Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Particular communication authentication technique
Reexamination Certificate
1999-04-22
2002-02-26
Hayes, Gail (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Particular communication authentication technique
C713S152000
Reexamination Certificate
active
06351811
ABSTRACT:
TECHNICAL FIELD OF THE INVENTION
The present invention is directed, in general, to computer networks and, more specifically, to systems and methods for preventing transmission of compromised data in a computer network.
BACKGROUND OF THE INVENTION
The world is currently experiencing revolutionary changes in information systems, brought about, in part, by the general availability of access to the World Wide Web (“Web”) via the Internet. As the Web grows in popularity, more and more organizations and individuals see it as an efficient, inexpensive means of distributing information, products and services. While the Web is an attractive distribution channel for this new generation of on-line services, those wishing to take advantage of the Web's presence must ensure security concerns are addressed. Organizations that wish to use the Internet to share information with employees, partners and clients must implement security that prevents electronic fraud such as data tampering, eavesdropping and masquerading.
The Computer Security Institute (CSI), among many other security-related private and governmental organizations, has conducted annual surveys in an effort to help raise the level of security awareness as well as determine the scope of computer crime in the United States and abroad. The CSI's “1999 Computer Crime and Security Survey” noted, in particular, that corporations, financial institutions and government agencies face threats from both external and internal access to their information systems. In that survey, 30% of respondents reported intrusions, and those reporting their Internet connection as a frequent point of attack rose from 37% of respondents in 1996 to 57% in 1999. It has also been reported that financial losses due to computer security breaches exceed $100,000,000 per year.
Although these survey results indicate a wide range of computer security breaches, perhaps the most disturbing trend is the continued increase in attacks from unauthorized external access. Of the respondents who reported unauthorized access or misuse, 38% reported from two to five incidents, and 26% reported 10 or more incidents. Several types of attack were specified in the CSI survey: 98% of respondents reported vandalism, 93% reported denial of service, 27% reported financial fraud, and 25% reported theft of transaction information. It is clear that computer crime and other information security breaches pose a growing threat to U.S. economic competitiveness and the rule of law in cyberspace. It is also clear that the financial cost is tangible and alarming.
The FBI, in response to an expanding number of instances in which criminals have targeted major components of information and economic infrastructure systems, has established National Infrastructure Protection and Computer Intrusion Squads in selected offices throughout the United States. The mission of these squads is to investigate violations of the Computer Fraud and Abuse Act of 1986, including intrusions to public switched networks, major computer network intrusions, privacy violations, industrial espionage, pirated computer software and other crimes where the computer is a major factor in committing the criminal offense. The seriousness of this mission was recently reinforced by the creation of the National Infrastructure Protection Center, located at FBI headquarters. Recognizing this country's unprecedented reliance on information technology, the Center, which is a joint partnership among federal agencies and private industry, is designed to serve as the government's lead mechanism for preventing and responding to cyber attacks on the nation's infrastructures.
Conventional methods of providing information system security include the use of “firewalls.” A firewall is a system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria. Although a firewall can provide a certain level of protection, they are only considered a first line of defense in protecting private information. For greater security, data can be “encrypted,” which refers to techniques for ensuring that data stored in a computer cannot be read or compromised. Most conventional security measures involve data encryption and passwords. Data encryption is the translation of data into a form that is unintelligible without a deciphering mechanism. A password is a secret word or phrase that gives a user access to a particular program or system.
Although the use of firewalls and encryption techniques can provide some security, the fact that unauthorized persons continue to gain access to information systems illustrates that such security measures do not guarantee that data stored in such systems cannot be compromised. Thus, persons who access such data have no assurance of its accuracy, which could cause financial or other harm to such persons. For example, if publicly-available financial information for a company is compromised, a person who makes an investment decision based on the compromised information could risk losing the value of their investment. More seriously, compromised medical information could cause injury to a person's health. Therefore, there is a need in the art for systems and methods for preventing transmission of compromised data in a computer network. Preferably, such systems and methods should provide security that works seamlessly across applications and platforms such that it is transparent to users and easy for organizations to manage.
SUMMARY OF THE INVENTION
To address the above-discussed deficiencies of the prior art, the present invention provides systems and methods for controlling the transmission of data in a computer network; specifically, systems and methods related to preventing the transmission of compromised data. In one embodiment, a web server is configured to transmit requested data to a remote client through a computer network, such as the Internet. The web server includes a conventional computing system, including a processor and random access memory, and a non-volatile storage medium for storing the requested data. A software-defined process is executed by the computing system, whereby the software-defined process and the computing system cooperate to: i) receive a request from a remote client for the requested data; ii) determine whether the requested data has been compromised; and iii) prevent the transmission of the requested data to the remote client if the data is compromised. The principles of the present invention represent a shift in the approach to conventional network security. The present invention recognizes that, in many cases, the greatest harm resulting from compromised data stems not from the fact that some person has gained unauthorized access to and altered the data, but that some other person may unknowingly rely on the compromised data.
Various techniques are disclosed for determining whether the requested data has been compromised, such as through comparison of a digital signature associated with the requested data to a control signature. A control signature can be unique to the requested data or predefined for all data. Alternatively, or in addition to a comparison of signatures, the requested data may be directly compared to a secure copy of the requested data, or various file attributes such as file timestamp and size can be compared.
In one embodiment, the determination of whether data has been compromised is accomplished by computing a digital signature for the data, and comparing the digital signature to a control signature; the data is identified as compromised if the digital signature is not identical to the control signature. A control signature can be unique to
Groshon Robert F.
Philipp L. Aaron
Stone Jason C.
Adapt Network Security, L.L.C.
Burleigh Roger S.
Burleigh & Associates
DiLorenzo Anthony
Hayes Gail
LandOfFree
Systems and methods for preventing transmission of... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Systems and methods for preventing transmission of..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Systems and methods for preventing transmission of... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2977842