Trust scoring for network entities in network

Abstract

The invention relates to trust scoring for network entities in a network. A method determines, by a computing system, a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust for the network entity; and modifying, by the computing system, a traffic mode of the computer network based on the trust score for the network entity.

Description

[0001] Divisional Application Instructions

[0002] This application is a divisional application of the Chinese invention patent application with the application date of February 9, 2021, application number 202110181141.8, and name “Trust Scoring for Network Entities in the Network”. Technical Field

[0003] The present disclosure relates to security in computer networks. Background Art

[0004] Zero Trust Networking is an approach to network security in which network administrators envision that network entities should not be trusted by default, even if they are in a private network or have been previously authenticated. Example types of network entities may include network nodes (e.g., endpoint devices, intermediate network devices, etc.), network services, or other types of real or virtual entities that can be identified on a computer network. Because network entities are not trusted by default in Zero Trust Networking, identity and integrity checks are routinely performed on network entities, even if such entities are part of a private computer network. Summary of the invention

[0005] In general, the present disclosure describes techniques for network security in a computer network. As described in the present disclosure, a computing system determines a trust score for a network entity in a computer network. The trust score for the network entity indicates a level of trust in the network entity. The computing system can perform various actions based on the trust score for the network entity. For example, in some examples, the computing system can modify a business model in the computer network based on the trust score.

[0006] In one example, a method includes determining, by a computing system, a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity; and modifying, by the computing system, a business model of the computer network based on the trust score for the network entity;

[0007] In another example, a computing system includes one or more processors and one or more storage devices, the one or more processors including processing circuitry, the one or more processors being configured to: determine, by the computing system, a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity; and modify, by the computing system, a business model of the computer network based on the trust score for the network entity; the one or more storage devices being configured to store the trust score for the network entity.

[0008] In yet another example, a computer-readable storage medium includes instructions that, when executed, cause one or more programmable processors to: determine a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity; and modify a business model of the computer network based on the trust score for the network entity.

[0009] The details of one or more examples will be set forth in the accompanying drawings and the description below. Other features, objects, and advantages will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 is a block diagram illustrating an example computer network, in accordance with one or more techniques of this disclosure.

[0011] Figure 2 is a block diagram illustrating example components of a trust controller, in accordance with one or more techniques of this disclosure.

[0012] Figure 3 is a graph illustrating an example of trust scores changing over time, according to one or more techniques of this disclosure.

[0013] Figure 4 is a table illustrating an example of trust scores changing over time, according to one or more techniques of this disclosure.

[0014] Figure 5 is a flowchart illustrating example operations, in accordance with one or more techniques of this disclosure.

[0015] Figure 6 is a flow diagram illustrating example operations for determining a trust score and performing actions based on the trust score, in accordance with one or more techniques of this disclosure. DETAILED DESCRIPTION

[0016] Figure 1 1 is a block diagram illustrating an example computer network 100, according to one or more techniques of the present disclosure. Computer network 100 may include various types of computer networks, such as a private network (e.g., an internal corporate or government network), a virtual private network, a residential network, etc., or a public network (e.g., a cellular communication network, an Internet backbone network, etc.).

[0017] Figure 1In the example of , the computer network 100 includes a set of network entities 102A to 102N, where N corresponds to an arbitrary number. The present disclosure may collectively refer to the network entities 102A to 102N as "network entities 102". Generally, each network entity in the network entities 102 is individually addressable within the computer network 100 and can send and receive data on the computer network 100. One or more network entities in the network entities 102 can be computing nodes, such as real or virtual endpoint devices (e.g., personal computers, smart phones, tablet computers, server devices, laptop computers, Internet of Things (IoT) devices, wearable devices, etc.) or real or virtual intermediate devices (e.g., routers, switches, firewall devices, virtualization devices, etc.). In some examples, one or more network entities in the network entities 102 can be network services, such as network servers, certain application programming interfaces (APIs), media streaming services, etc. Other types of network entities may include components, controllers, and routers through the computer network 100.

[0018] As mentioned above, a computer network (such as computer network 100) can be designed to operate using a zero-trust networking architecture. When a computer network operates using a zero-trust networking architecture, a large number of authentication and security checks are performed (e.g., each time a service is requested by a network entity from the computer network). Performing such checks may be resource-intensive and may increase network latency. Therefore, in order to improve network performance in a computer network that operates using a zero-trust networking architecture, a network administrator may temporarily reduce the intensity of checks on specific network entities. Although doing so can improve network performance, doing so may undermine the overall security of the computer network because there is no systematic method for reducing the intensity of checks on a single network entity. Instead, such a reduction in the intensity of checks may be based on the experience and intuition of the network administrator. This can lead to inconsistencies and configuration errors in the computer network, for example, the recognition of the reduction in the intensity of checks may not be passed on within the network administrator. Ultimately, this can lead to adverse results, such as security vulnerabilities and network outages.

[0019] This disclosure describes techniques that can address one or more of these issues. Figure 1As shown in the example of , the computer network 100 includes a trust controller 104. The trust controller 104 is a computing system that includes one or more computing devices (such as one or more server devices, personal computer devices, or other types of computing devices). The trust controller 104 determines a trust score for a network entity 102 in the computer network 100. Additionally, the trust controller 104 can use the trust score for the network entity 102 to perform various actions with respect to the computer network 100. In some embodiments, a computing system other than the trust controller 104 uses the trust score for the network entity 102 to perform actions with respect to the computer network 100. However, for ease of explanation, the present disclosure describes the trust controller 104 as performing an action. Because the trust controller 104 determines the trust score in a predictable, replicable manner, the trust score can be consistently applied throughout the network entities of the computer network 100. Therefore, inconsistencies associated with temporary adjustments to checks can be reduced, and there can be less need for documentation, which is used to convey awareness of security procedures between network administrators. Trust controller 104 may be implemented as a single trust controller, or as (or within) a system (e.g., a hierarchy) of two or more trust controllers. In examples where trust controller 104 is implemented as a system of trust controllers, trust controllers of trust controller 104 may correspond to particular classes of network entities, different network entities in a subnetwork of computer network 100, or other groups of network entities.

