Blockchain verification of network security service
According to some embodiments, a system may include a communication port to exchange information with a client device associated with an industrial control system. A network security server coupled to the communication port may include a computer processor adapted to provide a network security service for the client device. The computer processor may further be adapted to record security information about the client device via a blockchain verification process (e.g., by registering a validation result within a distributed ledger). The network security service might comprise, for example, an integrity attestation service providing software verification for the client device.
1. A system associated with an industrial control system, comprising:
a communication port to exchange information with a client device; and
an attestation server coupled to the communication port and including a computer processor adapted to:
provide an integrity attestation service associated with software verification for the client device,
record security information about the client device via a blockchain verification process, and
generate an attestation report for a plurality of remote client devices, wherein the attestation report includes:
an overall blockchain validity indication, and
for each remote client device: a client identifier, a recorded date and time, a blockchain validity indication, and an attestation status indicating one of a secure status, a warning status, and a compromised status.
2. The system of claim 1 , wherein the software being verified is associated with a program executing at the remote client devices, the program being associated with at least one of: (i) a basic input output system, (ii) an operating system, and (iii) an application.
3. The system of claim 1 , wherein at least one remote client device is associated with at least one of: (i) a personal computer, (ii) a tablet computer, (iii) a server computer, (iv) a smartphone, (v) a microcontroller, (vi) an embedded access point, (vii) an embedded telecommunication base station, (viii) an embedded Internet of Things (“IoT”) gateway, (ix) an embedded smart building automation device, and (x) a digital rights management device.
4. The system of claim 1 , wherein the attestation report is associated with at least one of: (i) a single network cloud-hosted topology, (ii) a multiple network cloud-hosted topology, and (iii) a participant hosted intranet environment.
5. The system of claim 1 , wherein said recording includes registering a validation result within a distributed ledger.
6. The system of claim 5 , wherein said registering includes a smart contract transaction that records a device attestation status, a validation hash, a device identifier, and an attestation server identifier.
7. The system of claim 5 , wherein said registering is associated with a public cryptography key associated with the attestation server.
8. The system of claim 5 , wherein said registering is associated with a Trusted Platform Module (“TPM”) of a remote client device providing a hardware root of trust for a measured and trusted boot associated with the industrial control system.
9. The system of claim 8 , wherein the TPM signs platform configuration register values as proof of integrity.
10. A method associated with an industrial control system, comprising:
exchanging, at an attestation server, information with a client device;
providing an integrity attestation service associated with software verification for the client device;
recording security information about the client device via a blockchain verification process; and
generating an attestation report for a plurality of remote client devices, wherein the attestation report includes:
an overall blockchain validity indication, and
for each remote client device: a client identifier, a recorded date and time, a blockchain validity indication, and an attestation status indicating one of a secure status, a warning status, and a compromised status.
11. The method of claim 10 , wherein the software being verified is associated with a program executing at the client device, the program being associated with at least one of: (i) a basic input output system, (ii) an operating system, and (iii) an application.
12. The method of claim 11 , wherein said recording includes registering a validation result within a distributed ledger.
13. The method of claim 12 , wherein said registering includes a smart contract transaction that records a device attestation status, a validation hash, a device identifier, and an attestation server identifier.
14. A system associated with an industrial control system, comprising:
a client device having a Trusted Platform Module (“TPM”); and
an attestation server, remote from the client device, including:
a communication port to exchange information with the client device; and
a computer processor coupled to the communication port and adapted to:
provide software verification for the client device based at least in part on information in the TPM,
record security information about the client device via a blockchain verification process by registering a validation result within a distributed ledger, and
generate an attestation report for a plurality of remote client devices, wherein the report includes:
an overall attestation server version number of the attestation server,
an overall blockchain validity indication, and
for each remote client device: a client identifier, a recorded date and time, a blockchain validity indication, and an attestation status indicating one of a secure status, a warning status, and a compromised status.
15. The system of claim 14 , wherein said registering includes a smart contract transaction that records a device attestation status, a validation hash, a device identifier, and an attestation server identifier.