risk correlator is further configured to receive subject alerts and map the subject alerts to cells in the risk correlation matrix, and

wherein reputation score generator is further configured to process the subject events and the subject alerts to determine the hierarchical reputation score for the subject.

4. The system of claim 3, wherein the subject events are:

one or more of assertions about provisioned attributes, endpoint activities associated with the subject, and network level activities associated with the subject; and

received at the system event correlator as a response to a directed query from log management system, a role management system, the identity management application module, or an inventory management module.

5. The system of claim 2, wherein the reputation token includes at least a reputation score for the subject information and information requested by the service provider to enforce a reputation-based access control to permit or deny a service request to access the managed application.

6. The system of claim 2, wherein the user uses an endpoint device to perform an online transaction or participate in an activity with a service rendered by an application and managed by an organization, and wherein the user is associated with the organization via a membership, employment, contract, or other affiliation.

7. The system of claim 6, wherein the activity is categorized as either social or professional.

8. The system of claim 7, wherein the IT assets include, one or more of the computing device, the endpoint device, a server, a desktop computer, a laptop, a tablet computer, a multi-function printer/scanners/fax machine, and a network device.

9. The system of claim 7, further comprising an inventory management system configured to manage an inventory of the IT assets on behalf of the organization.

10. The system of claim 1, wherein the trust broker is further configured to process received subject attributes such as entitlements, memberships, roles, and activity information;

and

generate and dispatch temporal subject events to the reputation processor.

11. The system of claim 1, wherein subject events represent assertions about the subject that are used to determine a level of security risk in a transaction.

12. The system of claim 11, wherein the subject events include static and dynamic separation of duties, principle of least privilege, observed resource usage patterns by the subject, and observed subject activities on internal networks of an organization and networks external to the organization.

13. The system of claim 1, wherein the query for the reputation score received by the trust broker is preconfigured.

14. The system of claim 13, further comprising an administrative application module configured to render a graphical user interface (GUI) for an administration console comprising a plurality of dashboards on a display,

wherein a preconfigured query can be customized using the GUI.

15. The system of claim 14, wherein the reputation processor is further configured to calculate risk posed by the subject to a computer system or platform;

and

and the administrative application module is further configured to render the hierarchical representation of the subject reputation score on the display.

16. The system of claim 1, wherein the management systems include information systems hosted by social networking vendors.

17. The system of claim 1, wherein the subject is a computing device, a user, a transaction, an organization, or a service.

18. The system of claim 17, wherein the attributes associated with the subject include one or more of a device geo-location, a device provisioned state, enabled/disabled device functions, a user registration, and an organization registration.

19. The system of claim 17, wherein the hierarchical reputation score comprises an aggregation of a plurality of component scores comprising one or more of a transaction score, a service score, a social score, a professional score, a device score, an organization score, and an application score.

20. The system of claim 19, wherein the hierarchical reputation score comprises an enumerated list with annotated component scores representing granularity and structure of how the subject score will be reported to the service provider.

21. A method of providing real time attestation of a reputation of a subject to a service provider using an endpoint trust agent, and a trust orchestrator including a processor comprising a reputation broker and a trust broker, the method comprising:

receiving, at the trust orchestrator by the reputation broker, from a service provider, a query for a reputation score of a subject as a result of a device initiated service transaction;

dispatching, at the trust orchestrator by the reputation broker, a request to generate a just-in-time reputation score for a subject as a measured dynamic assessment of the integrity of monitored applications executing on a device of the subject; and

processing, at the trust orchestrator by the trust broker, the received request to generate the just-in-time reputation score by;

initiating, by the processor, a plurality of directed queries to external information management systems to interrogate attributes associated with a subject,

analyzing, by the processor, received responses from the plurality of directed queries and generating a reputation score for a subject based on a calculus of risk,

sending, the generated reputation score for the subject to the reputation broker, and

sending, by the reputation broker at the trust orchestrator, as a response to the query for the reputation score, to a service provider, a reputation token for a subject.

22. The method of claim 21, wherein the subject is one or more of:

a user account;

a software application;

a computing system;

a computing platform; and

a computing device.

23. The method of claim 21, wherein the interrogation of internal or external information management systems comprises one or more of:

querying, provisioned identities, roles and entitlements of a subject;

querying, activity logs attributed to a subject;

querying, inventory object associations of a subject;

querying, geo-location based object actions of a subject;

querying, actions performed on inventory objects by a subject;

correlating, anomalies in observed actions and provisioned conflicts relating to a principle of least privilege and separation of duties;

correlating, association of a subject with a plurality of infected systems; and

correlating, association of a subject with a plurality of infected computing devices.

24. The method of claim 23, wherein the querying of activity logs comprises one or more of:

security and information events associated with a subject;

websites visited by a subject;

online or drive-by downloads initiated by a subject; and

local device management actions and operations performed by a subject.