Method of communications and communication network intrusion protection methods and intrusion attempt detection system

• US 20050172155A1
• Filed: 03/31/2005
• Published: 08/04/2005
• Est. Priority Date: 05/17/1999
• Status: Active Grant

• Current Assignee: Invicta Networks, Inc.
• Original Assignee: Invicta Networks, Inc.
• Inventors: Sheymov, Victor I.
• Granted Patent: US 7,506,166 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A method, system and computer readable medium for protecting a communications device connected to a communications system against an unauthorized intrusion, including providing a variable identifier to the communications device and entities authorized access thereto. The variable identifier is provided to a user address book and assigned with a permanent identifier and the permanent identifier, but not the variable identifier, is available to a user. The presence or absence of the correct variable identifier is sensed during an attempt to access the communications device for granting or denying access to the communications device. A new variable identifier is periodically provided to the communications device and to the authorized entities and to the user address book and assigned with the permanent identifier, wherein the permanent identifier, but not the new variable identifier, is available to the user.

Claims

1-25. -25. (canceled)

26. A method for protecting a communications device, which is connected to a communications system, against an unauthorized intrusion, said method comprising:

providing the communications device with at least one variable identifier;

providing the at least one variable identifier for use in accessing the communications device to entities authorized to access said communications device, said variable identifier being provided to a user address book and assigned with a permanent identifier, wherein said permanent identifier is available to a user, but not said variable identifier;

sensing the presence or absence of said variable identifier before granting access to said communications device;

providing access to said communications device when the use of said at least one correct variable identifier is sensed, and denying access to said communications device when the absence of the correct at least one variable identifier is sensed during an attempt to access said communications device; and

providing said communications device with at least one new variable identifier periodically and providing said at least one new variable identifier to entities authorized to access said communications device, said new variable identifier being provided to said user address book and assigned with said permanent identifier, wherein said permanent identifier is available to the user, but not said new variable identifier.

27. The method of claim 26, further comprising:

providing said communications device with a plurality of separate variable identifiers;

sensing the presence or absence of all of said plurality of variable identifiers before granting access to said communications device;

providing access to said communications device when the use of all of said identifiers is sensed; and

denying access to said communications device and providing said communications device with a new plurality of variable identifiers to replace the previous plurality of variable identifiers when the absence of any one of the correct identifiers is sensed.

28. The method of claim 27, further comprising periodically changing said plurality of separate variable identifiers and providing the changed variable identifiers to the entities authorized to access said communications device.

29. The method of claim 26, further comprising:

providing said communications device with at least one new variable identifier; and

providing said at least one new variable identifier to entities authorized to access said communications device when the absence of the correct at least one variable identifier is sensed during an attempt to access said communications device.

30. The method of claim 26, further comprising:

permitting a predetermined number of attempts to access said communications device with a correct at least one variable identifier after the absence of the correct at least one variable identifier is sensed before providing said communications device with at least one new variable identifier; and

providing access to said communications device if the correct at least one variable identifier is sensed during the predetermined number of attempts to access.

31. The method of claim 26, wherein said communications system is a telephone system and said communications device is a telephone.

32. The method of claim 26, wherein said communications system is a computer network with said entities authorized to access said communications device being authorized computers having access to said computer network, and said communications device including at least one host computer having access to said computer network.

33. The method of claim 32, further comprising providing the authorized computers with an unchangeable, accessible address for the host computer as permanent identifier which is used by the authorized computer to activate and transmit the at least one variable identifier for the host computer when the authorized computer initiates access to the host computer.

34. The method of claim 32, further comprising:

providing each authorized computer with an authorized computer identifier;

providing the host computer with a destination identifier;

causing each authorized computer to access said host computer with at least a host computer destination identifier and the authorized computer identifier;

sensing the presence or absence of both said host computer destination identifier and an authorized computer identifier before granting access to said host computer;

providing access to said host computer when the use of both a correct host computer destination identifier and an authorized computer identifier is sensed; and

denying access to said host computer and providing said host computer with a new host computer destination identifier when the absence of either a correct host computer destination identifier or a correct authorized computer identifier is sensed.

35. The method of claim 34, further comprising:

permitting a predetermined number of attempts to access said host computer with both a correct host computer destination identifier and an authorized computer identifier after the absence of a correct host computer destination identifier or an authorized computer identifier is sensed before providing said host computer with a new host computer destination identifier;

providing access to said host computer if correct host computer destination and authorized computer identifier are sensed during the predetermined number of attempts to access the host computer; and

storing said host computer destination identifier as an inaccessible identifier in said authorized computers, and providing said authorized computers with an unchangeable, accessible host computer address, which will activate and transmit the host computer destination identifier when an authorized computer initiates access to the host computer.

