Method for integrity protection in a computer network

A method of protecting integrity of data in a computer network, the method comprising:

• generating and sharing an initial value of an integrity token, T0, between an endpoint node and a security backend computer;
• receiving, by the security backend computer, one or more input events collected by the endpoint node and a new integrity token, Ti+1, related to the one or more input events, wherein the new integrity token, Ti+1, is generated every time a new input event, Ei+1, is written to a local repository of the endpoint node and wherein the new integrity token, Ti+1, is generated based on any new input event, Ei+1, and a prior integrity token, Ti, that was generated prior to the new integrity token, Ti+1;
• and
• checking integrity of the received data on the basis of a previously received integrity token related to the endpoint node, the received new integrity token, Ti+1 and the received one or more input events.

An endpoint node of a computer network, comprising:

• one or more processors configured to:
• generate and share an initial value of an integrity token, T0, between an endpoint node and the security backend computer;
• collect data at the endpoint node, wherein dissimilar data types are aligned as input events;
• generate a new integrity token, Ti+1, every time a new input event, Ei+1, is written to a local repository of the endpoint node, wherein the new integrity token, Ti+1, is generated based on the new input event, Ei+1, and a prior integrity token, Ti, that was generated prior to the new integrity token, Ti+1;
• remove the prior integrity token, Ti, generated prior to the new integrity token, Ti+1 from the endpoint node each time the new integrity token, Ti+1, has been generated;
• and
• send one or more input events with the new integrity token, Ti+1, to the security backend computer for enabling the security backend computer checking integrity of the data received from the endpoint.

A security backend computer of a computer network, comprising:

• one or more processors configured to:
• generate and share an initial value of an integrity token, T0, between an endpoint node and the security backend computer;
• receive, by the security backend computer, one or more input events collected by the endpoint node and a new integrity token, Ti+1, related to the one or more input events, wherein the new integrity token, Ti+1, is generated every time a new input event, Ei+1, is written to a local repository of the endpoint node and wherein the new integrity token, Ti+1, is generated based on any new input event, Ei+1, and a prior integrity token, Ti, that was generated prior to the new integrity token, Ti+1;
• and
• check integrity of received data on the basis of a previously received integrity token related to the endpoint node, the received new integrity token, Ti+1 and the received one or more input events.