Method, system, and computer program product for security within a global computer network

• US 20040123157A1
• Filed: 12/11/2003
• Published: 06/24/2004
• Est. Priority Date: 12/13/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: WholeSecurity, Inc. (Gen Digital Inc.)
• Inventors: Alagna, Michael Anthony, Payne, Charles Andrew, Smith, Todd Allen, Loiodice, Luca
• Granted Patent: US 7,624,110 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2127 Bluffing
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

In a first embodiment, an information handling system determines whether a resource is likely misrepresented as a trusted resource within a global computer network. In a second embodiment, the information handling system outputs an indication of whether a resource within a global computer network is recognized as a known trusted resource.

Claims

1. A method performed by an information handling system, the method comprising:

determining whether a resource is likely misrepresented as a trusted resource within a global computer network.

2. The method of claim 1, wherein the resource is likely misrepresented by a content of a web page.

3. The method of claim 2, wherein the content is an information entry field embedded in the web page.

4. The method of claim 2, wherein the web page is a first web page, and wherein the content is an address of a second web page.

5. The method of claim 4, wherein the address is a hyperlink embedded in the first web page.

6. The method of claim 1, wherein the resource is likely misrepresented by a content of an electronic message.

7. The method of claim 6, wherein the content is an information entry field embedded in the electronic message.

8. The method of claim 6, wherein the content is an address of a web page.

9. The method of claim 8, wherein the address is a hyperlink embedded in the electronic message.

10. The method of claim 6, wherein the content is a source address of the electronic message.

11. The method of claim 1, wherein the resource is a web page.

12. The method of claim 11, wherein determining whether the resource is likely misrepresented as a trusted resource comprises:

analyzing an address of the web page.

13. The method of claim 12, wherein the analyzing comprises:

in response to determining that the address points to a known trusted web page, determining that the web page is not misrepresented as a trusted resource.

14. The method of claim 12, wherein the analyzing comprises:

in response to determining that the address points to a known mistrusted web page, determining that the web page is likely misrepresented as a trusted resource.

15. The method of claim 11, wherein determining whether the resource is likely misrepresented as a trusted resource comprises:

analyzing a content of the web page.

16. The method of claim 15, wherein the analyzing comprises:

in response to determining that the content includes a predetermined content, determining that the web page is likely misrepresented as a trusted resource.

17. The method of claim 16, wherein the predetermined content is a request for financial information.

18. The method of claim 17, wherein the financial information is information about a bank account.

19. The method of claim 17, wherein the financial information is information about a credit card account.

20. The method of claim 11, wherein determining whether the resource is likely misrepresented as a trusted resource comprises:

analyzing a layout of the web page.

21. The method of claim 20, wherein the analyzing comprises:

in response to determining that the layout is similar to a layout of a known mistrusted web page, determining that the web page is likely misrepresented as a trusted resource.

22. The method of claim 11, wherein determining whether the resource is likely misrepresented as a trusted resource comprises:

analyzing information associated with the web page.

23. The method of claim 22, wherein the web page is part of a website, and wherein analyzing the information comprises:

determining an age of the website.

24. The method of claim 22, wherein the web page is part of a website, and wherein analyzing the information comprises:

determining a size of the website.

25. The method of claim 22, wherein the web page is part of a website, and wherein analyzing the information comprises:

determining a number of hyperlinks to the website by a known trusted resource.

26. The method of claim 11, wherein determining whether the resource is likely misrepresented as a trusted resource comprises:

outputting a signal to a computing system that hosts the web page, and analyzing the computing system'"'"'s response thereto.

27. The method of claim 11, wherein determining whether the resource is likely misrepresented as a trusted resource comprises:

performing at least two of the following operations;

analyzing an address of the web page;

analyzing a content of the web page;

analyzing a layout of the web page;

analyzing information associated with the web page; and

outputting information to the web page and analyzing the web page'"'"'s response thereto; and

in response to the performed operations, determining a score indicative of whether the resource is likely misrepresented as a trusted resource.

28. The method of claim 27, wherein the performing comprises performing at least three of the operations.

29. The method of claim 27, wherein the performing comprises performing at least four of the operations.

30. The method of claim 27, wherein the performing comprises performing at least five of the operations.

31. A system, comprising:

an information handling system for determining whether a resource is likely misrepresented as a trusted resource within a global computer network.

