Method and system for detecting and preventing an intrusion in multiple platform computing environments

• US 7,093,291 B2
• Filed: 01/28/2002
• Issued: 08/15/2006
• Est. Priority Date: 01/28/2002
• Status: Active Grant

• Current Assignee: Ronn H. Bailey
• Original Assignee: Ronn H. Bailey
• Inventors: Bailey, Ronn H.
• Primary Examiner(s): Louis-Jacques, Jacques H.
• Assistant Examiner(s): Simitoski, Michael J.
• Application Number:
  US10/057,157
• Publication Number:
  US 20030145224A1
• Time in Patent Office: 1,660 Days
• Field of Search: 713/183, 713/202, 726/23, 726/8
• US Class Current: 726/23
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method and a system by which to achieve authentication intrusion detection so as to effectively detect and prevent unauthorized access to and use of a local computer system, or the like, and take appropriate measures. The local system authentication process is redirected to an authenticator broker system (i.e. a secondary authentication system) that makes use of the local system authentication process paths and the local system authenticator file. The authenticator broker system includes an authenticator broker system file having stored therein secret authenticators of prospective users, a mapping file to assign a replacement identifier for the identifier entered by a particular user at the local system and redirected to the secondary system, and a decoy authenticator file to assign a decoy authenticator for the secret authenticator entered by the user and originally stored in the local system authentication file. It is the decoy authenticator that is captured and unknowingly used by the intruder to give away his or her presence. By way of example, the authenticator broker system may be a mainframe computer that is responsible for authentication and access control with respect to a local computer system.

Claims

1. An authentication intrusion detection system responsive to an attempted intrusion into a local computer system to which access is gained by prospective users entering a personal identifier followed by a secret authenticator, said authentication intrusion detection system comprising:

a local computer system authenticator file communicating with said local computer system and having stored therein the secret authenticators corresponding to the personal identifiers entered by prospective users;

an authenticator broker system to intercept and redirect the identifier and secret authenticator of a prospective user from the local computer system;

an authenticator broker file communicating with said authenticator broker system and having stored therein the secret authenticators corresponding to the personal identifiers entered by the prospective users at the local computer system and stored in the local computer system authenticator file, whereby a prospective user can gain access to the local computer system when the authenticator entered by the prospective user matches the authenticator stored in said authenticator broker file; and

a decoy authenticator file communicating with the authenticator broker system to assign a decoy authenticator for the secret authenticator entered by the prospective user at the local computer system and stored in the local computer system authenticator file, wherein said decoy authenticator file is a mapping file and wherein a replacement identifier is randomly assigned by said mapping file for the identifier entered by the prospective user and intercepted by said authenticator broker system.

2. The authentication intrusion detection system recited in claim 1, wherein said replacement identifier assigned by said mapping file for the identifier entered by the prospective user and intercepted by said authenticator broker system is unique to the prospective user.

3. The authentication intrusion detection system recited in claim 1, wherein said replacement identifier assigned by said mapping file for the identifier entered by the prospective user and intercepted by said authenticator broker system is unknown to the prospective user.

4. The authentication intrusion detection system recited in claim 1, wherein said authenticator broker system is a host computer that is responsive to the prospective user'"'"'s attempt to gain access to the local computer system and to any intrusion into the local computer system.

5. The authentication intrusion detection system recited in claim 4, wherein said host computer is a mainframe computer.

6. The authentication intrusion detection system recited in claim 5, further comprising a mapping file communicating with the authenticator broker system to assign said replacement identifier stored in said mapping file for the identifier entered by the prospective user at the local computer system and intercepted by said authenticator broker system, said authenticator broker system, said mapping file and said decoy authenticator file being located at said mainframe host computer.

7. A method for detecting a compromise by an intruder to a local computer system that requires authorized users to log onto the local computer system by means of successfully entering a personal identifier and a secret authenticator for purposes of user authentication, said method comprising the steps of:

intercepting the secret authenticator entered by the authorized user at the local computer system and forwarding the secret authenticator to an authenticator broker system;

transmitting from the authenticator broker system to the local computer system a decoy password in substitution of the secret authenticator of the authorized user; and

logging the authorized user onto the local computer system on the basis of the decoy password transmitted to the local computer system from the authenticator broker system;

whereby an intruder who breaks into the local computer system will capture and enter the authorized user'"'"'s personal identifier and the decoy password substituted for the authorized user'"'"'s secret authenticator to be forwarded to the authenticator broker system by which to provide an indication that the local computer system has been compromised, and

wherein the authorized user accesses a plurality of local computer systems, each local computer system being identified in a system identifier mapped to each decoy password and secret authenticator, and wherein the identification of a compromised local computer system is determined by the system identifier thereof.

8. The method recited in claim 7, including the additional step of storing the decoy password in an authenticator file of each of said local computer system and said authenticator broker system.

9. The method recited in claim 7, including the additional step of maintaining the decoy password in secrecy from the authorized user.

10. A method for detecting unauthorized access and an intrusion into a local computer to which access is gained by a user signing on with a local identifier and a secret authenticator to identify himself to the local computer, said method comprising the steps of:

transmitting the user'"'"'s local identifier and secret authenticator to an authentication broker system and associating the secret authenticator with a corresponding mapped identifier stored on the authentication broker system;

verifying on the authentication broker system the mapped identifier with the secret authenticator to authenticate the user;

retrieving a decoy authenticator and returning the decoy authenticator and the verification of the user to the local computer;

assigning a random replacement identifier for the local identifier entered by the user during sign on; and

associating the decoy authenticator with the local identifier at the local computer.

11. The method recited in claim 10, wherein said authentication broker is located on a host computer that is remote from the local computer system.

12. The method recited in claim 11, wherein said remote host computer is a mainframe computer.