Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
2000-07-26
2003-04-22
Wright, Norman M. (Department: 2134)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S152000, C709S203000, C709S241000
Reexamination Certificate
active
06553498
ABSTRACT:
FIELD OF THE INVENTION
The present invention relates to the security management of computer networks. More particularly, the invention relates to methods and systems for preventing the downloading and execution of undesirable Executable Objects in a workstation of a computer network.
BACKGROUND OF THE INVENTION
The Internet has developed very much both in respect of its contents and of the technology employed, since it began a few years ago. In the early days of the Internet, web sites included text only, and after a while graphics was introduced. As the Internet developed, many compressed standards, such as pictures, voice and video files, were developed and with them programs used to play them (called “players”). Initially, such files were downloaded to the user's workstation only upon his request, and extracted only by the appropriate player, and after a specific order from the user.
When, in the natural course of the development of the World Wide Web the search for a way to show nicer, interactive and animated Web Pages began, Sun Microsystems Inc. developed Java—a language that allows the webmaster to write a program, a list of commands—Network Executables—that will be downloaded to the user workstation without his knowledge, and executed by his browser at his workstation. The executables are used, e.g., to provide photographic animation and other graphics on the screen of the web surfer. Such executables have ways of approaching the user workstation's resources, which lead to a great security problem. Although some levels of security were defined in the Java language, it was very soon that a huge security hole was found in the language.
Since Java was developed, Microsoft developed ActiveX, which is another Network Executable format, also downloaded into the workstation. ActiveX has also security problems of the same kind.
The Internet has been flooded with “Network Executables” which may be downloaded—deliberately or without the knowledge of the users—into workstations within organizations. These codes generally contain harmless functions. Although usually safe, they may not meet the required security policy of the organization.
Once executed, codes may jam the network, cause considerable irreversible damage to the local database, workstations and servers, or result in unauthorized retrieval of information from the servers/workstations. Such elements may appear on Java applets, ActiveX components, DLLs and other object codes, and their use is increasing at an unparalleled pace. The majority of these small programs are downloaded into the organization unsolicited and uncontrolled. The enterprise has no way of knowing about their existence or execution and there is no system in place for early detection and prevention of the codes from being executed.
The security problem was solved partially by the browser manufactures which allow the user to disable the use of executables. Of course this is not a reasonable solution, since all the electronic commerce and advertising are based on the use of executables. The security problem is much more serious once such an executable can approach the enterprise servers, databases and other workstations. However, so far the art has failed to provide comprehensive solutions which are safe and quick enough to be practically useful. Systems such as “Firewall” or “Finjan”, distributed for use by Internet users, provide only partial solutions and, furthermore, are difficult to install and to update.
In two copending patent applications of the same applicants hereof, IL 120420, filed Mar. 10, 1997, and IL 121815, filed Sep. 22, 1997, the descriptions of which are incorporated herein by reference, there are described methods and means for preventing undesirable Executable Objects from infiltrating the LAN/WAN in which we work and, ultimately, our workstation and server. However, while the systems described in the aforementioned two Israeli patent applications are safe and convenient to use, they present a drawback when very large organizations are concerned, inasmuch as they require that each individual user (or workstation) be controlled to ensure that it operates according to the desired security policy or, in other words, that he has installed in the workstation appropriate security data, or they require that control of the security policy be carried out centrally at the gateway level, rather than at the workstation level. Thus, in large organizations where new users are constantly added, policing the maintenance of the security policy requires constant management efforts, if the security agent is to be installed on the individual workstations. As will be appreciated, installing the security agent on the individual workstation provides many advantages, particularly where speed of operation and cost of central equipment is concerned, and where a centralized security enforcement is needed.
SUMMARY OF THE INVENTION
It is an object of the present invention to provide a method and means for enforcing the security policy of an organization on each and every member of the organization, thereby selectively preventing the downloading and execution of undesired Executable Objects in a computer, which obviates the need for the continuous central management and monitoring of the activities of the individuals within the organization, and which permits to effect a part of the security policy enforcement process on the individual workstations of the organization.
It is another object of the invention to provide such a system which is easy to install and which can be quickly and easily updated.
It is a further object of the invention to provide such a method which can be used with a large number of gateways, LAN's and workstations.
It is yet another object of the invention to provide such a security management system which is independent of the physical infrastructure and network layout.
Also encompassed by the invention is a computer system which utilizes the method of the invention.
The invention is directed to a method for enforcing a security policy for selectively preventing the downloading and execution of undesired Executable Objects in an individual workstation, comprising the steps of:
(1) providing a security agent suitable to be installed in an individual workstation, said security agent being provided with means for introducing at least one marker in one or more data packet transmitted by a workstation to a server through a gateway, said at least one marker indicating that a security agent is installed in the transmitting workstation;
(2) providing means in or coupled to the gateway for analyzing the first one or more data packet(s) received from a transmitting workstation initiating communication to a remote server, to determine whether said first one or more data packet(s) comprise at least one marker indicating that a suitable security agent is installed in the transmitting workstation;
(3) If at least one marker indicating that a suitable security agent is installed in the transmitting workstation is detected in said first one or more data packet(s), deleting said marker(s) from said first one or more data packet(s), and allowing said data packet(s) to be transmitted to their destination; and
(4) If no marker indicating that a suitable security agent is installed in the transmitting workstation is detected in said first one or more data packet(s), preventing any data packet(s) received from the server to which the workstation is connected from being transmitted to the workstation.
Details of the security policies, their distribution to various gateways within the organization, and the analysis of received data, are described in detail in said copending Israeli patent applications of the same applicant herein, the description of which is incorporated herein by reference, and are therefore not discussed herein in detail, for the sake of brevity.
According to a preferred embodiment of the invention, the method further comprises the step of obliging the workstation which has transmitted data packet(s) which do not contain a marke
Elgressy Doron
Jospe Asher
Computer Associates Think Inc.
Wright Norman M.
LandOfFree
Method and system for enforcing a communication security policy does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and system for enforcing a communication security policy, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and system for enforcing a communication security policy will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3056721