Identifying unauthorized communication systems based on their memory contents

• US 6,954,861 B2
• Filed: 05/09/2001
• Issued: 10/11/2005
• Est. Priority Date: 07/14/2000
• Status: Expired due to Fees

• Current Assignee: Oath Inc. (Verizon Communications Inc.)
• Original Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Inventors: Wick, Andrew L., Watkins, Robert G.
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US09/851,121
• Publication Number:
  US 20020120871A1
• Time in Patent Office: 1,616 Days
• Field of Search: 713/150, 713/168, 713/176, 713/181, 713200-202, 709227-229, 705 50- 52, 705 55- 59, 711/100, 711/154, 711/163, 711/164
• US Class Current: 726/28
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

An authorized client communication system seeking access to a host communication system may be identified by locating a memory segment within the client communication system that stores client software used to access the host computer system. The memory segment then is examined to determine whether the client software stored in the memory segment corresponds to client software for an official client communication system. Communications from the client communication system are terminated when the client software in the memory segment is determined to diverge from software for an official client communication system.

Claims

1. A method for identifying unauthorized client software seeking to communicate with a host communication system, comprising:

locating a memory segment within a client communication system that stores client software used to communicate with a host communication system;

determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system; and

identifying the client communication system as an unauthorized client communication system when the client software stored in the memory segment located does not correspond to the client software for an official client communication system.

2. The method of claim 1, wherein locating the memory segment comprises:

identifying a type or version of client software being used by the client communication system to enable communication, and

locating the memory segment of the client communication system based on the identified type or version.

3. The method of claim 2, wherein identifying the type or version comprises receiving information indicating the type or version of the client software from the client communication system when a communication session is initiated.

4. The method of claim 2, wherein identifying the type or version comprises performing a diagnostic on the client communication system to automatically determine the type or version of the client software.

5. The method of claim 1, wherein locating the memory segment comprises locating a memory segment of the client communication system that includes client software that remains unchanged in memory segments of official client communication systems.

6. The method of claim 1, wherein locating the memory segment comprises locating a memory segment of the client communication system that includes client software that is user independent in memory segments of official client communication systems.

7. The method of claim 1, wherein locating the memory segment comprises identifying the memory segment based on a random selection among several memory segments that store the client software.

8. The method of claim 7, wherein identifying the memory segment comprises identifying the memory segment based on a random selection among several memory segments including client software that remains unchanged with respect to each particular client.

9. The method of claim 8, wherein identifying the memory segment comprises identifying the memory segment based on a random selection among several memory segments including a continuous piece of client software on the memory segment that is stored without relocation of any intermediate client software.

10. The method of claim 1, wherein determining whether the client software corresponds to official software comprises comparing the client software stored in the identified memory segment with the corresponding client software of the official client communication system.

11. The method of claim 10, wherein comparing the client software comprises:

performing a mathematical computation on the contents of the identified memory segment; and

comparing results from the mathematical computation performed on the contents of the identified memory segment against a mathematical representation for the corresponding client software of the official communication system.

12. The method of claim 11, wherein the mathematical computation comprises a checksum.

13. The method of claim 11, wherein the mathematical computation comprises a hashing algorithm.

14. The method of claim 13, wherein terminating communications is performed after a predetermined and intentional delay once the client communication system is identified as an unauthorized client communication system.

15. The method of claim 1, further comprising terminating communications from the client communication system when the client software stored in the memory segment is determined to diverge from predictable client software for an official client communication system.

16. The method of claim 1, further comprising sending a notification to the user of the client communication system indicating identification of an unauthorized client when the client software stored in the memory segment is determined to diverge from predictable client software for an official client communication system.

17. The method of claim 1 wherein the client software used for communicating includes software configured to perform processing independent of authentication.

18. The method of claim 17 wherein the client software used for communicating includes software configured to perform processing independent of authentication of the client communication system.

19. The method of claim 17 wherein the client software used for communicating includes software configured to perform processing independent of authentication of a user of the client communication system.

