| 摘要 |
The invention comprises a technique in which a desired computer security policy, e.g. member or corporate security policy, can be enforced by performing a host computer security assessment at the time of user authentication by means of a system configuration that comprises a managed and trusted device. In this way, a company can extend their corporate security policy to the user's desktop and verify an untrusted host, e.g. a PC, by means of a trustworthy technology, e.g. a hardened smartcard. Because the smartcard is relatively tamperproof, operations performed on the card are considered more trustworthy than those running solely on the PC. The smartcard and associated middleware running on the host perform such security-related functions as, for example, verifying that the host's anti-virus software is running and that it is not modified, verifying that the anti-virus software has the most recent virus definitions installed, verifying that the host is not currently infected and does not have dangerous and/or unpermitted remote control Trojan horses running and listening on TCP/IP ports, and checking that the host has a password-protected screen saver enabled to prevent unauthorized access to the system in the user's absence.
|
