Method, system and computer program product for security in a global computer network transaction

• US 20040187023A1
• Filed: 01/30/2004
• Published: 09/23/2004
• Est. Priority Date: 08/30/2002
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: WholeSecurity, Inc. (Gen Digital Inc.)
• Inventors: Alagna, Michael Anthony, Payne, Charles Andrew, Obrecht, Mark Eric, Norwood, Peter
• Granted Patent: US 7,509,679 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

From a first information handling system (“IHS”) to a second IHS, in response to a request for initiating an online transaction, a program is downloaded for detecting malicious code on the second IHS.

Claims

1. A method performed by a first information handling system (“

IHS”

), the method comprising;

from the first IHS to a second IHS, in response to a request for initiating an online transaction, downloading a program for detecting malicious code on the second IHS.

2. The method of claim 1, and comprising:

initiating execution of the program for detecting malicious code on the second IHS.

3. The method of claim 1, wherein the request is made by accessing a web page of the first IHS.

4. The method of claim 1, wherein the program is a web browser plug-in for detecting malicious code on the second IHS.

5. The method of claim 4, and comprising:

initiating caching of the plug-in for detecting malicious code on the second IHS.

6. The method of claim 1, wherein the program is for:

in response to detecting malicious code on the second IHS, receiving an indication of whether to mitigate the malicious code that is detected, the indication being received from a user that operates the second IHS.

7. The method of claim 6, wherein the program is for:

in response to the indication being non-mitigation, saving the indication for a subsequent operation of the program for detecting malicious code.

8. The method of claim 1, wherein the program is for:

in response to detecting malicious code on the second IHS, performing at least one action for mitigating the malicious code that is detected.

9. The method of claim 8, wherein the action is at least one of the following:

disabling the malicious code that is detected; and

quarantining the malicious code that is detected.

10. The method of claim 8, wherein the program is for storing a record of performing the action.

11. The method of claim 1, wherein the program is for:

on a display device, initiating display of an icon associated with the program.

12. The method of claim 1, wherein the program is for:

in response to detecting malicious code on the second IHS, performing at least one action for mitigating the malicious code that is detected, the action being selected by a user that operates the second IHS.

13. The method of claim 12, wherein the action is at least one of the following:

disabling the malicious code that is detected; and

quarantining the malicious code that is detected.

14. The method of claim 13, wherein the program is for:

in response to a command from the user, reversing the performed action.

15. The method of claim 1, wherein the program is for detecting malicious code in the form of a trojan horse.

16. The method of claim 15, wherein the program is for detecting malicious code in the form of a trojan horse by:

examining code under investigation on the second IHS;

associating weights to respective code under investigation in response to detections of a valid code or malicious code; and

determining a score in response to the weights.

17. The method of claim 1, wherein the program is for detecting malicious code during a session of the online transaction.

18. The method of claim 17, wherein the program is for repeatedly attempting to detect malicious code during the session.

19. The method of claim 17, wherein the session includes an authentication by the first IHS of a user that operates the second IHS.

20. The method of claim 19, wherein the program is for detecting malicious code in response to the second IHS accessing a web page of the first IHS, before the authentication.

21. The method of claim 19, wherein the program is for detecting malicious code during the authentication.

22. The method of claim 19, wherein the program is for detecting malicious code after the authentication.

23. The method of claim 1, wherein the online transaction is a financial transaction.

24. The method of claim 23, wherein the financial transaction includes an inquiry about an account balance.

25. The method of claim 23, wherein the financial transaction includes an inquiry about an account transaction history.

26. The method of claim 23, and comprising:

in response to execution of the program, performing the financial transaction.

27. A first information handling system (“

IHS”

), comprising;

a computer system for;

from the first IHS to a second IHS, in response to a request for initiating an online transaction, downloading a program for detecting malicious code on the second IHS.

28. The first IHS of claim 27, wherein the computer system is for:

initiating execution of the program for detecting malicious code on the second IHS.

29. The first IHS of claim 27, wherein the request is made by accessing a web page of the first IHS.

30. The first IHS of claim 27, wherein the program is a web browser plug-in for detecting malicious code on the second IHS.

31. The first IHS of claim 30, wherein the computer system is for:

initiating caching of the plug-in for detecting malicious code on the second IHS.

32. The first IHS of claim 27, wherein the program is for:

in response to detecting malicious code on the second IHS, receiving an indication of whether to mitigate the malicious code that is detected, the indication being received from a user that operates the second IHS.

33. The first IHS of claim 32, wherein program is for:

in response to the indication being non-mitigation, saving the indication for a subsequent operation of the program for detecting malicious code.

34. The first IHS of claim 27, wherein the program is for:

in response to detecting malicious code on the second IHS, performing at least one action for mitigating the malicious code that is detected.

35. The first IHS of claim 34, wherein the action is at least one of the following:

disabling the malicious code that is detected; and

quarantining the malicious code that is detected.

36. The first IHS of claim 34, wherein the program is for storing a record of performing the action.

37. The first IHS of claim 27, wherein the program is for:

on a display device, initiating display of an icon associated with the program.

38. The first IHS of claim 27, wherein the program is for:

in response to detecting malicious code on the second IHS, performing at least one action for mitigating the malicious code that is detected, the action being selected by a user that operates the second IHS.

