Remote crowd attestation in a network

1. A method, comprising:

receiving, at a first device in a network, information regarding a plurality of nodes in the network;

determining, by the first device, a property of the plurality of nodes based on the received information, wherein the property of the plurality of nodes comprises at least one of: a hardware configuration, a software configuration, a physical location, or a traffic pattern of the one or more nodes;

observing, by the first device, a behavior of the plurality of nodes;

constructing, by the first device, a behavioral model based on the observed behavior;

determining, by the first device, a degree of trustworthiness of the plurality of nodes based on the received information by comparing the determined property to the behavioral model;

ensuring, by the first device, a degree of trustworthiness of the observed behavior; and

attesting, by the first device, to the determined property and degree of trustworthiness of the plurality of nodes to a verification device, wherein the verification device is configured to verify the attested property and degree of trustworthiness, as part of a hierarchy of attester devices in the network.

2. The method as in claim 1 , wherein the verification device is further configured to attest to the property and degree of trustworthiness of the plurality of nodes to a higher level attester device in the hierarchy.

3. The method as in claim 1 , wherein the behavioral model was constructed by the first device while in a learning mode.

4. The method as in claim 1 , wherein the behavioral model comprises an inferred finite state machine (FSM) that models the observed behavior of the plurality of nodes.

5. The method as in claim 1 , further comprising:

selecting, by the first device, the plurality of nodes based on a security policy, wherein the security policy identifies a set of trusted device types.

6. The method of claim 1 , further comprising:

comparing the received information regarding the plurality of nodes to a history of information regarding the plurality of nodes.

7. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

receive information regarding a plurality of nodes in the network;

determine a property of the plurality of nodes based on the received information;

observe a behavior of the plurality of nodes;

construct a behavioral model based on the observed behavior;

determine a degree of trustworthiness of the plurality of nodes based on the received information by comparing the determined property to the behavioral model;

ensure a degree of trustworthiness of the observed behavior; and

attest to the determined property and degree of trustworthiness of the plurality of nodes to a verification device, wherein the verification device is configured to verify the attested property and degree of trustworthiness as part of a hierarchy of attester devices in the network.

8. The apparatus as in claim 7 , wherein the process when executed is further configured to:

compare the received information regarding the plurality of nodes to a history of information regarding the plurality of nodes.

9. The apparatus as in claim 8 , wherein the verification device is further configured to attest to the property and degree of trustworthiness of the plurality of nodes to a higher level attester device in the hierarchy.

10. The apparatus as in claim 9 , wherein the behavioral model was constructed by the first device while in a learning mode.

11. The apparatus as in claim 8 , wherein the behavioral model comprises an inferred finite state machine (FSM) that models the observed behavior of the plurality of nodes.

12. The apparatus as in claim 8 , wherein the process when executed is further configured to:

select the plurality of nodes based on a security policy, wherein the security policy identifies a set of trusted device types.

13. The apparatus as in claim 8 , wherein the process when executed is further configured to:

compare the received information regarding the plurality of nodes to a history of information regarding the plurality of nodes.

14. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor configured to:

receive information regarding a plurality of nodes in the network;

determine a property of the plurality of nodes based on the received information;

observe a behavior of the plurality of nodes;

construct a behavioral model based on the observed behavior;

determine a degree of trustworthiness of the plurality of nodes based on the received information by comparing the determined property to the behavioral model;

ensure a degree of trustworthiness of the observed behavior; and

attest to the determined property and degree of trustworthiness of the plurality of nodes to a verification device, wherein the verification device is configured to verify the attested property and degree of trustworthiness as part of a hierarchy of attester devices in the network.

15. The computer-readable media as in claim 14 , wherein the verification device is further configured to attest to the property and degree of trustworthiness of the plurality of nodes to a higher level attester device in the hierarchy.

16. The computer-readable media as in claim 14 , wherein the behavioral model was constructed by the first device while in a learning mode.

17. The computer-readable media as in claim 14 , wherein the behavioral model comprises an inferred finite state machine (FSM) that models the observed behavior of the plurality of nodes.

18. The computer-readable media as in claim 14 , wherein the software when executed by the processor is further configured to:

select the plurality of nodes based on a security policy, wherein the security policy identifies a set of trusted device types.

19. The computer-readable media of claim 14 , wherein the software when executed by the processor is further configured to:

compare the received information regarding the plurality of nodes to a history of information regarding the plurality of nodes.