[0020] As mentioned above, the trust controller 104 determines a trust score for the network entity 102. The trust score for the network entity indicates a level of trust in the network entity. Generally, if the network entity has been previously performed in a manner expected by an administrator of the computer network 100, there is a higher trust in the network entity. Conversely, if the network entity has not been performed in a manner expected by an administrator of the computer network 100, there is a lower trust in the network entity. For example, if the network entity is known to be compromised by malware, if the network entity is known to generate corrupted data, if the network entity is known to have frequent service interruptions, if the network entity has a known unpatched security vulnerability, etc., the trust score for the network entity may indicate a low trust.

[0021] The trust controller 104 may determine a trust score for a network entity based on several factors. For example, the trust controller 104 may determine a trust score for a network entity based on one or more contribution classes. A contribution class is a class of information that contributes to a trust score for a network entity. In some examples, a contribution class includes one or more prerequisites in a set of prerequisites for the network entity, and / or a set of reputation factors for the network entity.

[0022] In some examples, there may be a separate sub-score for each contribution class in the contribution class. For example, there may be a first sub-score for a prerequisite of a network entity, a second self-score for a variable factor of a network entity, and a third sub-score for a reputation factor of a network entity. In some examples, the sub-score of a contribution class is expressed as a percentage of the highest possible sub-score of the contribution class. In some other examples, the sub-score of a contribution class is expressed in other ways. The trust controller 104 can use the sub-scores (e.g., first, second, and third sub-scores) of the contribution class of the network entity to determine a trust score for the network entity. Therefore, the trust score for the network entity can be the result of a mathematical calculation based on one or more of the following: a prerequisite for the network entity, a variable factor for the network entity, and / or a reputation factor for the network entity.

[0023] Each of the prerequisites for the network entity is a condition that must be satisfied for the trust score for the network entity to have a value greater than a minimum value (e.g., 0). In the present disclosure, the trust score for the network entity having a minimum value means that the lowest level of trust (e.g., no trust) is provided to the network entity. In some examples, the minimum value may be equal to 0. However, a value other than 0 may be used to represent a trust score indicating no trust.

[0024] The variable factors for the network entity correspond to current characteristics of the network entity. Example characteristics of the network entity may include: current configuration of the network entity, version of the network entity, active features of the network entity, etc. The variable factors may be weighted so that some of the variable factors contribute more to the variable factor sub-score than other of the variable factors.

[0025] Each of the reputation factors for a network entity may be variable based on a specified historical event involving the network entity. For example, the trust controller 104 modifies the value of a reputation factor for the network entity based on the behavior of the network entity over time. For example, the trust controller 104 may modify the value of a reputation factor based on the number of times the network entity automatically restarts. In another example, the trust controller 104 may modify the value of a reputation factor based on the number of times the network entity is reconfigured.

[0026] Figure 2 is a block diagram illustrating example components of trust controller 104 , in accordance with one or more techniques of this disclosure. Figure 2 Only one specific example of a trust controller 104 is illustrated, and many other example configurations of the trust controller 104 exist.

[0027] As in Figure 2 As shown in the example of , the trust controller 104 includes one or more processors 202, one or more communication units 204, one or more input devices 208, one or more output devices 210, zero or more display screens 212, one or more power supplies 214, one or more storage devices 216, and one or more communication channels 218. The trust controller 104 may include other components. For example, the trust controller 104 may include physical buttons, microphones, speakers, communication ports, etc. (Multiple) communication channels 218 can interconnect each of the components 202, 204, 208, 210, 212, and 216 for inter-component communication (physically, communicatively, and / or operationally). In some examples, (multiple) communication channels 218 may include a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data. (Multiple) power supplies 214 can provide power to the components 202, 204, 208, 210, 212, and 216.

[0028] The storage device(s) 216 may store the required information for use during the operation of the trust controller 104. In some examples, the storage device(s) 216 have the primary purpose of being a short-term rather than long-term computer-readable storage medium. The storage device(s) 216 may include volatile memory and may therefore not retain stored contents if power is removed. In some examples, the storage device(s) 216 include non-volatile memory configured for long-term storage of information and for retaining information after power on / off cycles. In some examples, the processor(s) 202 of the trust controller 104 may read and execute instructions stored by the storage device(s) 216.

[0029] The trust controller 104 may include one or more input devices 208 that the trust controller 104 uses to receive user input. Examples of user input include tactile, audio, and video user input. The input device(s) 208 may include a presence sensitive screen, a touch sensitive screen, a mouse, a keyboard, a voice response system, a microphone, a motion sensor capable of detecting gestures, or other types of devices for detecting input from a human or machine.

[0030] The communication unit(s) 204 may enable the trust controller 104 to send data to and receive data from one or more other computing devices (e.g., via a computer network, such as a local area network or the Internet). For example, the communication unit(s) 204 may be configured to receive data from the network entity 102. In some examples, the communication unit(s) 204 may include a wireless transmitter and receiver that enable the trust controller 104 to communicate wirelessly with other computing devices. Examples of the communication unit(s) 204 may include a network interface card, an Ethernet card, an optical transceiver, a radio frequency transceiver, or other type of device capable of sending and receiving information. Other examples of such communication units may include Bluetooth. TM , 3G, 4G, 5G, and WI-FI TM radio, universal serial bus (USB) interface, etc. Additionally, the trusted controller 104 may communicate with one or more other devices using the communication unit(s) 204 .

[0031] Output device(s) 210 may generate output. Examples of output include tactile, audio, and video output. Output device(s) 210 may include a presence-sensitive screen, a sound card, a video graphics adapter card, a speaker, a liquid crystal display (LCD), a light-emitting diode (LED) display, or other types of devices for generating output. Output device(s) 210 may include a display screen 212. In some examples, output device(s) 210 may include a virtual reality, augmented reality, or mixed reality display device.

