System and method for providing connection orientation based access authentication

• US 6,981,143 B2
• Filed: 11/28/2001
• Issued: 12/27/2005
• Est. Priority Date: 11/28/2001
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Mullen, Shawn P., McBrearty, Gerald F., Shieh, Johnny M.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/996,132
• Publication Number:
  US 20030101338A1
• Time in Patent Office: 1,490 Days
• Field of Search: 713/166, 713/168, 713/182, 713/189, 713/200, 713/201
• US Class Current: 713/166
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL

Abstract

The present invention is embodied in a system and method for providing access authentication of users attempting to gain access to a network based on connection orientation parameters to prevent security breaches of the network. In general, after a connection is requested to gain access to a networked computer, all router addresses through which the request went is gathered and compared to a well-known set of firewall router addresses (for example, of known companies) to determine the validity of the request. If one of the gathered addresses match the well-known set of firewall address, the request is deemed to have come from the other side of the firewall and the connection is denied. As such, in an intranet networking environment that uses a firewall, the present invention will provide computer users of the intranet protection from unauthorized access by others that do not have access past the firewall.

Claims

1. A computer system operating in a network environment for preventing security breaches, comprising:

an interface layer that receives at least one connection request from another computer;

a security layer that examines the connection request, gathers a list of router addresses and compares the router addresses to a set of known firewall router address; and

a socket layer residing above the security layer and coupling connection requests to data stored on the computer.

2. The computer system of claim 1, wherein the security layer generates an alert to a user of the computer if one of the gathered addresses match one of the known firewall router addresses.

3. The computer system of claim 2, wherein the security layer provides the user of the computer the option to grant or deny the connection request.

4. The computer system of claim 1, wherein the security layer denies the connection request if one of the gathered addresses match one of the known firewall router addresses.

5. The computer system of claim 1, wherein the security layer uses a traceroute to gather the list of router addresses.

6. The computer system of claim 5, wherein the traceroute gathers Internet Protocol (IP) addresses of all routers between the computer system and a machine originating the connection request.

7. The computer system of claim 6, wherein the security layer resides between the socket layer and the interface layer.

8. The computer system of claim 1, wherein the security layer monitors Transmission Control Protocol (TCP) data packets for synchronization (SYN) requests.

9. A computer implemented method operating in a network environment for preventing security breaches, comprising:

receiving at least one connection request from another computer;

gathering a list of router addresses associated with the connection request;

comparing the router addresses to a set of known firewall router address; and

forming a socket layer residing above the security layer and coupling connection requests to data stored on the computer.

10. The method of claim 9, further comprising alerting a user of the computer if one of the gathered addresses match one of the known firewall router addresses.

11. The method of claim 9, further comprising providing a user of the computer the option to grant or deny the connection request.

12. The method of claim 9, further comprising denying the connection request if one of the gathered addresses match one of the known firewall router addresses.

13. The method of claim 9, further comprising using a traceroute to gather the list of router addresses.

14. The method of claim 13 wherein the traceroute gathers Internet Protocol (IP) addresses of all routers between the computer system and the machine originating the connection request.

15. A computer-readable medium having computer-executable instructions operating on a computer system for validating connection requests on a networked computer, comprising:

an interface module operating on the computer that examines the connection request and collects Internet Protocol (IP) addresses of all routers between the computer and a machine originating the connection request; and

a security module that compares the collected addresses to a set of known firewall router address and prevents the connection request if the any of the collected addresses match the set of known firewall addresses, wherein the security module monitors Transmission Control Protocol (TCP) data packets for synchronizing (SYN) requests.

16. The computer-readable medium of claim 15, wherein an alert is provided to a user of the computer if one of the gathered addresses match one of the known firewall router addresses.

17. The computer-readable medium of claim 15 wherein the security module provides a user of the computer the option to grant or deny the connection request.

18. The computer-readable medium of claim 15, wherein the interface module uses a traceroute to collect the router addresses.