Patent ID: 8266676
Filing Date: 2012-09-11
Classification: H04L

Abstract:
1. A system for verifying the integrity of components within a trusted computing environment, comprising: a client platform capable of being connected to a network, including an integrity report generator to generate an integrity report, wherein said integrity report includes a hash of at least one component of the client platform; an integrity authority separate and remote from the client platform, and capable of being connected to the network, the integrity authority including a global signature database to store a first plurality of integrity records, wherein each of the first plurality of integrity records includes a trustworthy hash; an authenticator entity including a local signature database to store a second plurality of integrity records, wherein each of the second plurality of integrity records includes a trustworthy hash, wherein the authenticator entity is configured to compare said hash of at least one component of said integrity report with said trustworthy hash of each of the second plurality of integrity records; an authentication server separate from the client platform, and capable of being connected to the network to remotely authenticate the client platform; a verification server separate from the client platform, and capable of being connected to the network to receive said integrity report from the client platform, to compare said hash of at least one component of said integrity report with said trustworthy hash of each of the first plurality of integrity records from the integrity authority if said hash of at least one component of said integrity report is not found in said second plurality of integrity records, and to provide a trust report to the authentication server, wherein said trust report includes an integrity/trust score that is determined based at least in part on the comparison of said hash of at least one component with said trustworthy hash of each of the first plurality of integrity records and the second plurality of integrity records; a resource available on the network; and a policy server separate and remote from the client platform, and capable of being connected to the network to grant or deny access to the resource by the client platform according to the integrity/trust score, wherein the authenticator entity includes the verification server, the authentication server, and the policy server and the authenticator entity is configured to periodically synchronize said local signature database with said first plurality of integrity records of said global signature database.