[0032] Processor(s) 202 may include processing circuitry configured to perform various actions. Processor(s) 202 may be configured to read instructions from storage device(s) 216 and may execute instructions stored by storage device(s) 216. Execution of the instructions by processor(s) 202 may configure or cause trust controller 104 to provide at least some of the functionality attributed to trust controller 104 or components thereof (e.g., processor(s) 202) in the present disclosure. Figure 2 As shown in the example of , storage device(s) 216 include computer readable instructions associated with data collection system 220, scoring system 222, action system 224, and tracking system 226. Figure 2 In the example of , the storage device(s) 216 may also include source data 228 and scoring data 230. Figure 2As shown in the example of , the computer readable instructions associated with the scoring system 222 may include computer readable instructions associated with the prerequisite system 232, the variable factor system 234, the reputation system 236, and the calculation system 238. In some other examples, the storage device(s) 216 may include computer readable instructions associated with other systems or modules.

[0033] The data collection system 220 is configured to collect data about the network entity 102. For example, as part of collecting data about the network entity 102, the data collection system 220 can query the log data of the network entity. In some examples, the data collection system 220 can be configured to collect configuration and performance data about the network entity. The configuration and performance data can include snapshots of configuration data, snapshots of alarm data, and logs. The source data 228 can include data collected by the data collection system 220.

[0034] Scoring system 222 may use source data 228 to determine a trust score for network entity 102. Scoring data 230 may include a trust score for network entity 102 determined by scoring system 222. Figure 2 In the example of FIG. 1 , prerequisite system 232 may determine a prerequisite sub-score for network entity 102. Variable factor system 234 may determine a variable factor sub-score for network entity 102. Reputation system 236 may determine a reputation sub-score for network entity 102. Computing system 238 may use one or more of the prerequisite sub-score for the network entity, the variable factor sub-score for the network entity, or the reputation sub-score for the network entity to determine a trust score for the network entity.

[0035] As mentioned above, the prerequisite system 232 can determine a prerequisite sub-score for the network entity 102. That is, the prerequisite system 232 can determine a trust score for the network entity based on one or more prerequisites. Each of the prerequisites is a condition that must be met for the trust score for the network entity to not have a minimum value. The prerequisite system 232 can evaluate the conditions to determine the prerequisite sub-score for the network entity. The prerequisite system 232 can store the prerequisite sub-score for the network entity 102 in the score data 230. Example conditions can include: whether the network entity is released using certified software, whether the network entity is released using certified hardware, etc. Other prerequisites can include: the network entity does not use a known vulnerable software version, the network entity uses only supported software or hardware versions, the network entity has the correct network time setting, the network entity has the correct certificate for the loaded transport layer security (TLS), etc. The conditions can be user defined.

[0036] In addition, the variable factor system 234 can determine a variable factor sub-score for the network entity 102. Each of the one or more variable factors for the network entity corresponds to a current characteristic of the network entity. The variable factor system 234 can store the variable factor sub-score for the network entity 102 in the scoring data 230. The characteristics can be user defined. Examples of characteristics can include:

[0037] Use only approved applications on the network entity.

[0038] Only use applications that are signed on the network entity.

[0039] Whether the released version of the network entity is a known good version.

[0040] The status or configuration of network entities, for example, whether the recommended configuration is applied

[0041] • Whether the software release version of the network entity's software application is within a given number of releases of the current version of the software application.

[0042] • Rate limiting of requests to be processed by the router's routing engine.

[0043] · Limitation on the rate of possible network management interactions per time period.

[0044] Password strength requirements.

[0045] The number and type of open network ports.

[0046] Whether encryption keys are updated more frequently than a threshold time limit.

[0047] The variable factor system 234 may apply different weights to different characteristics to determine the variable factor sub-score for the network entity. Therefore, a specific characteristic may contribute more to the variable factor sub-score than other characteristics. Table 1 below shows an example contribution of a specific selection (possible value) for a specific characteristic of a network entity. As shown in the example of Table 1, software applications (apps) may be classified into multiple classes (e.g., class 1, class 2, class 3, etc.). Different classes of apps may correspond to different levels of risk. For example, class 1 apps may be limited to apps approved by a system vendor, signed applications, applications with security audits, etc., class 2 apps may be limited to apps approved by a provider, unsigned applications, applications with regular security upgrades, etc., class 3 apps may be unapproved apps, etc. In Table 1, the contribution column indicates that the score may be contributed if the corresponding selection in the "Selection" column is applicable. In some other examples, one or more selections may be associated with a negative value, but the final variable factor sub-score may be limited to a minimum value of 0 or other predefined minimum values. In Table 1, the "Example Score" column provides an example of how the variable factor sub-score for a specific network entity may be calculated. Thus, in the example of Table 1, if the network entity uses only Class 1 apps and has a software version that is within 3 releases of the most recent release of the software, but the software is not a known good release, the variable factor system 234 can determine a variable factor sub-score of 60 (e.g., 50+10).

[0048] Table 1

[0049]

[0050] The reputation system 236 may determine a reputation sub-score for the network entity 102. The reputation sub-score for the network entity may be based on one or more reputation factors for the network entity. One or more of the reputation factors for the network entity may vary according to specified historical events involving the network entity. The reputation factors for the network entity may be user defined. Historical events may be defined as those events that occurred within a specific time period (e.g., 5 weeks, 10 weeks, 6 months, etc.). The reputation system 236 may store the reputation sub-score for the network entity 102 in the score data 230. Example types of reputation factors may include:

[0051] • Number of time intervals without reset of the network entity (eg, weeks, days, etc.).

[0052] • Number of time intervals (eg, weeks, days, etc.) without restarts of network entities.

[0053] ·The number of failed logins.

[0054] Login frequency.

[0055] Configure frequency.

[0056] The number of protocol timeouts or other runtime data.

