Systems and methods for providing mobile security based on dynamic attestation

摘要

Instrumented networks, machines and platforms having target subjects (devices, transactions, services, users, organizations) are disclosed. A security orchestration service generates runtime operational integrity profiles representing and identifying a level of threat or contextual trustworthiness, at near real time, of subjects (including mobile devices) and applications on the instrumented target platform. Methods and systems are disclosed for dynamic attestation of mobile device integrity based upon subject reputation scores. In an embodiment, a method scores trustworthiness of a mobile device based on reputation scores for users associated with the device and/or a device reputation score. The method generates runtime integrity alerts regarding execution anomalies for applications executing on the device, calculates risks based on a ruleset, and determines a calculus of risk for the device. The method sends endpoint events comprising data and content of the integrity warnings to a trust orchestrator, which generates an integrity profile based on the endpoint events.

主权项

1. A method for providing runtime operational integrity of a mobile device to a mobile service provider using an endpoint trust agent, and a trust orchestrator, the method comprising:
generating, by the endpoint trust agent, one or more runtime integrity alerts regarding behavioral risks posed by actions of applications not operating with integrity currently executing on the mobile device; identifying, by the endpoint trust agent, risks based on a predetermined ruleset; determining a threat as an infected state on the mobile device by a calculus of risk based at least upon the integrity alerts and identified risks; sending, by the endpoint trust agent, a plurality of endpoint events comprising data and content of runtime integrity warnings to the trust orchestrator to apply flow controls based on the infected state on the mobile device; and generating, by the trust orchestrator, an integrity profile for applications not operating with integrity based on the received endpoint events, wherein the endpoint events are temporal events generated based on a normalization and collation of elements in endpoint assessment reports from a plurality of collaboration services.