20. The method of claim 1 wherein the client software used for communicating includes software for identifying unauthorized client software.

21. The method of claim 1 wherein locating a memory segment, determining whether the client software corresponds to client software for an official client communication system, and identifying the client communication system as an unauthorized client communication system are performed for the purpose of identifying unauthorized client software.

22. The method of claim 1 wherein the client software used for communicating includes executable software.

23. The method of claim 1 wherein the client software used for communicating includes a client application.

24. The method of claim 1 wherein the client software used for communicating includes a browser application.

25. The method of claim 1 further comprising, in addition to determining whether the client software corresponds to client software for an official client communication system, determining whether a user of the client software is an authorized user.

26. The method of claim 1 wherein locating a memory segment within a client communication system, determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system, and identifying the client communication system as an unauthorized client communication system occur after initiation of a communication session between the client communication system and the host system.

27. The method of claim 26 wherein locating a memory segment within a client communication system, determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system, and identifying the client communication system as an unauthorized client communication system occur before the communication session between the client communication system and the host system ends.

28. A computer readable medium or propagated signal having embodied thereon a computer program, that when executed by a processor, identifies unauthorized client software seeking to communicate with a host communication system, the computer program comprising:

a locating code segment for locating a memory segment within a client communication system that stores client software used to communicate with a host communication system;

a determining code segment for determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system; and

an identifying code segment for identifying the client communication system as an unauthorized client communication system when the client software stored in the memory segment located does not correspond to the client software for an official client communication system.

29. The medium of claim 28, wherein the locating code segment comprises:

an identifying code segment for identifying a type or version of client software being used by the client communication system to enable communication, and

a locating code segment for locating the memory segment of the client communication system based on the identified type or version.

30. The medium of claim 29, wherein the identifying code segment comprises a receiving code segment for receiving information indicating the type or version of the client software from the client communication system when a communication session is initiated.

31. The medium of claim 29, wherein the identifying code segment comprises a performing code segment for performing a diagnostic on the client communication system to automatically determine the type or version of the client software being used by the client communication system to enable communication.

32. The medium of claim 28, wherein the locating code segment comprises a code segment for locating a memory segment of the client communication system that includes client software that remains unchanged in memory segments of official client communication systems.

33. The medium of claim 28, wherein the locating code segment comprises a code segment for locating a memory segment of the client communication system that includes client software that is user independent in memory segments of official client communication systems.

34. The medium of claim 28, wherein the locating code segment comprises an identifying code segment for identifying the memory segment based on a random selection among several memory segments that include the client software.

35. The medium of claim 34, wherein the identifying code segment comprises a code segment for identifying the memory segment based on a random selection among several memory segments including client software that remains unchanged.

36. The medium of claim 28, wherein the determining code segment comprises a comparing code segment for comparing the client software stored in the identified memory segment with the corresponding client software of the official client communication system.

37. The medium of claim 36, wherein the comparing code segment comprises:

a performing code segment for performing a mathematical computation on the contents of the identified memory segment; and

a comparing code segment for comparing results from the mathematical computation performed on the contents of the identified memory segment against a mathematical representation for the corresponding client software of the official communication system.

38. The medium of claim 37, wherein the mathematical computation comprises a checksum.

39. The medium of claim 37, wherein the mathematical computation comprises a hashing algorithm.

40. The medium of claim 28, further comprising a terminating code segment for terminating communications from the client communication system when the client software stored in the memory segment is determined to diverge from predictable client software for an official client communication system.

41. The medium of claim 28 wherein the client software used for communicating includes software configured to perform processing independent of authentication.

42. The medium of claim 41 wherein the client software used for communicating includes software configured to perform processing independent of authentication of the client communication system.

43. The medium of claim 41 wherein the client software used for communicating includes software configured to perform processing independent of authentication of a user of the client communication system.

44. The medium of claim 28 wherein the client software used for communicating includes software for identifying unauthorized client software.

