System and method for computer security using multiple cages

• US 6,907,533 B2
• Filed: 04/23/2001
• Issued: 06/14/2005
• Est. Priority Date: 07/14/2000
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Ross, Robert F., Sorkin, Stephen, Maricondo, James R., Lyle, Michael
• Primary Examiner(s): Moise, Emmanuel L.
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US09/841,700
• Publication Number:
  US 20020157021A1
• Time in Patent Office: 1,513 Days
• Field of Search: 713/201, 707/3, 707/9
• US Class Current: 726/22
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A system and method are disclosed for providing security for a computer network. Content sets are generated for a computer associated with the network. It is determined whether a user should be routed to the generated content sets. If it is determined that the user should be routed to the generated content sets, a generated content set is selected and the user is so routed. Various actions and events may be recorded in a logfile, and the logfile is analyzed using regular expressions.

Claims

1. A method for providing security for a computer network, comprising:

generating content sets for a computer associated with the network;

determining whether a user should be routed to the generated content sets;

selecting one of the content sets if it is determined that the user should be routed to the generated content sets;

routing the user to a network interface associated with the selected generated content set;

monitoring the activities of the user with respect to the computer;

preventing the user from accessing files associated with said monitoring; and

preventing the user from accessing processes associated with said monitoring;

wherein each generated content set is associated with one or more network interfaces associated only with that generated content set.

2. The method as recited in claim 1, further comprising associating each generated content set with a virtual computer.

3. The method as recited in claim 2, wherein selecting one of the content sets includes choosing a content set associated with a virtual computer requested to be accessed by the user.

4. The method as recited in claim 3, further comprising concealing from the user network interfaces not associated with the selected generated content set.

5. The method as recited in claim 2, further comprising concealing from the user network connections not associated with the selected generated content set.

6. The method as recited in claim 5, wherein concealing network connections includes receiving a request from the user to access a network connection, checking whether that network connection is associated with the selected generated content set, and if it is not associated with the selected generated content set, providing an indication that the network connection does not exist.

7. The method as recited in claim 5, wherein concealing network connections includes receiving a request from the user to access a network connection, checking whether that network connection is associated with the selected generated content set, and if it is not associated with the selected generated content set, transforming the request into a request to access a network connection associated with the selected generated content set.

8. The method as recited in claim 2, wherein the computer is running on a Unix operating system.

9. The method as recited in claim 8, wherein the computer is running on a Solaris operating system.

10. The method as recited in claim 1, wherein selecting one of the content sets includes choosing a content set associated with a service requested to be accessed by the user.

11. The method as recited in claim 10, wherein the service is telnet.

12. The method as recited in claim 1, wherein selecting one of the content sets includes choosing a content set not currently in use by another user.

13. The method as recited in claim 1, further comprising storing the packets sent by the user.

14. The method as recited in claim 1, further comprising logging information concerning the files to which the user requests access.

15. The method as recited in claim 1, further comprising preventing the user from accessing content within the computer other than the selected generated content set.

16. The method as recited in claim 1, further comprising screening a request by the user to access a file to determine if access is permitted.

17. The method as recited in claim 16, further comprising permitting access to a requested file if it is determined that access to the requested file is permitted.

18. The method as recited in claim 16, further comprising providing an indication that a requested file does not exist if it is determined that access is not permitted.

19. The method as recited in claim 1, further comprising generating additional content subsequent to the step of generating content sets.

20. The method as recited in claim 19, further comprising adding the additional content to the selected generated content set.

21. The method as recited in claim 1, wherein routing the user includes using network address translation to route to the selected generated content set any user who requests to access an unauthorized service.

22. The method as recited in claim 21, wherein the unauthorized service is telnet.

23. The method as recited in claim 1, further comprising receiving an indication that the user is no longer connected to the computer.

24. The method as recited in claim 23, further comprising determining whether to retain changes in the files of the computer that resulted from the user'"'"'s activities.

25. The method as recited in claim 24, further comprising resetting the computer to restore the computer and the selected generated content set to the condition they were in prior to the user being routed to the selected generated content set if it is determined the changes should not be retained.

26. The method as recited in claim 25 further comprising updating the selected generated content set by generating additional content that appears to have been created during a time period during which the user was connected to the computer.

27. A system for providing security for a computer network, comprising:

a computer configured to generate content sets or the computer, wherein the computer is associated with the network;

a plurality of network interfaces each associated with one of the content sets; and

a network device configured to determine whether a user should be routed to the generated content sets, select one of the generated content sets if it is determined that the user should be routed to the generated content, and to route the user to a network interface associated with the selected generated content set;

monitor the activities of the user with respect to the computer;

prevent the user from accessing files associated with said monitoring; and

prevent the user from accessing processes associated with said monitoring;

wherein each generated content set is associated with one or more network interfaces associated only with that generated content set.

28. The system as recited in claim 27, wherein the network device is a firewall.

29. A computer program product for providing security for a computer network comprising a computer usable medium having machine readable code embodied therein for generating content sets for a computer associated with the network;

determining whether a user should be routed to the generated content sets;

selecting one of the generated content sets if it is determined that the user should be routed to the generated content sets; and

routing the user to a network interface associated with the selected generate content set;

monitoring the activities of the user with respect to the computer;

preventing the user from accessing files associated with said monitoring; and

preventing the user from accessing processes associated with said monitoring;

wherein each generated content set is associated with one or more interfaces associated only with that generated content set.