COMPUTER NETWORK CROSS-BOUNDARY PROTECTION

• US 20170155651A1
• Filed: 11/29/2015
• Published: 06/01/2017
• Est. Priority Date: 11/29/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: KLEIN, AMIT, REGEV, SHMUEL
• Granted Patent: US 10,069,833 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]

Abstract

A computer security method including detecting access, by a computer in a first computer network, to a computer-readable document, determining whether the computer-readable document was retrieved from a second computer network, identifying a reference, associated with the computer-readable document, to a resource at a location within the first computer network, and preventing access by the computer to the resource at the location within the first computer network responsive to determining that the computer-readable document was retrieved from the second computer network.

Claims

1. A computer security method comprising:

detecting access, by a computer in a first computer network, to a computer-readable document;

determining whether the computer-readable document was retrieved from a second computer network;

identifying a reference, associated with the computer-readable document, to a resource at a location within the first computer network; and

preventing access by the computer to the resource at the location within the first computer network responsive to determining that the computer-readable document was retrieved from the second computer network.

2. The method according to claim 1 and further comprising maintaining an indicator indicating that the computer-readable document was retrieved from the second computer network, wherein the computer-readable document is stored in a data storage device of the computer after being retrieved from the second computer network, and wherein the detected access is to the computer-readable document that is retrieved from the data storage device.

3. The method according to claim 1 wherein the detecting comprises detecting wherein the computer-readable document is a web page.

4. The method according to claim 1 wherein the preventing comprises preventing operation of the resource.

5. The method according to claim 1 and further comprising deleting the computer-readable document from a data storage device of the computer.

6. The method according to claim 1 and further comprising deleting from a data storage device of the computer a second computer-readable document that is referred to by the computer-readable document that was retrieved from the second computer network.

7. The method of claim 1 wherein the detecting, determining, identifying, and preventing are implemented in any of

a) computer hardware, and

b) computer software embodied in a non-transitory, computer-readable medium.

8. A computer security system comprising:

an access manager configured to

detect access, by a computer in a first computer network, to a computer-readable document,

determine whether the computer-readable document was retrieved from a second computer network,

identify a reference, associated with the computer-readable document, to a resource at a location within the first computer network; and

a security manager configured to prevent access by the computer to the resource at the location within the first computer network responsive to determining that the computer-readable document was retrieved from the second computer network.

9. The system according to claim 8 wherein the access manager is configured to maintain an indicator indicating that the computer-readable document was retrieved from the second computer network, wherein the computer-readable document is stored in a data storage device of the computer after being retrieved from the second computer network, and wherein the detected access is to the computer-readable document that is retrieved from the data storage device.

10. The system according to claim 8 wherein the computer-readable document is a web page.

11. The system according to claim 8 wherein the security manager is configured to prevent operation of the resource.

12. The system according to claim 8 wherein the security manager is configured to delete the computer-readable document from the first computer network.

13. The system according to claim 8 wherein the security manager is configured to delete from a data storage device of the computer a second computer-readable document that is referred to by the computer-readable document that was retrieved from the second computer network.

14. The system of claim 9 wherein the access manager and the security manager are implemented in any of

a) computer hardware, and

b) computer software embodied in a non-transitory, computer-readable medium.

15. A computer program product for providing computer security, the computer program product comprising:

a non-transitory, computer-readable storage medium; and

computer-readable program code embodied in the storage medium, wherein the computer-readable program code is configured to

detect access, by a computer in a first computer network, to a computer-readable document,

determine whether the computer-readable document was retrieved from a second computer network,

identify a reference, associated with the computer-readable document, to a resource at a location within the first computer network, and

prevent access by the computer to the resource at the location within the first computer network responsive to determining that the computer-readable document was retrieved from the second computer network.

16. The computer program product according to claim 15 wherein the computer-readable program code is configured to maintain an indicator indicating that the computer-readable document was retrieved from the second computer network, wherein the computer-readable document is stored in a data storage device of the computer after being retrieved from the second computer network, and wherein the detected access is to the computer-readable document that is retrieved from the data storage device.

17. The computer program product according to claim 15 wherein the computer-readable document is a web page.

18. The computer program product according to claim 15 wherein the computer-readable program code is configured to prevent operation of the resource.

19. The computer program product according to claim 15 wherein the computer-readable program code is configured to delete the computer-readable document from the first computer network.

20. The computer program product according to claim 15 wherein the computer-readable program code is configured to delete from a data storage device of the computer a second computer-readable document that is referred to by the computer-readable document that was retrieved from the second computer network.