45. The medium of claim 28 wherein locating a memory segment, determining whether the client software corresponds to client software for an official client communication system, and identifying the client communication system as an unauthorized client communication system are performed for the purpose of identifying unauthorized client software.

46. The medium of claim 28 wherein the client software used for communicating includes executable software.

47. The medium of claim 28 wherein the client software used for communicating includes a client application.

48. The medium of claim 28 wherein the client software used for communicating includes a browser application.

49. The medium of claim 28 further comprising one or more code segments configured to determine whether a user of the client software is an authorized user, wherein the determination of whether a user is an authorized user is made in addition to determining whether the client software corresponds to client software for an official client communication system.

50. The medium of claim 28 wherein the locating code segment, the determining code segment, and the identifying code segment are executed after initiation of a communication session between the client communication system and the host system.

51. The medium of claim 50 wherein the locating code segment, the determining code segment, and the identifying code segment are executed before the communication session between the client communication system and the host system ends.

52. A communication system for identifying unauthorized client software seeking to communicate with the communication system, the communication system comprising:

a locator structured and arranged to locate a memory segment within a client communication system that stores client software used to communicate with the communication system;

a comparing device structured and arranged to determine whether the client software stored in the memory segment located corresponds to client software for an official client communication system; and

an identifier structured and arranged to identify the client communication system as an unauthorized client communication system when the client software stored in the memory segment located does not correspond to the client software for an official client communication system.

53. The communication system of claim 52, wherein the locator comprises:

an identifier structured and arranged to identify a type or version of client software being used by the client communication system to enable communication, and

a locator structured and arranged to locate the memory segment of the client communication system based on the identified type or version.

54. The communication system of claim 53, wherein the identifier comprises a receiver structured and arranged to receive information from the client communication system when the communication session is initiated indicating the type or version of client software.

55. The communication system of claim 53, wherein the identifier comprises a testing device structured and arranged to perform a diagnostic on the client communication system to automatically determine the type or version of the client software being used by the client communication system to enable communication.

56. The communication system of claim 52, wherein the locator comprises a memory segment locator structured and arranged to locate a memory segment of the client communication system that includes client software that remains unchanged in memory segments of official client communication systems.

57. The communication system of claim 52, wherein the locator comprises a memory segment locator structured and arranged to locate a memory segment of the client communication system that includes client software that is user independent in memory segments of official client communication systems.

58. The communication system of claim 52, wherein the locator comprises an identifier structured and arranged to identify the memory segment based on a random selection among several memory segments that include the client software.

59. The apparatus of claim 58, wherein the identifier comprises a memory segment identifier structured and arranged to identify the memory segment based on a random selection among several memory segments including client software that remains unchanged.

60. The communication system of claim 52, wherein the comparing device comprises a comparing device structured and arranged to compare the client software stored in the identified memory segment with the corresponding client software of the official client communication system.

61. The communication system of claim 60, wherein the comparing device comprises:

a testing device structured and arranged to test a mathematical computation on the contents of the identified memory segment; and

a comparing device structured and arranged to compare results from the mathematical computation performed on the contents of the identified memory segment against a mathematical representation for the corresponding client software of the official communication system.

62. The communication system of claim 61, wherein the mathematical computation comprises a checksum.

63. The communication system of claim 61, wherein the mathematical computation comprises a hashing algorithm.

64. The communication system of claim 52, further comprising a device structured and arranged to terminate communications from the client communication system when the client software stored in the memory segment is determined to diverge from predictable client software for an official client communication system.

65. The apparatus of claim 52 wherein the client software used for communicating includes software configured to perform processing independent of authentication.

66. The apparatus of claim 65 wherein the client software used for communicating includes software configured to perform processing independent of authentication of the client communication system.

67. The apparatus of claim 65 wherein the client software used for communicating includes software configured to perform processing independent of authentication of a user of the client communication system.

68. The communication system of claim 52 wherein the client software used for communicating includes software for identifying unauthorized client software.