36. The method of claim 32, further comprising:

providing said host computer with a host computer destination identifier and a host computer port identifier;

causing each authorized computer to access said host computer with at least the host computer destination identifier and the host computer port identifier;

sensing the presence or absence of both said host computer destination identifier and said host computer port identifier before granting access to said host computer;

providing access to said host computer when the use of both a correct host computer destination identifier and a correct host computer port identifier are sensed; and

denying access to said host computer and providing said host computer with a new destination identifier and port identifier when the absence of either or both of a correct host computer destination or port identifier is sensed.

37. The method of claim 36, further comprising:

permitting a predetermined number of attempts to access said host computer with both a correct host computer destination and port identifier when either or both an incorrect host computer destination or port identifier is sensed before providing said host computer with a new destination and port identifier;

providing access to said host computer if both correct host computer destination and port identifiers are sensed during the predetermined number of attempts to access said host computer; and

storing said host computer destination and port identifiers as inaccessible identifiers in said authorized computers and providing said authorized computers with an unchangeable, accessible host computer address which will activate and transmit the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

38. The method of claim 26, wherein a host computer is connected to said computer communications system, which includes one or more authorized computers, as entities having access to said computer communications system, which are authorized to access said host computer, and the method further comprises:

providing each authorized computer with an authorized computer identifying address;

providing said host computer with a host computer destination identifier and a host computer port identifier as variable identifiers;

providing said host computer destination identifier and said host computer port identifier to said authorized computers;

causing each authorized computer to access said host computer with the host computer destination and port identifiers and said authorized computer identifying address;

sensing the presence or absence of said host computer destination and port identifiers and said authorized computer identifying address before granting access to said host computer;

providing access to said host computer when the use of correct computer destination and port identifiers and a correct authorized computer identifying address is sensed; and

denying immediate access to said host computer when the absence of any one or more of the correct host computer destination and port identifiers or the authorized computer identifying address is sensed.

39. The method of claim 38, further comprising:

periodically changing the host computer destination and port identifiers and providing these changes to the authorized computers;

storing said host computer destination and port identifiers as inaccessible variable identifiers in said authorized computer; and

providing said authorized computers with an unchangeable, accessible host computer address as permanent identifier which will activate and transmit the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

40. The method of claim 38, further comprising:

permitting a predetermined number of attempts to access said host computer with correct host computer destination and port identifiers and a correct authorized computer identifying address after the absence of at least a correct one of said identifiers and authorized computer identifying address is sensed by the host computer; and

providing access to said host computer if correct host computer destination and port identifiers and a correct authorized computer identifying address are sensed during the predetermined number of attempts to access said host computer.

41. The method of claim 38, further comprising:

changing the host computer destination and port identifiers when access is denied to said host computer after at least one access attempt has been made and providing these changed identifiers to the authorized computers;

storing said host computer destination and port identifiers as inaccessible variable identifiers in said authorized computer; and

providing said authorized computers with an unchangeable, accessible host computer address as permanent identifier which will activate and cause transmission of the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

42. The method of claim 26, wherein said variable identifier is a cyber coordinate, consisting of statements determining location of an object, such as a computer, or a piece of information, such as a computer file, in cyber space.

45. A system for protecting a communications device, which is connected to a communications system, against an unauthorized intrusion, said system comprising:

means for providing the communications device with at least one variable identifier;

means for providing the at least one variable identifier for use in accessing the communications device to entities authorized to access said communications device, said variable identifier being provided to a user address book and assigned with a permanent identifier, wherein said permanent identifier is available to a user, but not said variable identifier;

means for sensing the presence or absence of said variable identifier before granting access to said communications device;

means for providing access to said communications device when the use of said at least one correct variable identifier is sensed, and denying access to said communications device when the absence of the correct at least one variable identifier is sensed during an attempt to access said communications device; and

means for providing said communications device with at least one new variable identifier periodically and providing said at least one new variable identifier to entities authorized to access said communications device, said new variable identifier being provided to said user address book and assigned with said permanent identifier, wherein said permanent identifier is available to the user, but not said new variable identifier.