[0057] Table 2 below shows an example of how reputation system 236 may determine a reputation sub-score for a network entity. For example, in Table 2, for each month in which the network entity does not experience a reset, reputation system 236 may increase the reputation sub-score for the network entity by 5. Additionally, in Table 2, for each month in which the network entity does not experience a reboot, reputation system 236 may increase the reputation sub-score for the network entity by 15. Because the time period considered is 5 months, in this example, the maximum reputation sub-score is 100.

[0058] Table 2

[0059]

[0060] The computing system 238 may determine a trust score for the network entity using one or more of a prerequisite sub-score for the network entity, a variable factor sub-score for the network entity, or a reputation sub-score for the network entity. When calculating the trust score for the network entity, if one or more of the prerequisites are not met (e.g., if the prerequisite sub-score has a minimum value (e.g., 0)), the computing system 238 may determine that the trust score for the network entity indicates no trust. In some examples, the computing system 238 determines the trust score for the network entity as the sum of the variable factor sub-score and the reputation sub-score. In some examples, the computing system 238 determines the trust score for the network entity as a weighted sum of the variable factor sub-score and the reputation sub-score. For example, the computing system 238 may apply a 60% weight to the variable factor sub-score and a 40% weight to the reputation sub-score. In some examples, the weights applied to the variable factor sub-score and the reputation sub-score are user-defined. Therefore, because the weights applied to the variable factor sub-score and the reputation sub-score are user-defined, the final trust score may be dependent on the user's priorities and preferences. In some examples, computing system 238 may multiply the resultant sum (or weighted sum) by the prerequisite sub-score to determine a trust score for the network entity. In some examples, if any of the prerequisites are not met, computing system 238 may simply set the trust score for the network entity to a minimum value (e.g., 0) instead of trust controller 104 calculating the prerequisite sub-score. Computing system 238 may store the trust score for network entity 102 in score data 230.

[0061] In some examples, the scoring system 222 may aggregate trust scores for two or more of the network entities 102 to determine a trust score for a higher-order network entity. Example types of higher-order network entities may include networks, services, routes, and / or other collections of one or more network entities. The scoring system 222 may aggregate the trust scores in one of a variety of ways. For example, the scoring system 222 may aggregate the trust scores for two or more of the network entities 102 to determine a trust score for the higher-order network entity by taking the lowest trust score for the two or more network entities as the trust score for the higher-order network entity. In another example, the scoring system 222 may aggregate the trust scores for two or more of the network entities 102 to determine a trust score for the higher-order network entity as an average or sum of the trust scores for the two or more of the network entities.

[0062] The action system 224 may perform one or more actions based on the trust score for the network entity 102 determined by the scoring system 222. For example, the action system 224 may modify the traffic mode of the computer network 100 based on the trust score for the network entity. For example, in this example, based on the trust score for the network entity, the action system 224 may change the traffic mode of the computer network 100 to divert network traffic away from the network entity or to direct network traffic to the network entity. For example, if the trust score for the network entity is below a certain threshold, the action system 224 may change the traffic mode of the computer network 100 to divert network traffic away from the network entity. In some examples, if the trust score for the network entity is above a certain threshold, the action system 224 may change the traffic mode of the computer network 100 to direct network traffic to the network entity. In another example, based on the trust score for the network entity being above a certain threshold, the action system 224 may send instructions to one or more routers in the computer network 100, which cause the routers to change routes in the computer network 100 so that packets are not directed along routes directed to or through the network entity.

[0063] In another example, the action system 224 may determine that there is conflicting information between two sensors (e.g., in the context of an aircraft, an angle of attack sensor and a pitch angle sensor). In this example, the action system 224 may perform one or more actions based on a trust score for a sensor (e.g., a network entity) in response to determining such a conflict. For example, the action system 224 may generate a notification to an operator, recommending the use of information from a sensor with a higher trust score. In another example, the action system 224 may disable a sensor with a lower trust score. In some examples, the action system 224 may recommend a probe or obtain a combination of other sensor data to determine which of the two sensors is more likely to generate accurate data. In an example where the network entity includes multiple clock sources (e.g., a precision time protocol (PTP) clock source), the action system 224 may change the primary clock source from the current clock source to the backup clock source because the backup clock source has a higher trust score than the current clock source. In some examples, the action system 224 may identify a route through the network 100 based on the trust score for the network entity in the network 100. Thus, action system 224 may configure the router to route network traffic along routes that pass through network entities with high trust scores.

[0064] In some examples, tracking module 226 can track changes in trust scores, and / or sub-scores over time. For example, Figure 3 is a graph illustrating an example of how a trust score changes over time in accordance with one or more techniques of the present disclosure. A user may use information about changes in trust scores and / or sub-scores for a variety of purposes. For example, a user may use historical information about trust scores for network entities to determine which network entities require attention (e.g., need to be upgraded, audited, reviewed, tested, etc.). In some examples, a user may use such historical information to identify network entities with consistently high trust scores and configure network 100 to utilize the identified network entities for high priority tasks, such as for emergency communications during an emergency situation). Figure 3 In the example of , a good initial setup means that all prerequisites are met and the variables and reputation factors lead to a good initial score. Behaviors correspond to actions that change the trust score over time.

[0065] Figure 4 4 is a table 400 showing an example of how trust scores change over time, according to one or more techniques of this disclosure. Figure 4In the example of , the prerequisites include: whether the network entity is released using certified software, and whether the network entity is released using certified hardware. In addition, in table 400, variable factors include: software factors (e.g., whether the network entity's software is limited to approved applications; whether the network entity's software is limited to signed applications; or whether the network entity's software includes unsigned applications). Reputation factors in table 400 include: the number of time intervals without resets (e.g., weeks, days, etc.), and the number of time intervals without restarts. In Figure 4 In the example of , resets occur on days 2, 4, and 6, and restarts occur on day 7. Figure 4 In the example of , the prerequisite or variable factor sub-score does not change in days 0 to 9. However, due to the passage of time and various resets and restarts, the reputation sub-score changes (e.g., from 0 to 8 to 12 to 20, etc.). As a result, the trust score for the network entity also changes (e.g., from 60 to 68 to 72 to 80, etc.). Due to the change in the trust score for the network entity, various actions can be performed with respect to the network entity over time. For example, when the trust score for the network entity is less than 65, the action system 224 can transfer network traffic away from the network entity. Therefore, in Figure 4 In the example of FIG. 1 , network traffic may be directed toward the network entity on days 1 through 6, 8, and 9, and transferred away from the network entity on days 0 and 7.