32. The system of claim 31, wherein the resource is likely misrepresented by a content of a web page.

33. The system of claim 32, wherein the content is an information entry field embedded in the web page.

34. The system of claim 32, wherein the web page is a first web page, and wherein the content is an address of a second web page.

35. The system of claim 34, wherein the address is a hyperlink embedded in the first web page.

36. The system of claim 31, wherein the resource is likely misrepresented by a content of an electronic message.

37. The system of claim 36, wherein the content is an information entry field embedded in the electronic message.

38. The system of claim 36, wherein the content is an address of a web page.

39. The system of claim 38, wherein the address is a hyperlink embedded in the electronic message.

40. The system of claim 36, wherein the content is a source address of the electronic message.

41. The system of claim 31, wherein the resource is a web page.

42. The system of claim 41, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by at least:

analyzing an address of the web page.

43. The system of claim 42, wherein the information handling system is for analyzing an address of the web page by at least:

in response to determining that the address points to a known trusted web page, determining that the web page is not misrepresented as a trusted resource.

44. The system of claim 42, wherein the information handling system is for analyzing an address of the web page by at least:

in response to determining that the address points to a known mistrusted web page, determining that the web page is likely misrepresented as a trusted resource.

45. The system of claim 41, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by at least:

analyzing a content of the web page.

46. The system of claim 45, wherein the information handling system is for analyzing a content of the web page by at least:

in response to determining that the content includes a predetermined content, determining that the web page is likely misrepresented as a trusted resource.

47. The system of claim 46, wherein the predetermined content is a request for financial information.

48. The system of claim 47, wherein the financial information is information about a bank account.

49. The system of claim 47, wherein the financial information is information about a credit card account.

50. The system of claim 41, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by at least:

analyzing a layout of the web page.

51. The system of claim 50, wherein the information handling system is for analyzing a layout of the web page by at least:

in response to determining that the layout is similar to a layout of a known mistrusted web page, determining that the web page is likely misrepresented as a trusted resource.

52. The system of claim 41, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by at least:

analyzing information associated with the web page.

53. The system of claim 52, wherein the web page is part of a website, and wherein the information handling system is for analyzing information associated with the web page by at least:

determining an age of the website.

54. The system of claim 52, wherein the web page is part of a website, and wherein the information handling system is for analyzing information associated with the web page by at least:

determining a size of the website.

55. The system of claim 52, wherein the web page is part of a website, and wherein the information handling system is for analyzing information associated with the web page by at least:

determining a number of hyperlinks to the website by a known trusted resource.

56. The system of claim 41, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by at least:

outputting a signal to a computing system that hosts the web page, and analyzing the computing system'"'"'s response thereto.

57. The system of claim 41, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by at least:

performing at least two of the following operations;

analyzing an address of the web page;

analyzing a content of the web page;

analyzing a layout of the web page;

analyzing information associated with the web page; and

outputting information to the web page and analyzing the web page'"'"'s response thereto; and

in response to the performed operations, determining a score indicative of whether the resource is likely misrepresented as a trusted resource.

58. The system of claim 57, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by performing at least three of the operations.

59. The system of claim 57, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by performing at least four of the operations.

60. The system of claim 57, wherein the information handling system is for determining whether the resource is likely misrepresented as a trusted resource by performing at least five of the operations.

61. A computer program product, comprising:

a computer program processable by an information handling system for causing the information handling system to determine whether a resource is likely misrepresented as a trusted resource within a global computer network; and

apparatus from which the computer program product is accessible from the computer-readable medium.

62. The computer program product of claim 61, wherein the resource is likely misrepresented by a content of a web page.

63. The computer program product of claim 62, wherein the content is an information entry field embedded in the web page.

64. The computer program product of claim 62, wherein the web page is a first web page, and wherein the content is an address of a second web page.

65. The computer program product of claim 64, wherein the address is a hyperlink embedded in the first web page.

66. The computer program product of claim 61, wherein the resource is likely misrepresented by a content of an electronic message.

67. The computer program product of claim 66, wherein the content is an information entry field embedded in the electronic message.

