System and method for alerting computer users of digital security intrusions

• US 6,973,580 B1
• Filed: 07/13/2000
• Issued: 12/06/2005
• Est. Priority Date: 07/13/2000
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carroll, Scott Allen, McBrearty, Gerald Francis, Shieh, Johnny Meng-Han, Mullen, Shawn Patrick, Fiveash, William Alton
• Primary Examiner(s): Caldwell, Andrew
• Assistant Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US09/615,772
• Time in Patent Office: 1,972 Days
• Field of Search: 713/200, 713/201, 345/710, 345/741, 345/742, 709/203
• US Class Current: 726/4
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/01 Protocols

Abstract

The present invention is embodied in a system and method for monitoring and alerting remote client users of digital intrusions of their computers by host servers. In general, the present invention monitors actions taken by host servers relating to information about the remote client and displays graphical alerts when a digital intrusion or a breach of security occurs during a network connection, such as a connection to the Internet, with the host server. Specifically, the present invention monitors certain aspects of the remote client user s interaction with host servers. Based on certain interaction, such as an attempt by the host server to retrieve non-related information about the remote client, the remote client user can be provided with a graphical alert. This allows the remote client user to make an informed decision whether or not to allow certain host server sites to retrieve the client user s personal information.

Claims

1. A computer-readable medium having computer-executable instructions for performing a process to prevent digital intrusions, the process comprising:

(a) detecting a request for access by a second computer of a digital tracking component residing on a first computer;

(b) automatically determining if the second computer is associated with the digital tracking component that is being requested by the second computer;

(c) in response to determining that the second computer is associated with the digital tracking component, automatically allowing the second computer to access the digital tracking component;

(d) comparing a domain name of the second computer with a domain name associated with the digital tracking component;

(e) in response to a match of the domain names, determining that the second computer is associated with the digital tracking component; and

(f) in response to a mis-match of the domain names, determining that the second computer is not associated with the digital tracking component, wherein a browser operating within the first computer performs steps (a) through (f).

2. The medium of claim 1 further comprising:

in response to determining that the second computer is not associated with the digital tracking component, alerting a user of the first computer; and

optionally allowing or preventing access to the digital tracking component by the second computer.

3. The medium of claim 2, wherein the alerting step comprises at least one of sounding an audible alert or displaying a color coded visual alert on the first computer.

4. The medium of claim 1 further comprising:

in response to determining that the second computer is not associated with the digital tracking component, automatically blocking the second computer from accessing the digital tracking component.

5. The medium of claim 1, wherein the first computer is a remote client and the second computer is a host server.

6. The medium of claim 1, wherein steps (a) through (c) occur without intervention from a user of the first computer.

7. The medium of claim 1, wherein digital communication between the first and second computers occurs on a networked connection comprising a World Wide Web Internet connection.

8. The medium of claim 1, wherein the digital tracking component is a cookie.

9. The medium of claim 1, further comprising:

in response to a match of the domain names, determining that the second computer previously created the digital tracking component residing on the first computer; and

in response to a mis-match of the domain names, determining that the digital tracking component residing on the first computer was created by a third computer.

10. A computer-implemented method for protecting a first computer from digital intrusions by a second computer, the method comprising:

(a) sending by the second computer to the first computer a request for access of a digital tracking component residing on the first computer;

(b) if the second computer is associated with the digital tracking component that is being requested, the second computer automatically receiving access to the digital tracking component by the first computer;

(c) if the second computer is not associated with the digital tracking component, the second computer automatically being denied access to the digital tracking component by the first computer;

(d) comparing a domain name of the second commuter with a domain name associated with the digital tracking component;

(e) in response to a match of the domain names, determining that the second computer is associated with the digital tracking component; and

(f) in response to a mis-match of the domain names, automatically determining that the second computer is not associated with the digital tracking component, wherein steps (a) through (f) are performed by a browser operating within the first computer.

11. The computer-implemented method of claim 10, wherein determining if the second computer is associated with the digital tracking component comprises comparing a domain name of the second computer with a domain name associated with the digital tracking component.

12. The computer-implemented method of claim 10, wherein if the second computer is not associated with the digital tracking component, a user of the first computer is alerted.

13. The computer-implemented method of claim 12, wherein after the user of the first computer is alerted, the first user is given an option to allow or prevent access of the digital tracking component by the second computer.

14. The computer-implemented method of claim 12, wherein the alert includes at least one of sounding an audible alert or displaying a color coded visual alert on the first computer.

15. A computer-implemented method for protecting a first computer from digital intrusions by a second computer, comprising:

(a) detecting a request for access by the second computer of a digital tracking component residing on the first computer;

(b) automatically determining if the second computer is associated with the digital tracking component that is being requested by the second computer;

(c) in response to determining that the second computer is associated with the digital tracking component, automatically allowing the second computer to access the digital tracking component;

(d) comparing a domain name of the second computer with a domain name associated with the digital tracking component;

(e) in response to a match of the domain names, determining that the second computer is associated with the digital tracking component; and

(f) in response to a mismatch of the domain names, automatically determining that the second computer is not associated with the digital tracking component, wherein steps (a) through (f) are performed by a browser operating within the first computer.

16. The method of claim 15 further comprising:

in response to determining that the second computer is not associated with the digital tracking component, alerting a user of the first computer; and

optionally allowing or preventing access to the digital tracking component by the second computer.

17. The method of claim 16, wherein the alerting step comprises sounding an audible alert or displaying a color coded visual alert on the first computer.

18. The method of claim 15, wherein the first computer is a remote client and the second computer is a host server.

19. The method of claim 15, wherein steps (a) through (c) occur without intervention from a user of the first computer.

20. The method of claim 15, wherein digital communication between the first and second computers occurs on a networked connection comprising a World Wide Web Internet connection.

21. The method of claim 15, wherein the digital tracking component is a cookie.

22. The method of claim 15, further comprising:

in response to a match of the domain names, determining that the second computer previously created the digital tracking component that resides on the first computer; and

in response to a mis-match of the domain names, determining that the digital tracking component residing on the first computer was previously created by a third computer.

23. The method of claim 15, further comprising:

in response to determining that the second computer is not associated with the digital tracking component, automatically blocking the second computer from accessing the digital tracking component.

24. A computer security system for preventing host servers from taking inappropriate self-contained packets of information residing on a remote client, the system comprising:

a monitor module that monitors requests for access by the host servers of the self-contained packets of information residing on a remote client during digital communication between the remote client and the host server;

a notify module that sends an alert to the remote client if a domain name associated with a particular host server does not match a domain name associated with one of the self-contained packets of information residing on a remote client that is being requested by the particular host server;

a compare module that compares a domain name of the host server with a domain name associated with the self-contained packet;

wherein the compare module, in response to a match of the domain names, determines that the host server is associated with the self-contained packet;

wherein the monitor module, in response to a mis-match of the domain names, automatically determines that the host server is not associated with the digital tracking component; and

wherein the monitor module and the compare module are within a browser operating within the remote client.

25. The computer security system of claim 24, wherein the notify module provides an audible notification to the remote client when a particular host server requests one or more of the self-contained packets of information that contains information that is not associated with the particular host server.

26. The computer security system of claim 24, wherein the monitor module uses a color coded visual alert represented by a graphical display that displays a safe color when one of the host servers requests one or more of the digital tracking components that contains information that is associated with the host server and a warning color when one of the host servers requests one or more of the digital tracking components that contains information that is not associated with the host server.