[0066] Figure 5 is a flow chart illustrating example operations according to one or more techniques of this disclosure. Figure 5 In the example of , a computing system (e.g., trust controller 104) can determine a trust score (500) for a network entity (e.g., one of network entities 102) in computer network 100. The trust score for the network entity indicates a level of trust in the network entity. The computing system can determine the trust score according to any of the examples provided elsewhere in this disclosure.

[0067] In addition, Figure 5 In an example of the present invention, the computing system can modify the traffic pattern of the computer network 100 based on the trust score for the network entity (502). For example, the computing system can instruct one or more intermediate network devices (e.g., routers) to change the routing in the computer network 100 to avoid sending traffic to the network entity. In another example, the computing system can instruct a firewall device to block traffic from the network entity. As described elsewhere in this disclosure, the computing system can perform other actions based on the trust score for the network entity.

[0068] Figure 6is a flow chart illustrating example operations for determining a trust score and performing actions based on the trust score according to one or more techniques of the present disclosure. Figure 6 In an example of , the scoring system 222 may obtain source data 228 (600). The scoring system 222 may obtain source data 228 from various sources. For example, the scoring system 222 may obtain source data directly from a network entity (e.g., a device, an app, etc.), from an intermediate device that controls the network entity (e.g., an element management system (EMS) controller, software defined networking (SDN), etc.), offline records, etc. In some examples, the trust controller 104 (e.g., the scoring system 222 of the trust controller 104) may perform operations to determine a trust score for the network entity in response to receiving a request from a user or application. In some examples, the trust controller 104 may perform operations based on a periodic basis (e.g., once per time interval, such as once per day) to determine a trust score for the network entity. In some examples, the trust controller 104 may perform operations to determine a trust score for the network entity in response to a manual trigger (such as a user input). In some examples, the trust controller 104 may perform operations to determine a trust score for the network entity in response to a specific event (such as a drop in the trust score for one or more other network entities).

[0069] In addition, Figure 6 In an example of , a prerequisite system 232 of a scoring system 222 may determine a prerequisite sub-score for a network entity (602). Each of the one or more prerequisites is a condition that must be satisfied if the trust score for the network entity does not have a minimum value. In some examples, in order to determine the prerequisite sub-score for the network entity, the prerequisite system 232 may evaluate one or more prerequisites about the network entity. Each of the prerequisites may be a Boolean condition (e.g., a statement that evaluates to true or false). Therefore, the prerequisite sub-score itself may be a Boolean value. Based on the source data 228, the prerequisite system 232 may determine whether each of the prerequisites evaluates to true or false. In this example, if any of the prerequisites evaluates to false, the prerequisite system 232 may set the prerequisite sub-score for the network entity to false (e.g., 0). In other words, if any of the prerequisites evaluates to false, the prerequisite system 232 may define the overall prerequisite as not being satisfied.

[0070] Additionally, variable factor system 234 of scoring system 222 can determine variable factor sub-scores for the network entity (604). Each of the one or more variable factors for the network entity corresponds to a current characteristic of the network entity. Variable factor system 234 can determine variable factor sub-scores can use source data 229 to determine a score for one or more characteristics of the network entity.

[0071] Reputation system 236 of scoring system 222 may determine a reputation sub-score for the network entity (606). Each of the reputation factors for the network entity varies according to a specified historical event involving the network entity. For example, reputation system 236 may determine the reputation sub-score, for example, as described in this disclosure with respect to Table 2 or elsewhere.

[0072] The computing system 238 of the scoring system 222 may then determine a trust score for the network entity based on the prerequisite sub-score for the network entity, the reputation sub-score for the network entity, and the trust score for the network entity (608). For example, if the prerequisite sub-score for the network entity indicates that the prerequisite has not been met, the computing system 238 may set the trust score for the network entity to a minimum trust score. In this example, if the prerequisite sub-score for the network entity indicates that the prerequisite has not been met, the computing system 238 may determine the trust score for the network entity as the sum (or weighted sum) of the variable factor sub-score for the network entity and the reputation sub-score for the network entity. In some examples, the computing system 238 may determine the trust score for the network entity as a percentage of the highest possible trust score.

[0073] The action system 224 may perform one or more actions (610) based on the trust score. For example, based on the trust score for the network entity being below a certain threshold, the action system 224 may divert network traffic away from the network entity, or direct network traffic to the network entity. For example, in this instance, the action system 224 may send a message to one or more devices in the network 100, the message directing the device to direct the network traffic along a route that is not dependent on the network entity. In some examples, including examples in which the action system 224 does not modify the business model of the computer network based on the trust score, the action system 224 may modify the test mode for the network entity by the computing system based on the trust score for the network entity. The test mode may correspond to a mode (e.g., an event mode, an event-based mode, etc.) used to perform a test on the network entity (e.g., by the trust controller 104 or another system). Example types of tests may include: network probing, auditing, data logging, etc. Modifying the test mode may include increasing or decreasing the intensity of the test mode.

[0074] The following is a non-limiting list of aspects consistent with one or more techniques of the present disclosure.

[0075] Aspect 1. A method, comprising: determining, by a computing system, a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity; and modifying, by the computing system, a business model of the computer network based on the trust score for the network entity.

[0076] Aspect 2. The method according to aspect 1, wherein modifying the traffic pattern comprises: changing the traffic pattern by the computing system based on the trust score for the network entity to divert network traffic away from the network entity or to direct network traffic toward the network entity.

[0077] Aspect 3. A method according to Aspect 1 or 2, wherein determining a trust score for a network entity comprises: determining, by a computing system, a trust score for the network entity based on one or more prerequisites, wherein each of the one or more prerequisites is a condition that must be satisfied if: the trust score for the network entity is not a minimum value.