46. The system of claim 45, further comprising:

means for providing said communications device with a plurality of separate variable identifiers;

means for sensing the presence or absence of all of said plurality of variable identifiers before granting access to said communications device;

means for providing access to said communications device when the use of all of said identifiers is sensed; and

means for denying access to said communications device and providing said communications device with a new plurality of variable identifiers to replace the previous plurality of variable identifiers when the absence of any one of the correct identifiers is sensed.

47. The system of claim 46, further comprising means for periodically changing said plurality of separate variable identifiers and providing the changed variable identifiers to the entities authorized to access said communications device.

48. The system of claim 45, further comprising:

means for providing said communications device with at least one new variable identifier; and

means for providing said at least one new variable identifier to entities authorized to access said communications device when the absence of the correct at least one variable identifier is sensed during an attempt to access said communications device.

49. The system of claim 45, further comprising:

means for permitting a predetermined number of attempts to access said communications device with a correct at least one variable identifier after the absence of the correct at least one variable identifier is sensed before providing said communications device with at least one new variable identifier; and

means for providing access to said communications device if the correct at least one variable identifier is sensed during the predetermined number of attempts to access.

50. The system of claim 45, wherein said communications system is a telephone system and said communications device is a telephone.

51. The system of claim 45, wherein said communications system is a computer network with said entities authorized to access said communications device being authorized computers having access to said computer network, and said communications device including at least one host computer having access to said computer network.

52. The system of claim 51, further comprising means for providing the authorized computers with an unchangeable, accessible address for the host computer as permanent identifier which is used by the authorized computer to activate and transmit the at least one variable identifier for the host computer when the authorized computer initiates access to the host computer.

53. The system of claim 51, further comprising:

means for providing each authorized computer with an authorized computer identifier;

means for providing the host computer with a destination identifier;

means for causing each authorized computer to access said host computer with at least a host computer destination identifier and the authorized computer identifier;

means for sensing the presence or absence of both said host computer destination identifier and an authorized computer identifier before granting access to said host computer;

means for providing access to said host computer when the use of both a correct host computer destination identifier and an authorized computer identifier is sensed; and

means for denying access to said host computer and providing said host computer with a new host computer destination identifier when the absence of either a correct host computer destination identifier or a correct authorized computer identifier is sensed.

54. The system of claim 53, further comprising:

means for permitting a predetermined number of attempts to access said host computer with both a correct host computer destination identifier and an authorized computer identifier after the absence of a correct host computer destination identifier or an authorized computer identifier is sensed before providing said host computer with a new host computer destination identifier;

means for providing access to said host computer if correct host computer destination and authorized computer identifier are sensed during the predetermined number of attempts to access the host computer; and

means for storing said host computer destination identifier as an inaccessible identifier in said authorized computers, and providing said authorized computers with an unchangeable, accessible host computer address, which will activate and transmit the host computer destination identifier when an authorized computer initiates access to the host computer.

55. The system of claim 51, further comprising:

means for providing said host computer with a host computer destination identifier and a host computer port identifier;

means for causing each authorized computer to access said host computer with at least the host computer destination identifier and the host computer port identifier;

means for sensing the presence or absence of both said host computer destination identifier and said host computer port identifier before granting access to said host computer;

means for providing access to said host computer when the use of both a correct host computer destination identifier and a correct host computer port identifier are sensed; and

means for denying access to said host computer and providing said host computer with a new destination identifier and port identifier when the absence of either or both of a correct host computer destination or port identifier is sensed.

56. The system of claim 55, further comprising:

means for permitting a predetermined number of attempts to access said host computer with both a correct host computer destination and port identifier when either or both an incorrect host computer destination or port identifier is sensed before providing said host computer with a new destination and port identifier;

means for providing access to said host computer if both correct host computer destination and port identifiers are sensed during the predetermined number of attempts to access said host computer; and

means for storing said host computer destination and port identifiers as inaccessible identifiers in said authorized computers and providing said authorized computers with an unchangeable, accessible host computer address which will activate and transmit the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

57. The system of claim 45, wherein a host computer is connected to said computer communications system, which includes one or more authorized computers, as entities having access to said computer communications system, which are authorized to access said host computer, and the method further comprises:

means for providing each authorized computer with an authorized computer identifying address;

means for providing said host computer with a host computer destination identifier and a host computer port identifier as variable identifiers;

means for providing said host computer destination identifier and said host computer port identifier to said authorized computers;

means for causing each authorized computer to access said host computer with the host computer destination and port identifiers and said authorized computer identifying address;

means for sensing the presence or absence of said host computer destination and port identifiers and said authorized computer identifying address before granting access to said host computer;

means for providing access to said host computer when the use of correct computer destination and port identifiers and a correct authorized computer identifying address is sensed; and

means for denying immediate access to said host computer when the absence of any one or more of the correct host computer destination and port identifiers or the authorized computer identifying address is sensed.