68. The computer program product of claim 66, wherein the content is an address of a web page.

69. The computer program product of claim 68, wherein the address is a hyperlink embedded in the electronic message.

70. The computer program product of claim 66, wherein the content is a source address of the electronic message.

71. The computer program product of claim 61, wherein the resource is a web page.

72. The computer program product of claim 71, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by at least:

analyzing an address of the web page.

73. The computer program product of claim 72, wherein the computer program is processable by the information handling system for causing the information handling system to analyze an address of the web page by at least:

in response to determining that the address points to a known trusted web page, determining that the web page is not misrepresented as a trusted resource.

74. The computer program product of claim 72, wherein the computer program is processable by the information handling system for causing the information handling system to analyze an address of the web page by at least:

in response to determining that the address points to a known mistrusted web page, determining that the web page is likely misrepresented as a trusted resource.

75. The computer program product of claim 71, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by at least:

analyzing a content of the web page.

76. The computer program product of claim 75, wherein the computer program is processable by the information handling system for causing the information handling system to analyze a content of the web page by at least:

in response to determining that the content includes a predetermined content, determining that the web page is likely misrepresented as a trusted resource.

77. The computer program product of claim 76, wherein the predetermined content is a request for financial information.

78. The computer program product of claim 77, wherein the financial information is information about a bank account.

79. The computer program product of claim 77, wherein the financial information is information about a credit card account.

80. The computer program product of claim 71, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by at least:

analyzing a layout of the web page.

81. The computer program product of claim 80, wherein the computer program is processable by the information handling system for causing the information handling system to analyze a layout of the web page by at least:

in response to determining that the layout is similar to a layout of a known mistrusted web page, determining that the web page is likely misrepresented as a trusted resource.

82. The computer program product of claim 71, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by at least:

analyzing information associated with the web page.

83. The computer program product of claim 82, wherein the web page is part of a website, and wherein the computer program is processable by the information handling system for causing the information handling system to analyze information associated with the web page by at least:

determining an age of the website.

84. The computer program product of claim 82, wherein the web page is part of a website, and wherein the computer program is processable by the information handling system for causing the information handling system to analyze information associated with the web page by at least:

determining a size of the website.

85. The computer program product of claim 82, wherein the web page is part of a website, and wherein the computer program is processable by the information handling system for causing the information handling system to analyze information associated with the web page by at least:

determining a number of hyperlinks to the website by a known trusted resource.

86. The computer program product of claim 71, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by at least:

outputting a signal to a computing system that hosts the web page, and analyzing the computing system'"'"'s response thereto.

87. The computer program product of claim 71, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by at least:

performing at least two of the following operations;

analyzing an address of the web page;

analyzing a content of the web page;

analyzing a layout of the web page;

analyzing information associated with the web page; and

outputting information to the web page and analyzing the web page'"'"'s response thereto; and

in response to the performed operations, determining a score indicative of whether the resource is likely misrepresented as a trusted resource.

88. The computer program product of claim 87, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by performing at least three of the operations.

89. The computer program product of claim 87, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by performing at least four of the operations.

90. The computer program product of claim 87, wherein the computer program is processable by the information handling system for causing the information handling system to determine whether the resource is likely misrepresented as a trusted resource by performing at least five of the operations.

91. A method performed by an information handling system (“

IHS”

), the method comprising;

outputting an indication of whether a resource within a global computer network is recognized as a known trusted resource.

92. The method of claim 91, wherein the outputting comprises:

outputting the indication of whether the resource is recognized as one of the following;

a known trusted resource and a known mistrusted resource.

93. The method of claim 91, wherein the outputting comprises:

in response to the resource being recognized as a known trusted resource, outputting the indication that the resource is recognized as a known trusted resource.

94. The method of claim 91, wherein the outputting comprises:

in response to the resource being recognized as a known mistrusted resource, outputting the indication that the resource is recognized as a known mistrusted resource.

95. The method of claim 91, wherein the outputting comprises:

in response to the resource being unrecognized, outputting the indication that the resource is unrecognized.

96. The method of claim 91, wherein the outputting comprises:

outputting audio signals through a speaker of the IHS.

97. The method of claim 91, wherein the outputting comprises:

displaying the indication.

98. The method of claim 97, wherein the displaying comprises:

displaying the indication in a screen displayed by a display device of the IHS.