[0078] Aspect 4. The method according to aspect 3, wherein the prerequisite comprises: whether the network entity is released using certified software, and whether the network entity is released using certified hardware.

[0079] Aspect 5. A method according to any one of Aspects 1 to 4, wherein determining a trust score for a network entity comprises: determining, by a computing system, a trust score for the network entity based on one or more variable factors for the network entity, wherein each of the one or more variable factors for the network entity corresponds to a current characteristic of the network entity.

[0080] Aspect 6. The method according to aspect 5, wherein the variable factors include: whether the software of the network entity is limited to approved applications, whether the software of the network entity is limited to the first category of applications, or whether the software of the network entity includes the second category of applications.

[0081] Aspect 7. A method according to any one of Aspects 1 to 6, wherein determining a trust score for a network entity comprises: determining, by a computing system, a trust score for the network entity based on one or more reputation factors for the network entity, wherein each of the reputation factors for the network entity varies according to a specified historical event involving the network entity.

[0082] Aspect 8. The method according to aspect 7, wherein the reputation factor comprises one or more of: the number of time intervals without a reset of the network entity, or the number of time intervals without a restart of the network entity.

[0083] Aspect 9. A method according to any one of Aspects 1 to 8, wherein determining a trust score for a network entity comprises: determining a first sub-score by a computing system based on one or more prerequisites, wherein each of the one or more prerequisites is a condition that must be satisfied if: the trust score for the network entity is not a minimum value; determining a second sub-score by the computing system based on one or more variable factors of the network entity, wherein each of the one or more variable factors corresponds to a current characteristic of the network entity; determining a third sub-score by the computing system based on one or more reputation factors of the network entity, wherein each of the reputation factors varies according to a specified historical event involving the network entity; and determining the trust score for the network entity by the computing system based on the first sub-score, the second sub-score, and the third sub-score.

[0084] Aspect 10. The method according to any one of aspects 1 to 9, wherein the network entity is a higher-order network entity including multiple network entities, and determining the trust score for the higher-order network entity comprises: aggregating the trust scores for the multiple network entities to determine the trust score for the higher-order network entity.

[0085] Aspect 11. The method according to any one of aspects 1 to 10, wherein the method further comprises: modifying, by the computing system, a test pattern for the network entity based on the trust score for the network entity.

[0086] Aspect 12. A computing system comprising: one or more processors, including a processing circuit device, the one or more processors being configured to: determine, by the computing system, a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity; and modify, by the computing system, a business model of the computer network based on the trust score for the network entity; and one or more storage devices, configured to store the trust score for the network entity.

[0087] Aspect 13. The computing system of aspect 12, wherein the one or more processors are configured such that as part of modifying the traffic pattern, the one or more processors: change the traffic pattern based on the trust score for the network entity to divert network traffic away from the network entity.

[0088] Aspect 14. A computing system according to Aspect 12 or 13, wherein the one or more processors are configured such that as part of determining a trust score for a network entity, the one or more processors: determine the trust score for the network entity based on one or more prerequisites, wherein each of the one or more prerequisites is a condition that must be met for the trust score for the network entity to be not a minimum value.

[0089] Aspect 15. The computing system according to aspect 14, wherein the prerequisite comprises: whether the network entity is released using certified software, and whether the network entity is released using certified hardware.

[0090] Aspect 16. A computing system according to any one of Aspects 12 to 15, wherein the one or more processors are configured such that as part of determining a trust score for a network entity, the one or more processors: determine the trust score for the network entity based on one or more variable factors for the network entity, wherein each of the one or more variable factors for the network entity corresponds to a current characteristic of the network entity.

[0091] Aspect 17. The computing system of Aspect 16, wherein the variable factors include whether the network entity's software is limited to approved applications, whether the network entity's software is limited to signed applications, or whether the network entity's software includes unsigned applications.

[0092] Aspect 18. A computing system according to any of Aspects 12 to 17, wherein the one or more processors are configured such that, as part of determining a trust score for a network entity, the one or more processors: determine a trust score for the network entity based on one or more reputation factors for the network entity, wherein each of the reputation factors for the network entity varies based on a specified historical event involving the network entity.

[0093] Aspect 19. The computing system of aspect 18, wherein the reputation factor comprises one or more of: a number of time intervals without a reset of the network entity, or a number of time intervals without a restart of the network entity.

[0094] Aspect 20. A computing system according to any one of Aspects 12 to 19, wherein one or more processors are configured such that, as part of determining a trust score for a network entity, the one or more processors: determine a first sub-score based on one or more prerequisites, wherein each of the one or more prerequisites is a condition that must be satisfied if: the trust score for the network entity is not a minimum value; determine a second sub-score based on one or more variable factors of the network entity, wherein each of the one or more variable factors corresponds to a current characteristic of the network entity; determine a third sub-score based on one or more reputation factors of the network entity, wherein each of the reputation factors varies based on a specified historical event involving the network entity; and determine the trust score for the network entity based on the first sub-score, the second sub-score, and the third sub-score.

[0095] Aspect 21. The computing system of any one of aspects 12 to 20, wherein the network entity is a higher-order network entity comprising a plurality of network entities, and the one or more processors are configured to: aggregate trust scores for the plurality of network entities to determine a trust score for the higher-order network entity.

[0096] Aspect 22. The computing system of any of aspects 12 to 20, wherein the one or more processors are further configured to: modify a test pattern for a network entity based on a trust score for the network entity.

[0097] Aspect 23. A computer-readable storage medium comprising instructions that, when executed, cause one or more programmable processors to: determine a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity; and modify a business model of the computer network based on the trust score for the network entity.

[0098] Aspect 24. The computer-readable storage medium according to Aspect 23, wherein the instructions, when executed, cause the one or more programmable processors to perform the method of any one of Aspects 1 to 11.