58. The system of claim 57, further comprising:

means for periodically changing the host computer destination and port identifiers and providing these changes to the authorized computers;

means for storing said host computer destination and port identifiers as inaccessible variable identifiers in said authorized computer; and

means for providing said authorized computers with an unchangeable, accessible host computer address as permanent identifier which will activate and transmit the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

59. The system of claim 57, further comprising:

means for permitting a predetermined number of attempts to access said host computer with correct host computer destination and port identifiers and a correct authorized computer identifying address after the absence of at least a correct one of said identifiers and authorized computer identifying address is sensed by the host computer; and

means for providing access to said host computer if correct host computer destination and port identifiers and a correct authorized computer identifying address are sensed during the predetermined number of attempts to access said host computer.

60. The system of claim 57, further comprising:

means for changing the host computer destination and port identifiers when access is denied to said host computer after at least one access attempt has been made and providing these changed identifiers to the authorized computers;

means for storing said host computer destination and port identifiers as inaccessible variable identifiers in said authorized computer; and

means for providing said authorized computers with an unchangeable, accessible host computer address as permanent identifier which will activate and cause transmission of the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

61. The system of claim 45, wherein said variable identifier is a cyber coordinate, consisting of statements determining location of an object, such as a computer, or a piece of information, such as a computer file, in cyber space.

62. The system of claim 45, wherein said system is implemented with one or more hardware and/or software devices.

63. A computer-readable medium including one or more computer-readable instructions embedded therein for protecting a communications device, which is connected to a communications system, against an unauthorized intrusion, and configured to cause one or more computer processors to perform the steps of:

providing the communications device with at least one variable identifier;

providing the at least one variable identifier for use in accessing the communications device to entities authorized to access said communications device, said variable identifier being provided to a user address book and assigned with a permanent identifier, wherein said permanent identifier is available to a user, but not said variable identifier;

sensing the presence or absence of said variable identifier before granting access to said communications device;

providing access to said communications device when the use of said at least one correct variable identifier is sensed, and denying access to said communications device when the absence of the correct at least one variable identifier is sensed during an attempt to access said communications device; and

providing said communications device with at least one new variable identifier periodically and providing said at least one new variable identifier to entities authorized to access said communications device, said new variable identifier being provided to said user address book and assigned with said permanent identifier, wherein said permanent identifier is available to the user, but not said new variable identifier.

64. The computer-readable medium of claim 63, further comprising:

providing said communications device with a plurality of separate variable identifiers;

sensing the presence or absence of all of said plurality of variable identifiers before granting access to said communications device;

providing access to said communications device when the use of all of said identifiers is sensed; and

denying access to said communications device and providing said communications device with a new plurality of variable identifiers to replace the previous plurality of variable identifiers when the absence of any one of the correct identifiers is sensed.

65. The computer-readable medium of claim 64, further comprising periodically changing said plurality of separate variable identifiers and providing the changed variable identifiers to the entities authorized to access said communications device.

66. The computer-readable medium of claim 63, further comprising:

providing said communications device with at least one new variable identifier; and

providing said at least one new variable identifier to entities authorized to access said communications device when the absence of the correct at least one variable identifier is sensed during an attempt to access said communications device.

67. The computer-readable medium of claim 63, further comprising:

permitting a predetermined number of attempts to access said communications device with a correct at least one variable identifier after the absence of the correct at least one variable identifier is sensed before providing said communications device with at least one new variable identifier; and

providing access to said communications device if the correct at least one variable identifier is sensed during the predetermined number of attempts to access.

68. The computer-readable medium of claim 63, wherein said communications system is a telephone system and said communications device is a telephone.

69. The computer-readable medium of claim 63, wherein said communications system is a computer network with said entities authorized to access said communications device being authorized computers having access to said computer network, and said communications device including at least one host computer having access to said computer network.

70. The computer-readable medium of claim 69, further comprising providing the authorized computers with an unchangeable, accessible address for the host computer as permanent identifier which is used by the authorized computer to activate and transmit the at least one variable identifier for the host computer when the authorized computer initiates access to the host computer.

