Method and system to issue trust score certificates for networked devices using a trust scoring service
A target machine can be verified prior to being granted access to a resource on a network by interrogating and analyzing digests of various elements of the target machine. The digests can be collected into an integrity report and provided to a Trust Scoring Service. The Trust Scoring Service receives the integrity report and compares the digests with signatures stored in a signature database. A trust score certificate can then be issued to the target machine. The Trust Scoring Service can include a Score Evaluation Server which can interact with a Kerberos Authentication Server and a Ticket Granting Server to embed a trust score within a Kerberos Ticket to enforce a richer set of access policies. The integrity of a web server can be verified and a Trust Score Certificate Logo can be displayed on a corresponding home page of a merchant. By clicking on the Trust Score Certificate Logo, a user can verify the integrity of the merchant's web servers prior to completing a transaction with the merchant.
1. A method for evaluating the integrity of a web server machine, comprising:
requesting a trust score evaluation of a web server machine;
initiating an interrogation of the web server machine responsive to the trust score evaluation request;
establishing a secure channel between the web server machine and a score evaluation server;
generating at least one digest corresponding to at least one module of the web server machine;
generating an integrity report to include the at least one digest;
transmitting the integrity report to the score evaluation server;
generating a trust score certificate responsive to the integrity report, the trust score certificate including a trust score for the web server machine, the trust score representing how many digests in the integrity report were verified by the score evaluation server and enabling a user to evaluate an integrity of the web server machine;
transmitting the trust score certificate to the web server machine; and
including a trust score certificate logo associated with the trust score certificate on a merchant website.
2. A method according to claim 1 , wherein the integrity of the web server machine is determined prior to initiating a transaction by the user.
3. A method according to claim 1 , wherein the integrity of the web server machine is determined prior to completing a transaction by the user.
4. A method according to claim 1 , further comprising displaying information about the trust score certificate responsive to a click on the trust score certificate logo.