Dynamic executable
View Patent ↗A system to identify and/or authenticate an entity includes a. client-side executable and an associated server-side executable, each of which may be dynamically generated. The server-side executable may be executed on a server to generate a first result. The client-side executable may be executed on an entity to generate a second result. The first result and the second result are compared to identify and/or to authenticate the entity.
1. A system comprising:
one or more processors
a server-side executable by one or more processors and configured to gather information about an execution environment of a client-side machine; and execute on a server to generate a first hardware signature including information identifying devices of the client-side machine;
a client-side executable by one or more processors and configured to execute on the client-side machine, to generate a second hardware signature identifying on devices associated with the client-side machine, the client-side executable being dynamically generated on the server and securely downloaded to the client-side machine, the client-side executable being associated with the server-side executable and configured to operate in the execution environment of the client-side machine, and configured to execute a subset of instructions from the server; and
an authenticator to configured to compare the first hardware signature and the second hardware signature based on a threshold level of matching to identity of the client-side machine.
2. The system of claim 1 wherein the server includes the authenticator.
3. The system of claim 1 wherein the server and the authenticator are separate.
4. The system of claim 1 further comprising a server-side database accessible by the server-side executable, wherein the server-side database includes the information identifying devices of the client-side machine.
5. The system of claim 4 wherein the server-side executable is to collect the information identifying devices of the client-side machine from the database.
6. The system of claim 1 wherein the information about an execution environment includes one or more of information about an operating system of the client-side machine, information about a central processing unit of the client-side machine, and information about security settings of the client-side machine.
7. The system of claim 1 wherein the authenticator is further configured to render the client-side machine as not identified if the second hardware signature is not received by the authenticator during a limited time frame.
8. The system of claim 1 wherein the client-side machine includes a device, wherein the device has an associated authentication score to be added towards the threshold level.
9. The system of claim 8 wherein the authentication score is higher for associated devices that are less likely to be replaced or adjusted.
10. The system of claim 1 wherein the threshold level of matching indicates a number of devices identified in the second hardware signature that must also be identified in the first hardware signature.
11. A method comprising:
identifying, by a server, components of an execution environment of a client-side machine, wherein the components include an operating system and a central processing unit;
dynamically generating, on the server, a client-side executable suitable for operation in the execution environment of the client-side machine, and a corresponding server-side executable;
securely downloading the client-side executable from the server to the client-side machine, the client-side executable being associated with the server-side executable, and being configured to execute a subset of instructions from the server;
executing the server-side executable on the server to generate a first hardware signature, wherein the first hardware signature includes information identifying a first group of devices associated with the client-side machine;
executing the client-side executable on the client-side machine to generate a second hardware signature based on a second group of devices associated with the client-side machine; and
comparing, based on a threshold level of matching, the first hardware signature and the second hardware signature to authenticate the client-side machine, wherein the threshold level of matching indicates a number of devices that must be in the first and second groups for the client-side device to be authenticated.
12. The method of claim 11 further comprising collecting information, selected from a group including a dynamic information type of the client-side machine, a dynamic information order of the client-side machine and a dynamic amount of information of the client-side machine, for the client-side executable.
13. The method of claim 11 , wherein the client-side executable includes at least one dynamic encryption instruction.
14. The method of claim 11 further comprising collecting information identifying the first group of hardware components associated with the client-side machine, and obfuscating the information collected.
15. The method of claim 11 further comprising collecting, from a server database, the first hardware signature for the server-side executable.
16. The method of claim 11 wherein the comparing is performed by an authenticator residing on the server.
17. The method of claim 16 further comprising imposing a time limit on receipt of the second result by the authenticator, wherein upon expiration of the time limit, the client-side machine is considered as not authenticated.
18. The method of claim 11 further comprising generating a plurality of instructions on the server; and dynamically selecting a subset of the plurality of instructions as the client-side executable.
19. The method of claim 11 further comprising:
updating the first hardware signature to identify a new device associated with the client-side machine.
20. A method for distributing executable software modules and granting access to resources based on operations performed by the executable software modules, the method comprising:
performing the following operations at a server,
collecting environment information about an execution environment of a client-side machine;
determining hardware information to be collected from the client-side machine;
creating a client-side software module configured to execute in the execution environment of the client-side machine, to collect the hardware information from the client-side machine, and to generate a first hardware signature based on the hardware information;
transmitting the client-side software module to the client-side machine;
receiving, from the client-side software module, the first hardware signature;
comparing the first hardware signature to a second hardware signature associated with the client-side machine;
granting the client-side device access to resources, wherein the granting is based on the comparison of the first and second hardware signatures.
21. The method of claim 20 , wherein first hardware signature identifies a first group of devices of the client-side machine, and wherein the second hardware signature identifies a second group of devices, and wherein the comparing includes:
determining a number of the devices identified in both the first and second groups; and
determining the number meets an authentication threshold value.
22. The method of claim 21 further comprising:
updating the second hardware signature to identify new devices of the client machine.
23. The method of claim 20 , wherein the environment information identifies one or more of an operating system, security privileges, access rights, and a central processing unit.
24. The method of claim 20 , wherein the hardware information includes information about devices of the client-side machine, wherein the devices include one or more of a hard disk drive, a Compact Disk Read Only Memory device, devices connected to the client side machine via a small computer system interface, and devices connected to the client side machine via a desktop management interface.