71. The computer-readable medium of claim 69, further comprising:

providing each authorized computer with an authorized computer identifier;

providing the host computer with a destination identifier;

causing each authorized computer to access said host computer with at least a host computer destination identifier and the authorized computer identifier;

sensing the presence or absence of both said host computer destination identifier and an authorized computer identifier before granting access to said host computer;

providing access to said host computer when the use of both a correct host computer destination identifier and an authorized computer identifier is sensed; and

denying access to said host computer and providing said host computer with a new host computer destination identifier when the absence of either a correct host computer destination identifier or a correct authorized computer identifier is sensed.

72. The computer-readable medium of claim 71, further comprising:

permitting a predetermined number of attempts to access said host computer with both a correct host computer destination identifier and an authorized computer identifier after the absence of a correct host computer destination identifier or an authorized computer identifier is sensed before providing said host computer with a new host computer destination identifier;

providing access to said host computer if correct host computer destination and authorized computer identifier are sensed during the predetermined number of attempts to access the host computer; and

storing said host computer destination identifier as an inaccessible identifier in said authorized computers, and providing said authorized computers with an unchangeable, accessible host computer address, which will activate and transmit the host computer destination identifier when an authorized computer initiates access to the host computer.

73. The computer-readable medium of claim 69, further comprising:

providing said host computer with a host computer destination identifier and a host computer port identifier;

causing each authorized computer to access said host computer with at least the host computer destination identifier and the host computer port identifier;

sensing the presence or absence of both said host computer destination identifier and said host computer port identifier before granting access to said host computer;

providing access to said host computer when the use of both a correct host computer destination identifier and a correct host computer port identifier are sensed; and

denying access to said host computer and providing said host computer with a new destination identifier and port identifier when the absence of either or both of a correct host computer destination or port identifier is sensed.

74. The computer-readable medium of claim 73, further comprising:

permitting a predetermined number of attempts to access said host computer with both a correct host computer destination and port identifier when either or both an incorrect host computer destination or port identifier is sensed before providing said host computer with a new destination and port identifier;

providing access to said host computer if both correct host computer destination and port identifiers are sensed during the predetermined number of attempts to access said host computer; and

storing said host computer destination and port identifiers as inaccessible identifiers in said authorized computers and providing said authorized computers with an unchangeable, accessible host computer address which will activate and transmit the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

75. The computer-readable medium of claim 63, wherein a host computer is connected to said computer communications system, which includes one or more authorized computers, as entities having access to said computer communications system, which are authorized to access said host computer, and the method further comprises:

providing each authorized computer with an authorized computer identifying address;

providing said host computer with a host computer destination identifier and a host computer port identifier as variable identifiers;

providing said host computer destination identifier and said host computer port identifier to said authorized computers;

causing each authorized computer to access said host computer with the host computer destination and port identifiers and said authorized computer identifying address;

sensing the presence or absence of said host computer destination and port identifiers and said authorized computer identifying address before granting access to said host computer;

providing access to said host computer when the use of correct computer destination and port identifiers and a correct authorized computer identifying address is sensed; and

denying immediate access to said host computer when the absence of any one or more of the correct host computer destination and port identifiers or the authorized computer identifying address is sensed.

76. The computer-readable medium of claim 75, further comprising:

periodically changing the host computer destination and port identifiers and providing these changes to the authorized computers;

storing said host computer destination and port identifiers as inaccessible variable identifiers in said authorized computer; and

providing said authorized computers with an unchangeable, accessible host computer address as permanent identifier which will activate and transmit the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

77. The computer-readable medium of claim 75, further comprising:

permitting a predetermined number of attempts to access said host computer with correct host computer destination and port identifiers and a correct authorized computer identifying address after the absence of at least a correct one of said identifiers and authorized computer identifying address is sensed by the host computer; and

providing access to said host computer if correct host computer destination and port identifiers and a correct authorized computer identifying address are sensed during the predetermined number of attempts to access said host computer.

78. The computer-readable medium of claim 75, further comprising:

changing the host computer destination and port identifiers when access is denied to said host computer after at least one access attempt has been made and providing these changed identifiers to the authorized computers;

storing said host computer destination and port identifiers as inaccessible variable identifiers in said authorized computer; and

providing said authorized computers with an unchangeable, accessible host computer address as permanent identifier which will activate and cause transmission of the host computer destination and port identifiers when an authorized computer initiates access to said host computer.

79. The computer-readable medium of claim 63, wherein said variable identifier is a cyber coordinate, consisting of statements determining location of an object, such as a computer, or a piece of information, such as a computer file, in cyber space.