[0099] Although the present disclosure is primarily described with respect to network entities, the techniques of the present disclosure may be applicable with respect to other concepts such as social media profiles, gaming profiles, real-world service providers, and the like.

[0100] In the present disclosure, terms such as "first", "second", "third", etc. are used nominally rather than sequentially, and therefore, unless otherwise specified, are not necessarily indicators of position within a sequence, but may be used to distinguish different instances of the same thing. The examples provided by the present disclosure may be used together, separately, or in various combinations. In addition, for examples involving personal data related to a user, it may be necessary to use such personal data only with the user's permission.

[0101] It should be appreciated that, according to examples, certain actions or events of any of the techniques described herein may be performed in a different order, may be added, combined, or omitted entirely (e.g., not all described actions or events are necessary for practicing the techniques). In addition, in some examples, actions or events may be performed concurrently rather than sequentially, such as by multithreading, interrupt handling, or multiple processors.

[0102] In one or more examples, the described functions may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored as one or more instructions or codes on a computer-readable medium or transmitted thereon via a computer-readable medium, and may be executed by a hardware-based processing unit. Computer-readable media may include computer-readable storage media, which corresponds to tangible media such as data storage media, or communication media, including, for example, any media that facilitates the transfer of a computer program from one place to another according to a communication protocol. In this manner, computer-readable media may generally correspond to (1) a non-transitory tangible computer-readable storage medium, or (2) a communication medium such as a signal or carrier wave. The data storage medium may be any available medium that is accessible by one or more computers or one or more processing circuits to retrieve instructions, codes, and / or data structures for implementing the techniques described in the present disclosure. A computer program product may include a computer-readable medium.

[0103] As an example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage, or other magnetic storage devices, flash memory, cache memory, or any other medium that can be used to store the desired program code in the form of instructions or can be used to store data structures and can be accessed by a computer. Moreover, any connection is appropriately referred to as a computer-readable medium. For example, if a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wireless technology (such as infrared, radio and microwave) is used to send instructions from a website, server or other remote source, the definition of the medium includes coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology such as infrared, radio and microwave. However, it should be understood that computer-readable storage media and data storage media do not include connections, carriers, signals or other transient media, but are directed to non-transient tangible storage media. The disk and disc used herein include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD) and blue-ray disc, wherein the disk usually copies data magnetically, while the disc uses lasers to optically copy data. Combinations of the above should also be included within the scope of computer-readable media.

[0104] The functionality described in this disclosure can be performed by fixed-function and / or programmable processing circuit devices. For example, instructions can be performed by fixed-function and / or programmable processing circuit devices. Such processing circuit devices may include one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuit devices. Therefore, as used herein, the term "processor" may refer to any of the aforementioned structures or any other structure suitable for implementing the technology described herein. In addition, in some aspects, the functionality described herein may be provided within dedicated hardware and / or software modules. Moreover, the technology may be fully implemented in one or more circuits or logic elements. The processing circuit may be coupled to other components in various ways. For example, the processing circuit may be coupled to other components via internal device interconnection, wired or wireless network connection, or another communication medium.

[0105] The technology of the present disclosure can be implemented in a variety of devices or apparatuses, integrated circuits (ICs) or a group of ICs (e.g., chipsets). Various components, modules, software systems, or units are described in the present disclosure to emphasize the functional aspects of the devices configured to perform the disclosed technology, but do not necessarily need to be implemented by different hardware units. Instead, as described above, the various units can be combined in hardware units, or provided by a collection of interoperable hardware units, including one or more processors as described above in combination with suitable software and / or firmware.

Claims

1. A method comprising: determining, by a computing system, a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity, wherein determining the trust score for the network entity comprises determining the trust score for the network entity based on one or more reputation factors for the network entity, wherein each of the reputation factors for the network entity varies according to a specified historical event involving the network entity, and the reputation factors comprise one or more of: a number of time intervals without a reset of the network entity, or a number of time intervals without a restart of the network entity; as well as A business model of the computer network is modified, by the computing system, based on the trust score for the network entity.

2. The method of claim 1, wherein modifying the business model comprises: The traffic pattern is changed by the computing system based on the trust score for the network entity to divert network traffic away from the network entity or to direct the network traffic toward the network entity.

3. The method of claim 1 , wherein determining the trust score for the network entity comprises: determining, by the computing system, a first sub-score based on one or more preconditions, wherein each of the one or more preconditions is a condition that must be satisfied that: the trust score for the network entity is not a minimum value; determining, by the computing system, a second sub-score based on one or more variable factors of the network entity, wherein each variable factor of the one or more variable factors corresponds to a current characteristic of the network entity; determining, by the computing system, a third sub-score based on the one or more reputation factors of the network entity; as well as The trust score for the network entity is determined by the computing system based on the first sub-score, the second sub-score, and the third sub-score.

4. The method according to claim 1, wherein the method further comprises: A testing pattern for the network entity is modified by the computing system based on the trust score for the network entity.

5. A computing system comprising: One or more processors, including processing circuitry, the one or more processors being configured to: determining a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity, wherein determining the trust score for the network entity comprises determining the trust score for the network entity based on one or more reputation factors for the network entity, wherein each of the reputation factors for the network entity varies according to a specified historical event involving the network entity, and The reputation factor comprises one or more of: a number of time intervals without a reset of the network entity, or a number of time intervals without a restart of the network entity; as well as modifying a business model of the computer network based on the trust score for the network entity; as well as One or more storage devices configured to store the trust score for the network entity.

6. The computing system of claim 5, wherein the one or more processors are configured to, as part of modifying the traffic pattern, change the traffic pattern based on the trust score for the network entity to divert network traffic away from the network entity or to direct the network traffic toward the network entity.

7. The computing system of claim 5, wherein the one or more processors are configured to, as part of determining the trust score for the network entity: determining a first sub-score based on one or more preconditions, wherein each of the one or more preconditions is a condition that must be satisfied: the trust score for the network entity is not a minimum value; determining a second sub-score based on one or more variable factors of the network entity, wherein each variable factor of the one or more variable factors corresponds to a current characteristic of the network entity; determining a third sub-score based on the one or more reputation factors of the network entity; and The trust score for the network entity is determined based on the first sub-score, the second sub-score, and the third sub-score. 8 . The computing system of claim 5 , wherein the one or more processors are further configured to modify a testing mode for the network entity based on the trust score for the network entity.