69. The communication system of claim 52 wherein locating a memory segment, determining whether the client software corresponds to client software for an official client communication system, and identifying the client communication system as an unauthorized client communication system are performed for the purpose of identifying unauthorized client software.

70. The communication system of claim 52 wherein the client software used for communicating includes executable software.

71. The communication system of claim 52 wherein the client software used for communicating includes a client application.

72. The communication system of claim 52 wherein the client software used for communicating includes a browser application.

73. The communication system of claim 52 further comprising a determining device structured and arranged to determine whether a user of the client software is an authorized user, wherein the determination of whether a user is an authorized user is made in addition to determining whether the client software corresponds to client software for an official client communication system.

74. The communication system of claim 52 wherein locating a memory segment within a client communication system, determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system, and identifying the client communication system as an unauthorized client communication system occur after initiation of a communication session between the client communication system and the host system.

75. The communication system of claim 74 wherein locating a memory segment within a client communication system, determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system, and identifying the client communication system as an unauthorized client communication system occur before the communication session between the client communication system and the host system ends.

76. A method for identifying an unauthorized client communication system seeking access to a host communication system, comprising:

locating a memory segment within a client communication system that stores client software used to communicate with a host communication system;

determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system; and

identifying the client communication system as an unauthorized client communication system when the client software stored in the memory segment located does not correspond to the client software for an official client communication system,

wherein locating the memory segment comprises locating a memory segment of the client communication system that includes client software that is user independent in memory segments of official client communication systems.

77. A method for identifying an unauthorized client communication system seeking access to a host communication system, comprising:

locating a memory segment within a client communication system that stores client software used to communicate with a host communication system;

determining whether the client software stored in the memory segment located corresponds to client software for an official client communication system; and

identifying the client communication system as an unauthorized client communication system when the client software stored in the memory segment located does not correspond to the client software for an official client communication system,

wherein locating the memory segment comprises identifying the memory segment based on a random selection among several memory segments that store the client software.

78. The method of claim 77, wherein identifying the memory segment comprises identifying the memory segment based on a random selection among several memory segments including client software that remains unchanged with respect to each particular client.

79. The method of claim 77, wherein identifying the memory segment comprises identifying the memory segment based on a random selection among several memory segments including a continuous piece of client software on the memory segment that is stored without relocation of any intermediate client software.

80. A communication system for identifying an unauthorized client communication system seeking access to a host communication system, the communication system comprising:

a locator structured and arranged to locate a memory segment within a client communication system that stores client software used to communicate with the communication system;

a comparing device structured and arranged to determine whether the client software stored in the memory segment located corresponds to client software for an official client communication system; and

an identifier structured and arranged to identify the client communication system as an unauthorized client communication system when the client software stored in the memory segment located does not correspond to the client software for an official client communication system,

wherein the locator comprises a memory segment locator structured and arranged to locate a memory segment of the client communication system that includes client software that is user independent in memory segments of official client communication systems.

81. A communication system for identifying an unauthorized client communication system seeking access to a host communication system, the communication system comprising:

a locator structured and arranged to locate a memory segment with a client communication system that stores client software used to communicate with the communication system;

a comparing device structured and arranged to determine whether the client software stored in the memory segment located corresponds to client software for an official client communication system; and

an identifier structured and arranged to identify the client communication system as an unauthorized client communication system when the client software stored in the memory segment located does not correspond to the client software for an official client communication system,

wherein the identifier comprises a memory segment identifier structured and arranged to identify the memory segment based on a random selection among several memory segments including client software that remains unchanged.

82. The communication system of claim 81, wherein the identifier comprises a memory segment identifier structured and arranged to identify the memory segment based on a random selection among several memory segments including client software that remains unchanged.

83. The communicaton system of claim 81, wherein the identifier comprises a memory segment identifier structured and arranged to identify the memory segment based on a random selection among several memory segments including a continuous piece of client software on the memory segment that is stored without relocation of any intermediate client software.