39. The first IHS of claim 38, wherein the action is at least one of the following:

disabling the malicious code that is detected; and

quarantining the malicious code that is detected.

40. The first IHS of claim 39, wherein the program is for:

in response to a command from the user, reversing the performed action.

41. The first IHS of claim 27, wherein the program is for detecting malicious code in the form of a trojan horse.

42. The first IHS of claim 41, wherein the program is for detecting malicious code in the form of a trojan horse by:

examining code under investigation on the second IHS;

associating weights to respective code under investigation in response to detections of a valid code or malicious code; and

determining a score in response to the weights.

43. The first IHS of claim 27, wherein the program is for detecting malicious code during a session of the online transaction.

44. The first IHS of claim 43, wherein the program is for repeatedly attempting to detect malicious code during the session.

45. The first IHS of claim 43, wherein the session includes an authentication by the first IHS of a user that operates the second IHS.

46. The first IHS of claim 45, wherein the program is for detecting malicious code in response to the second IHS accessing a web page of the first IHS, before the authentication.

47. The first IHS of claim 45, wherein the program is for detecting malicious code during the authentication.

48. The first IHS of claim 45, wherein the program is for detecting malicious code after the authentication.

49. The first IHS of claim 27, wherein the online transaction is a financial transaction.

50. The first IHS of claim 49, wherein the financial transaction includes an inquiry about an account balance.

51. The first IHS of claim 49, wherein the financial transaction includes an inquiry about an account transaction history.

52. The first IHS of claim 49, wherein the computer system is for:

in response to execution of the program, performing the financial transaction.

53. A computer program product, comprising:

a first computer program processable by a first information handling system (“

IHS”

) for causing the first IHS to;

from the first IHS to a second IHS, in response to a request for initiating an online transaction, download a second computer program for detecting malicious code on the second IHS; and

apparatus from which the first computer program is accessible by the first IHS.

54. The computer program product of claim 53, wherein the first computer program is processable by the first IHS for causing the first IHS to initiate execution of the second computer program for detecting malicious code on the second IHS.

55. The computer program product of claim 53, wherein the request is made by accessing a web page of the first IHS.

56. The computer program product of claim 53, wherein the second computer program is a web browser plug-in for detecting malicious code on the second IHS.

57. The computer program product of claim 56, wherein the first computer program is processable by the first IHS for causing the first IHS to:

initiate caching of the plug-in for detecting malicious code on the second IHS.

58. The computer program product of claim 53, wherein the program is for:

in response to detecting malicious code on the second IHS, receiving an indication of whether to mitigate the malicious code that is detected, the indication being received from a user that operates the second IHS.

59. The computer program product of claim 58, wherein the program is for:

in response to the indication being non-mitigation, saving the indication for a subsequent operation of the program for detecting malicious code.

60. The computer program product of claim 53, wherein the second computer program is for:

in response to detecting malicious code on the second IHS, performing at least one action for mitigating the malicious code that is detected.

61. The computer program product of claim 60, wherein the action is at least one of the following:

disabling the malicious code that is detected; and

quarantining the malicious code that is detected.

62. The computer program product of claim 60, wherein the second computer program is for storing a record of performing the action.

63. The computer program product of claim 53, wherein the second computer program is for:

on a display device, initiating display of an icon associated with the second computer program.

64. The computer program product of claim 53, wherein the second computer program is for:

in response to detecting malicious code on the second IHS, performing at least one action for mitigating the malicious code that is detected, the action being selected by a user that operates the second IHS.

65. The computer program product of claim 64, wherein the action is at least one of the following:

disabling the malicious code that is detected; and

quarantining the malicious code that is detected.

66. The computer program product of claim 65, wherein:

in response to a command from the user, reversing the performed action.

67. The computer program product of claim 53, wherein the second computer program is for detecting malicious code in the form of a trojan horse.

68. The computer program product of claim 67, wherein the second computer program is for detecting malicious code in the form of a trojan horse by:

examining code under investigation on the second IHS;

associating weights to respective code under investigation in response to detections of a valid code or malicious code; and

determining a score in response to the weights.

69. The computer program product of claim 53, wherein the second computer program is for detecting malicious code during a session of the online transaction.

70. The computer program product of claim 69, wherein the second computer program is for repeatedly attempting to detect malicious code during the session.

71. The computer program product of claim 69, wherein the session includes an authentication by the first IHS of a user that operates the second IHS.

72. The computer program product of claim 71, wherein the second computer program is for detecting malicious code in response to the second IHS accessing a web page of the first IHS, before the authentication.

73. The computer program product of claim 71, wherein the second computer program is for detecting malicious code during the authentication.

74. The computer program product of claim 71, wherein the second computer program is for detecting malicious code after the authentication.

75. The computer program product of claim 53, wherein the online transaction is a financial transaction.

76. The computer program product of claim 75, wherein the financial transaction includes an inquiry about an account balance.

77. The computer program product of claim 75, wherein the financial transaction includes an inquiry about an account transaction history.

78. The computer program product of claim 75, wherein the first computer program is processable by the first IHS for causing the first IHS to:

in response to execution of the program, perform the financial transaction.