Method to control access between network endpoints based on trust scores calculated from information system component analysis
Signatures are generated for modules in a computer system. The signatures can be assembled into an integrity log. The signatures are compared with signatures in a database in an integrity validator. Once signatures are either validated or invalidated, a trust score can be generated. The trust score can then be used to determine whether the computer system should be granted access to a resource using a policy.
1. An apparatus ( 140 , 160 ), comprising:
a database ( 205 ) storing a plurality of signatures for a plurality of modules;
a receiver ( 210 ) to receive a signature for a module over a network from a separate device; and
a validator ( 220 ) to validate the signature if the signature for said module matches at least one of the plurality of signatures in the database ( 205 ).
2. An apparatus ( 140 , 160 ) according to claim 1 , further comprising a transmitter ( 215 ) to forward the signature to a second apparatus ( 140 , 160 ) for validation by the second apparatus ( 140 , 160 ) if the signature does not match at least one of the plurality of signatures in the database ( 205 ).
3. A method, comprising:
receiving ( 505 ) a signature for a module over a network from a separate device;
comparing ( 510 ) the signature with a plurality of signatures in a database ( 205 ); and
if the signature matches at least one of the plurality of signatures in the database ( 205 ), validating ( 520 ) the signature.
4. A method according to claim 3 , wherein:
receiving ( 505 ) a signature for a module includes receiving ( 505 ) an identifier for the module; and
comparing ( 510 ) the signature with a plurality of signatures in a database ( 205 ) includes:
identifying a first signature in the database ( 205 ) using the identifier for the module; and
comparing ( 510 ) the signature with the first signature.
5. A method according to claim 3 , further comprising, if the signature does not match at least one of the plurality of signatures in the database ( 205 ), forwarding the signature to a second database for validation of the signature.
6. An apparatus according to claim 1 , wherein:
the receiver ( 210 ) is operative to receive at least two signatures for two modules from two computer systems ( 105 ); and
the validator ( 220 ) to validate each of the at least two signatures if each of the at least two signatures for said two modules matches at least one of the plurality of signatures in the database ( 205 ).
7. A method according to claim 3 , wherein:
receiving ( 505 ) a signature for a module over a network from a separate device includes receiving at least two signatures for two modules over the network from two separate devices;
comparing ( 510 ) the signature with a plurality of signatures in a database ( 205 ) includes comparing each of the at least two signatures for the two modules with the plurality of signatures in the database ( 205 ); and
validating ( 520 ) the signature includes, if each of the at least two signatures matches at least one of the plurality of signatures in the database ( 205 ), validating each of the at least two signatures.