Method of communications and communication network intrusion protection methods and intrusion attempt detection system

• US 6,981,146 B1
• Filed: 05/15/2000
• Issued: 12/27/2005
• Est. Priority Date: 05/17/1999
• Status: Expired due to Term

• Current Assignee: Invicta Networks, Inc.
• Original Assignee: Invicta Networks, Inc.
• Inventors: Sheymov, Victor I.
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Lipman, Jacob
• Application Number:
  US09/571,377
• Time in Patent Office: 2,052 Days
• Field of Search: 380/273, 380/286, 380277-279, 713/172, 713/200
• US Class Current: 713/172
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

The intrusion protection method and system for a communications network provides address agility wherein the cyber coordinates of a target host are changed both on a determined time schedule and when an intrusion attempt is detected. The system includes a management unit which generates a random sequence of cyber coordinates and maintains a series of tables containing the current and next set of cyber coordinates. These cyber coordinates are distributed to authorized users under an encryption process to prevent unauthorized access.

Claims

1. A computer-implemented method for communicating with a communications device or object, the method comprising:

assigning a valid variable cyber coordinate associated with a permanent identifier of the communications device or object, wherein the cyber coordinate defines a location or position of the communications device or object in a cyber space;

determining if a received identifier, received during a communication attempt, with the communications device or object, based on the permanent identifier, is the valid variable cyber coordinate associated with the permanent identifier;

enabling a communication with the communications device or object, if the received identifier is determined to be the valid variable cyber coordinate associated with the permanent identifier;

not enabling a communication with the communications device or object, if the received identifier is determined not to be the valid variable cyber coordinate associated with the permanent identifier;

changing the variable cyber coordinate; and

repeating the determining and enabling steps to at least one of maintain uninterrupted communications with the communications device or object and maintain communications capabilities with the communications device or object.

2. The method of claim 1, further comprising:

changing the valid variable cyber coordinate on a regular or irregular basis; and

providing the changed valid variable cyber coordinate to devices or objects authorized to communicates with the communications device or objects based on the permanent identifier.

3. The method of claim 1, wherein the communications device or object is a telephony device in a telephony communications system, the variable cyber coordinate is based on a telephone number of the telephony device, and the permanent identifier is based on a name of a user of the telephony device.

4. The method of claim 1, further comprising not responding to the communication attempt, with the communications device or objects, based on the permanent identifier, if the received identifier is not the valid variable cyber coordinate associated with the permanent identifier.

5. The method of claim 1, wherein the communications device or object is a computer file in a computer network.

6. The method of claim 1, wherein the communications device or object is a database within a computer network.

7. The method of claim 1, wherein the variable cyber coordinate is based on an IP address of the communications device or object, and the permanent identifier is based on a DNS name of the communications device or object.

8. The method of claim 1, wherein the variable cyber coordinate is based on a port identifier of the communications device or object, and the permanent identifier is based on a DNS name of the communications device or object.

9. The method of claim 1, further comprising:

protecting the communications device or object against intrusion, including;

granting access to the communications device or object, if the received identifier is the valid variable cyber coordinate associated with the permanent identifier; and

denying access to the communications device or object, if the received identifier is not the valid variable cyber coordinate associated with the permanent identifier.

10. The method of claim 1, further comprising generating the valid variable cyber coordinate associated with the permanent identifier.

11. The method of claim 1, wherein the communications device or object is a software device or object.

12. The method of claim 1, wherein the communications device or object is a hardware device or object.

13. The method of claim 1, wherein the variable cyber coordinate is based on a physical address of the communications device or object.

14. One or more computer systems configured to perform the steps recited in claim 1.

15. One or more devices or objects configured to perform the steps recited in claim 1.

16. A computer readable medium, including computer readable instructions configured to cause one or more processors to perform the steps recited in claim 1.

17. The method of claim 1, further comprising providing the valid variable cyber coordinate to devices or objects authorized to communicate, with the communications device or object, based on the permanent identifier.

18. The method of claim 17, further comprising:

storing the valid variable cyber coordinate as a user-inaccessible identifier in the devices or objects authorized to communicates with the communications device or object, based on the permanent identifier.

19. The method of claim 17, wherein the authorized devices or objects are software devices or objects.

20. The method of claim 17, wherein the authorized devices or objects are hardware devices or objects.

21. The method of claim 1, further comprising assigning a new valid variable cyber coordinate to the communications device or object, if the received identifier is not the valid variable cyber coordinate associated with the permanent identifier.

22. The method of claim 21, further comprising providing the new valid variable cyber coordinate to devices or objects authorized to communicate, with the communications device or object, based on the permanent identifier.

23. The method of claim 21, further comprising:

permitting a predetermined number of attempts to communicate with the communications device or object with a received identifier, before assigning the new valid variable cyber coordinate, and

enabling a communication with the communications device or object, if during the predetermined number of attempts a received identifier is the valid variable cyber coordinate associated with the permanent identifier.

24. The method of claim 1, further comprising assigning a plurality of valid variable cyber coordinates associated with the permanent identifier to the communications device or object.

25. The method of claim 24, further comprising providing the plurality of the valid variable cyber coordinates to devices or objects authorized to communicate, with the communications device or objects based on the permanent identifier.

26. The method of claim 24, further comprising

determining if identifiers, received during a communication attempt, with the communications device or object, based on the permanent identifier, are the plurality of the valid variable cyber coordinates associated with the permanent identifier;

enabling a communication with the communications device or object, if the received identifiers are the valid variable cyber coordinates associated with the permanent identifier; and

not enabling a communication with the communications device or object, if the received identifiers are not the valid variable cyber coordinates associated with the permanent identifier.

27. The method of claim 24, further comprising:

changing the valid variable cyber coordinates on a regular or irregular basis; and

providing the changed valid variable cyber coordinates to devices or objects authorized to communicates with the communications device or objects based on the permanent identifier.

28. The method of claim 17, wherein the communications device or object is a host computer in a computer network, and the devices or objects authorized to communicates, with the host computer, based on the permanent identifier are authorized computers.

29. The method of claim 28, further comprising:

changing the valid variable cyber coordinate for the host computer on a regular or irregular basis; and

providing the changed valid variable cyber coordinate to the authorized computers.

30. The method of claim 28, further comprising providing the authorized computers with the permanent identifier, including a user-accessible address for the host computer, and which is used by the authorized computers to activate and transmit the valid variable cyber coordinate to the host computer when the authorized computers initiate access, to the host computer, based on the permanent identifier.