9. A method comprising: determining, by a computing system, a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity, wherein the network entity is a higher-order network entity that includes a plurality of network entities, and determining the trust score for the higher-order network entity comprises: aggregating the trust scores for the plurality of network entities to determine the trust score for the higher-order network entity; and A business model of the computer network is modified, by the computing system, based on the trust score for the network entity.

10. The method of claim 9, wherein modifying the business model comprises: The traffic pattern is changed by the computing system based on the trust score for the network entity to divert network traffic away from the network entity or to direct the network traffic toward the network entity.

11. The method of claim 9, wherein the plurality of network entities comprises a specific network entity, and the method further comprises: A trust score for the particular network entity is determined by the computing system based on one or more preconditions, wherein each of the one or more preconditions is a condition that must be satisfied for the trust score for the particular network entity to be not a minimum value.

12. The method according to claim 11, wherein the prerequisites include: Whether the specific network entity is released using certified software, and whether the specific network entity is released using certified hardware.

13. The method of claim 9, wherein the plurality of network entities comprises a specific network entity, and the method further comprises: A trust score for the specific network entity is determined by the computing system based on one or more variable factors for the specific network entity, wherein each of the one or more variable factors for the specific network entity corresponds to a current characteristic of the specific network entity.

14. The method of claim 13, wherein the variable factors include: Whether the software of the specific network entity is limited to approved applications, whether the software of the specific network entity is limited to the first category of applications, or whether the software of the specific network entity includes the second category of applications.

15. The method of claim 9, wherein the plurality of network entities comprises a specific network entity, and the method further comprises: The trust score for the particular network entity is determined by the computing system based on one or more reputation factors for the particular network entity, wherein each of the reputation factors for the particular network entity varies according to specified historical events involving the particular network entity.

16. The method of claim 15, wherein the reputation factor comprises one or more of: a number of time intervals without a reset of the particular network entity, or a number of time intervals without a restart of the particular network entity.

17. The method of claim 9, wherein the plurality of network entities comprises a specific network entity, and the method further comprises: determining, by the computing system, a first sub-score based on one or more preconditions, wherein each of the one or more preconditions is a condition that must be satisfied that: the trust score for the particular network entity is not a minimum value; determining, by the computing system, a second sub-score based on one or more variable factors of the particular network entity, wherein each variable factor of the one or more variable factors corresponds to a current characteristic of the particular network entity; determining, by the computing system, a third sub-score based on one or more reputation factors of the particular network entity, wherein each of the reputation factors varies according to a specified historical event involving the particular network entity; as well as The trust score for the particular network entity is determined by the computing system based on the first sub-score, the second sub-score, and the third sub-score.

18. The method according to claim 9, wherein the method further comprises: A testing pattern for the network entity is modified by the computing system based on the trust score for the network entity.

19. A computing system comprising: One or more processors, including processing circuitry, the one or more processors being configured to: determining a trust score for a network entity in a computer network, the trust score for the network entity indicating a level of trust in the network entity, wherein the network entity is a higher-order network entity comprising a plurality of network entities, and the one or more processors are further configured to: aggregate the trust scores for the plurality of network entities to determine the trust score for the higher-order network entity; as well as modifying a business model of the computer network based on the trust score for the network entity; as well as One or more storage devices configured to store the trust score for the network entity.

20. The computing system of claim 19, wherein the one or more processors are configured to change the traffic pattern based on the trust score for the network entity to divert network traffic away from the network entity or to direct the network traffic toward the network entity.

21. The computing system of claim 19, wherein the plurality of network entities comprises a specific network entity, and the one or more processors are further configured to: A trust score for the particular network entity is determined based on one or more preconditions, wherein each of the one or more preconditions is a condition that must be satisfied for the trust score for the particular network entity to be not a minimum value.

22. The computing system of claim 21, wherein the prerequisites include: Whether the specific network entity is released using certified software, and whether the specific network entity is released using certified hardware.

23. The computing system of claim 19, wherein the plurality of network entities comprises a specific network entity, and the one or more processors are further configured to: A trust score for the specific network entity is determined based on one or more variable factors for the specific network entity, wherein each of the one or more variable factors for the specific network entity corresponds to a current characteristic of the specific network entity.

24. The computing system of claim 23, wherein the variable factors include: Whether the software of the specific network entity is limited to approved applications, whether the software of the specific network entity is limited to the first category of applications, or whether the software of the specific network entity includes the second category of applications.

25. The computing system of claim 19, wherein the plurality of network entities comprises a specific network entity, and the one or more processors are further configured to: The trust score for the particular network entity is determined based on one or more reputation factors for the particular network entity, wherein each of the reputation factors for the particular network entity varies according to specified historical events involving the particular network entity.

26. The computing system of claim 25, wherein the reputation factor comprises one or more of: a number of time intervals without a reset of the particular network entity, or a number of time intervals without a restart of the particular network entity.

27. The computing system of claim 19, wherein the plurality of network entities comprises a specific network entity, and the one or more processors are further configured to: determining a first sub-score based on one or more preconditions, wherein each of the one or more preconditions is a condition that must be satisfied that: the trust score for the particular network entity is not a minimum value; determining a second sub-score based on one or more variable factors of the particular network entity, wherein each variable factor of the one or more variable factors corresponds to a current characteristic of the particular network entity; determining a third sub-score based on one or more reputation factors of the particular network entity, wherein each of the reputation factors varies according to a specified historical event involving the particular network entity; and The trust score for the particular network entity is determined based on the first sub-score, the second sub-score, and the third sub-score.

28. The computing system of claim 19, wherein the one or more processors are further configured to modify a testing mode for the network entity based on the trust score for the network entity.

Images