Digital Trust Scoring for Device-Aware Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control methods, such as user accounts and passwords, are prone to misuse and do not adequately address the trustworthiness of the device being used, leading to potential malicious activities due to untrustworthy devices.
Innovation Solution
A system and method for determining digital trust of a client device and user by evaluating a combination of factors including digital certificates, user identity, and behavior-based and posture-based factors, using a cloud service to assign a dynamic digital trust score that can evolve over time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional access control methods (user accounts and passwords) are used, then access permission can be granted, but the system is prone to misuse and fraud because it does not assess device trustworthiness
Solution Approach 1:
The access control system is segmented into multiple independent evaluation components: device posture assessment (checking certificates, DNS, software agents), user identity verification, and behavior analysis. Each component evaluates a specific aspect of trustworthiness and combines their results to form an overall digital trust score, allowing comprehensive assessment without requiring a single complex verification mechanism
Solution Approach 2:
A cloud-based digital trust evaluation service acts as an intermediary between the access control system and the client devices. This service receives posture data from devices, performs comprehensive trust assessments, and returns digital trust scores that the access control system uses for decision-making. This intermediary handles the complexity of trust evaluation centrally, simplifying the local access control implementation
2Measurement precision
If multiple factors are evaluated to determine digital trust score, then trustworthiness assessment becomes more accurate, but the evaluation process becomes more complex
Solution Approach 1:
The trustworthiness evaluation is divided into distinct segmented factors: device posture (certificates, DNS, software agents), user identity, and behavioral patterns. Each factor is evaluated independently by specialized components, allowing precise measurement of each aspect while maintaining manageable complexity through modular processing of discrete evaluation elements
Solution Approach 2:
The system transforms multiple qualitative trust factors into a quantitative digital trust score parameter. By converting diverse evaluation criteria (certificate validity, DNS reputation, behavior patterns) into a unified numerical score with defined thresholds, the system achieves precise trustworthiness measurement while simplifying the decision-making process through parameter-based evaluation
3Object-affected harmful factors
If digital trust score is used for access permission, then malicious activities can be reduced, but access control decisions become more complex
Solution Approach 1:
The system changes the access control parameter from binary authentication (yes/no) to a continuous digital trust score with defined thresholds. Access decisions are made by comparing the calculated trust score against predetermined threshold values, automatically reducing access for low-trust devices while maintaining ease of operation through automated threshold-based decision-making rather than manual evaluation
Solution Approach 2:
The system implements continuous feedback loops where device posture and behavior are constantly monitored, digital trust scores are dynamically recalculated, and access permissions are automatically adjusted based on current trust levels. This feedback mechanism reduces malicious activities by continuously adapting access control decisions while maintaining operational simplicity through automated real-time adjustments
Data Source
AI summary
Systems and methods for determining digital trust of a device and a user for access permission include monitoring a client device and its access to a network and to resources connected to the network; analyzing behavior-based factors and posture-based factors to determine a digital trust rating at a given time for the client device, wherein the posture-based factors include a rating of certificates associated with the client device and a rating of a Domain Name System (DNS) server associated with the client device; and providing the digital trust rating at the given time for the client device for use in access permission of the client device to the network and/or to the resources.