Attestation and computer forensics based on universal references for hardware and/or software configurations
A method, computer system, and computer program product are provided for performing policy enforcement, attestation, and network forensics. A universal reference for a computing entity is obtained, wherein the universal reference identifies one or more components of the computing entity by additional universal references assigned to the one or more components. A hierarchical description of the computing entity is determined by enumerating each additional universal reference of the one or more components and additional sub-components, wherein the hierarchical description exhaustively identifies the components and sub-components of the computing entity. The hierarchical description is analyzed by accessing a database to identify mappings of the one or more additional universal references to the one or more components and sub-components. The one or more components and sub-components identified by the analyzing are assessed to perform one or more of: an inventory task, a policy enforcement task, an attestation task, and a forensics task.
1. A computer-implemented method comprising:
obtaining a universal reference for a computing entity, wherein the universal reference identifies one or more components of the computing entity by referencing additional universal references that are each assigned to the one or more components, and wherein the universal reference comprises a hash of a description of the computing entity combined with a hash of a description of the one or more components;
determining a hierarchical description of the computing entity by enumerating each additional universal reference of the one or more components and additional sub-components, wherein the hierarchical description identifies each of the one or more components and additional sub-components of the computing entity;
analyzing the hierarchical description by accessing a database to identify mappings of the additional universal references to the one or more components and sub-components; and
assessing the one or more components and sub-components identified by analyzing the hierarchical description, to perform one or more of: an inventory task, a policy enforcement task, an attestation task, and a forensics task.
2. The computer-implemented method of claim 1 , wherein the computing entity is selected from a group of: a hardware configuration, a software object, a firmware object, and a software object and corresponding hardware configuration used to execute the software object.
3. The computer-implemented method of claim 1 , wherein performing the attestation task comprises assigning an identity to the computing entity based on the universal reference of the computing entity, wherein the identity indicates that the computing entity is a known trusted system.
4. The computer-implemented method of claim 1 , wherein performing the forensics task comprises:
determining that the computing entity is associated with a vulnerability; and
storing the hierarchical description of the computing entity to indicate that the computing entity is associated with the vulnerability.
5. The computer-implemented method of claim 4 , further comprising:
comparing the hierarchical description of the computing entity to one or more other hierarchical descriptions of other computing entities associated with the vulnerability to identify at least one common component or sub-component.
6. The computer-implemented method of claim 1 , wherein the computing entity comprises a software object, and wherein the universal reference is embedded into the software obj ect.
7. The computer-implemented method of claim 1 , wherein the universal reference is generated by analyzing a bill of materials of the computing entity.
8. The computer-implemented method of claim 1 , wherein a component or sub-component includes a shared library that is utilized at runtime of the computing entity.
9. An apparatus comprising:
one or more computer processors;
a network interface configured to enable network communications;
one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising instructions to:
obtain a universal reference for a computing entity, wherein the universal reference identifies one or more components of the computing entity by referencing additional universal references that are each assigned to the one or more components, and wherein the universal reference comprises a hash of a description of the computing entity combined with a hash of a description of the one or more components;
determine a hierarchical description of the computing entity enumerating each additional universal reference of the one or more components and additional sub-components, wherein the hierarchical description identifies each of the one or more components and additional sub-components of the computing entity;
analyze the hierarchical description by accessing a database to identify mappings of additional universal references to the one or more components and sub-components; and
assess the one or more components and sub-components identified by analyzing of the hierarchical description, to perform one or more of: an inventory task, a policy enforcement task, an attestation task, and a forensics task.
10. The apparatus of claim 9 , wherein the computing entity is selected from a group of: a hardware configuration, a software object, a firmware object, and a software object and corresponding hardware configuration used to execute the software object.
11. The apparatus of claim 9 , wherein performing the attestation task comprises assigning an identity to the computing entity based on the universal reference of the computing entity, wherein the identity indicates that the computing entity is a known trusted system.
12. The apparatus of claim 9 , wherein the instructions to perform the forensics task comprise instructions to:
determine that the computing entity is associated with a vulnerability; and
store the hierarchical description of the computing entity to indicate that the computing entity is associated with the vulnerability.
13. The apparatus of claim 12 , further comprising instructions to:
compare the hierarchical description of the computing entity to one or more other hierarchical descriptions of other computing entities associated with the vulnerability to identify at least one common component or sub-component.
14. The apparatus of claim 9 , wherein the computing entity comprises a software object, and wherein the universal reference is embedded into the software object.
15. The apparatus of claim 9 , wherein the universal reference is generated by analyzing a bill of materials of the computing entity.
16. The apparatus of claim 9 , wherein a component or sub-component includes a shared library that is utilized at runtime of the computing entity.
17. One or more non-transitory computer readable storage media collectively having program instructions embodied therewith, the instructions executable by a computer to cause the computer to:
obtain a universal reference for a computing entity, wherein the universal reference identifies one or more components of the computing entity by referencing additional universal references that are each assigned to the one or more components, and wherein the universal reference comprises a hash of a description of the computing entity combined with a hash of a description of the one or more components;
determine a hierarchical description of the computing entity by enumerating each additional universal reference of the one or more components and additional sub-components, wherein the hierarchical description identifies each of the one or more components and additional sub-components of the computing entity;
analyze the hierarchical description by accessing a database to identify mappings of one or more additional universal references to the one or more components and sub-components; and
assess the one or more components and sub-components identified by analyzing of the hierarchical description, to perform one or more of: an inventory task, a policy enforcement task, an attestation task, and a forensics task.
18. The one or more non-transitory computer readable storage media of claim 17 , wherein the computing entity is selected from a group of: a hardware configuration, a software object, a firmware object, and a software object and corresponding hardware configuration used to execute the software object.
19. The one or more non-transitory computer readable storage media of claim 17 , wherein performing the attestation task comprises assigning an identity to the computing entity based on the universal reference of the computing entity, wherein the identity indicates that the computing entity is a known trusted system.
20. The one or more non-transitory computer readable storage media of claim 17 , wherein the instructions to perform the forensics task cause the computer to:
determine that the computing entity is associated with a vulnerability; and
store the hierarchical description of the computing entity to indicate that the computing entity is associated with the vulnerability.