Patent Application

App. No. 12/982,528

Abstract

Claims (41)

1 . A system comprising:

a target device having a target application and a web application thereon;

a trust broker configured to generate an application token having associated therewith a state attribute comprising at least one of a hash digest and a property value assertion, and weighted trust score;

the application token corresponding to a level of trustworthiness, in near real time, of a running application instance of the target application on the target device;

a trust monitor configured to monitor an execution state of the target application;

an authentication broker configured to authenticate a user to the web application and based upon a web services query for remote verification of the execution state of the target application;

a network access enforcer configured to control access of an authenticated user to the target application; and

a trust evaluation server configured to interrogate the target application based upon a request for a trust score, and generate the trust score based upon the interrogation.

2 . The system according to claim 1 , wherein the application token includes at least one of a registered service principle name for the running application instance, active listening and open port information, a product publisher, and product version information.

3 . The system according to claim 2 , wherein said trust broker is configured to generate a new application token based upon a state change in the running application instance.

4 . The system according to claim 3 , wherein the new application token includes the weighted trust scores and property value assertions.

5 . The system according to claim 1 , wherein the application token comprises a digitally signed token.

6 . The system according to claim 1 , wherein said authentication broker comprises a security token service (STS).

7 . The system according to claim 1 , wherein said network access enforcer is configured as a policy enforcement point (PEP).

8 . A method for evaluating integrity of a web application comprising:

requesting a token for a web application instance;

initiating an interrogation of the web application instance on a web server machine based upon an access request;

establishing a secure channel between the web server machine and a trust broker server;

generating at least one digest corresponding to at least one element of the web application instance;

generating an integrity report to include the at least one digest;

transmitting the integrity report to an authentication broker;

generating weighted trust scores and property value assertions based upon the integrity report;

transmitting the weighted trust scores in the token to the authentication broker; and

including the weighted trust scores of the web application instance as a logo on a user web browser.

9 . The method according to claim 8 , wherein the integrity report is generated prior to initiating a transaction by a user.

10 . The method according to claim 8 , wherein the integrity report is generated prior to completing a transaction by a user.

11 . The method according to claim 8 , further comprising displaying information about the weighted trust scores responsive to a click on the logo.

12 . A method for interrogating a target application comprising:

generating a token for a target application using a trust broker server;

requesting an interrogation of the target application;

subscribing for a state change notification of the target application;

receiving weighted trust scores and property value assertions of the target application based upon at least one of the interrogation and subscription;

including the weighted trust scores and property value assertions into the token; and

providing the token to at least one of an authentication broker and a network access enforcer.

13 . The method according to claim 12 , wherein generating the token comprises generating the token to include at least one of a registered service principle name for a running instance of the target application, active listening and open port information, a product publisher, and product version information.

14 . The method according to claim 13 , further comprising generating a new token for the target application using the trust broker server based upon a state change in the running instance of the target application instance.

15 . The method according to claim 14 , wherein generating a new token comprises including the weighted trust scores and property value assertions in the new token.

16 . The method according to claim 12 , further comprising digitally signing the token.

17 . The method according to claim 12 , further comprising authenticating the target application using a trust evaluation server and a trust scoring system.

18 . The method according to claim 12 , further comprising using the token, including the weighted trust scores and property value assertions, to enforce a set of logical post-connect access policies for controlling access to a trusted resource on a network.

19 . The method according to claim 12 , further comprising using the token, including the weighted trust scores and property value assertions, to enforce a set of physical pre-connect access policies for controlling access to a trusted resource on a network.

Assignments (8)