Method and system for enhancing flow of behavior metrics and evaluation of security of a node
A method and system for enhancing flow of behavior metrics and evaluating security of a node are described. Instead of sending behavior metrics from a trustee node to a trustor node, the trustor node sends an evaluation function to the trustee node. The trustee node performs security evaluation and sends a result to the trustor node. Alternatively, the trustee node and the trustor node may send behavior metrics and an evaluation function to a trusted broker, respectively. The trusted broker evaluates the security of the trustee node using the evaluation function and the behavior metrics, and sends a security evaluation result to the trustor node and the trustee node. There may be multiple trusted brokers. The behavior metrics may be accumulated by each node as the behavior metrics flow downstream. The nodes may submit behavior metrics to an intermediary periodically and may be accumulated by intermediaries.
1. In a network including a plurality of nodes and at least one broker, a method for evaluating security of a node, the method comprising, at the at least one broker:
receiving behavior metrics from a trustee node for evaluating a security state of the trustee node;
receiving an evaluation function from a trustor node for evaluating the security state of the trustee node;
performing a security evaluation to evaluate the security state of the trustee node based on the behavior metrics, received from the trustee node, using the evaluation function, received from the trustor node; and
sending a result of the security evaluation to the trustee node and the trustor node.
2. The method of claim 1 wherein the behavior metrics are received from the trustee node periodically.
3. In a network including a plurality of nodes and at least one broker, a method for evaluating security of a node, the method comprising, at the at least one broker:
receiving behavior metrics from a trustee node for evaluating a security state of the trustee node;
receiving, via a trusted broker associated with a trustor node, an evaluation function, for evaluating the security state of the trustee node, from the trustor node;
performing a security evaluation to evaluate the security state of the trustee node based on the behavior metrics, received from the trustee node, using the evaluation function, received from the trustor node; and
sending a result of the security evaluation to the trustee node and the trustor node.
4. The method of claim 3 wherein the trusted broker is included in a federation of node behavior evaluators.
5. The method of claim 3 wherein the trusted broker protects an identity of the trustor node.
6. In a network including a plurality of nodes and an intermediary, a method for evaluating security of a node, the method comprising, at a broker:
receiving accumulated behavior metrics from the intermediary, wherein the accumulated behavior metrics comprise behavior metrics associated with each node of a plurality of nodes in an upstream network associated with the intermediary;
receiving an evaluation function, for evaluating a security state of the upstream network, from a trustor node; and
performing a security evaluation on the upstream network by evaluating the accumulated behavior metric, from the intermediary, to evaluate the security state of the upstream network, using the evaluation function from the trustor node.
7. The method of claim 6 wherein the accumulated behavior metrics have been received, at the intermediary, periodically.
8. The method of claim 7 wherein the behavior metrics associated with each node of the plurality of nodes has been received at the intermediary based on a signal generated from a trusted platform module (TPM).
9. The method of claim 6 wherein the behavior metrics have been received at the intermediary at an interval that is reduced based on an increase in metrics related activity.
10. The method of claim 6 wherein the accumulated behavior metrics comprise a digital signature associated with the intermediary.
11. A system for evaluating security of a node, the system comprising:
a broker node configured to:
receive behavior metrics from a trustee node to evaluate a security state of the trustee node;
receive an evaluation function from a trustor node to evaluate the security state of the trustee node;
perform a security evaluation to evaluate the security state of the trustee node based on the behavior metrics from the trustee node using the evaluation function from the trustor node; and
send a result of the security evaluation to the trustee node and the trustor node.
12. The system of claim 11 wherein the broker node is further configured to receive the behavior metrics periodically from the trustee node.
13. A system for evaluating security of a node, the system comprising:
a broker node configured to:
receive behavior metrics from a trustee node to evaluate a security state of the trustee node;
receive, via a trusted broker associated with a trustor node, an evaluation function, to evaluate the security state of the trustee node, from the trustor node;
perform a security evaluation to evaluate the security state of the trustee node based on the behavior metrics from the trustee node using the evaluation function from the trustor node; and
send a result of the security evaluation to the trustee node and the trustor node.
14. The system of claim 13 wherein the trusted broker node is included in a federation of node behavior evaluators.
15. The system of claim 13 wherein an identity of the trustor node is protected by the trusted broker node.
16. A system for evaluation of security of a node, the system comprising:
a broker node configured to:
receive accumulated behavior metrics from an intermediary, wherein the accumulated behavior metrics comprise behavior metrics associated with each node of a plurality of nodes in an upstream network associated with the intermediary;
receive an evaluation function, to evaluate a security state of the upstream network, from a trustor node; and
perform a security evaluation on the upstream network by evaluating the accumulated behavior metrics; from the intermediary, to evaluate the security state of the upstream network using the evaluation function from the trustor node.
17. The system of claim 16 wherein the behavior metrics have been received, at the intermediary, periodically.
18. The system of claim 17 wherein the behavior metrics associated with each node of the plurality of nodes has been received at the intermediary based on a signal generated from a trusted platform module (TPM).
19. The system of claim 16 wherein the behavior metrics have been received at the intermediary at an interval that is reduced based on an increase in metrics related activity.
20. The system of claim 16 wherein the accumulated behavior metrics comprise a digital signature associated with the intermediary.