99. The method of claim 98, wherein the displaying comprises:

displaying the indication in a web browser window of the screen.

100. The method of claim 99, wherein the displaying comprises:

displaying the indication in a toolbar of the web browser window.

101. The method of claim 98, wherein the displaying comprises:

displaying the indication in a portion of the screen that is allocated to display information of an operating system.

102. The method of claim 101, wherein the displaying comprises:

displaying the indication in a system tray of the portion.

103. A system, comprising:

an information handling system (“

IHS”

) for outputting an indication of whether a resource within a global computer network is recognized as a known trusted resource.

104. The system of claim 103, wherein the IHS is for outputting the indication by outputting the indication of whether the resource is recognized as one of the following:

a known trusted resource and a known mistrusted resource.

105. The system of claim 103, wherein the IHS is for outputting the indication by:

in response to the resource being recognized as a known trusted resource, outputting the indication that the resource is recognized as a known trusted resource.

106. The system of claim 103, wherein the IHS is for outputting the indication by:

in response to the resource being recognized as a known mistrusted resource, outputting the indication that the resource is recognized as a known mistrusted resource.

107. The system of claim 103, wherein the IHS is for outputting the indication by:

in response to the resource being unrecognized, outputting the indication that the resource is unrecognized.

108. The system of claim 103, wherein the IHS is for outputting the indication by outputting audio signals through a speaker of the IHS.

109. The system of claim 103, wherein the IHS is for outputting the indication by displaying the indication.

110. The system of claim 109, wherein the IHS is for displaying the indication by displaying the indication in a screen displayed by a display device of the IHS.

111. The system of claim 110, wherein the IHS is for displaying the indication by displaying the indication in a web browser window of the screen.

112. The system of claim 111, wherein the IHS is for displaying the indication by displaying the indication in a toolbar of the web browser window.

113. The system of claim 110, wherein the IHS is for displaying the indication by displaying the indication in a portion of the screen that is allocated to display information of an operating system.

114. The system of claim 113, wherein the IHS is for displaying the indication by displaying the indication in a system tray of the portion.

115. A computer program product, comprising:

a computer program processable by an information handling system (“

IHS”

) for causing the IHS to output an indication of whether a resource within a global computer network is recognized as a known trusted resource; and

apparatus from which the computer program product is accessible from the computer-readable medium.

116. The computer program product of claim 115, wherein the computer program product is processable by the IHS for causing the IHS to output the indication by outputting the indication of whether the resource is recognized as one of the following:

a known trusted resource and a known mistrusted resource.

117. The computer program product of claim 115, wherein the computer program product is processable by the IHS for causing the IHS to output the indication by:

in response to the resource being recognized as a known trusted resource, outputting the indication that the resource is recognized as a known trusted resource.

118. The computer program product of claim 115, wherein the computer program product is processable by the IHS for causing the IHS to output the indication by:

in response to the resource being recognized as a known mistrusted resource, outputting the indication that the resource is recognized as a known mistrusted resource.

119. The computer program product of claim 115, wherein the computer program product is processable by the IHS for causing the IHS to output the indication by:

in response to the resource being unrecognized, outputting the indication that the resource is unrecognized.

120. The computer program product of claim 115, wherein the computer program product is processable by the IHS for causing the IHS to output the indication by outputting audio signals through a speaker of the IHS.

121. The computer program product of claim 115, wherein the computer program product is processable by the IHS for causing the IHS to output the indication by displaying the indication.

122. The computer program product of claim 121, wherein the computer program product is processable by the IHS for causing the IHS to display the indication by displaying the indication in a screen displayed by a display device of the IHS.

123. The computer program product of claim 122, wherein the computer program product is processable by the IHS for causing the IHS to display the indication by displaying the indication in a web browser window of the screen.

124. The computer program product of claim 123, wherein the computer program product is processable by the IHS for causing the IHS to display the indication by displaying the indication in a toolbar of the web browser window.

125. The computer program product of claim 122, wherein the computer program product is processable by the IHS for causing the IHS to display the indication by displaying the indication in a portion of the screen that is allocated to display information of an operating system.

126. The computer program product of claim 125, wherein the computer program product is processable by the IHS for causing the IHS to display the indication by displaying the indication in a system tray of the portion.