System and method for preventing detection of a computer connection to an external device

• US 7,152,239 B1
• Filed: 07/14/2000
• Issued: 12/19/2006
• Est. Priority Date: 07/14/1999
• Status: Expired due to Term

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Lyle, Michael P., Ross, Robert F., Maricondo, James R.
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US09/616,469
• Time in Patent Office: 2,349 Days
• Field of Search: 713/161, 713/180, 713/200, 713/201, 380/28, 380/30, 709/220, 709/229
• US Class Current: 726/3
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A system and method are disclosed for preventing detection of a computer connection to an external device. The external device is connected to the computer via a connectionless port. A key to be used to generate valid authorization information to be included in all valid data packets sent between the computer and the external device is provided. The external device is configured to reply to any packet in which the required valid authorization information is not present with the packet that would be sent if the connectionless port were not in use.

Claims

1. A method for preventing a remote user of a computer from discovering that the computer is in communication with an external device, comprising:

connecting the external device to the computer via a connectionless port;

providing a key to be used to generate valid authorization information to be included in all valid data packets sent between the computer and the external device; and

configuring the external device to reply to any packet in which the required valid authorization information is not present with the packet that would be generated by the computer in response to an attempt to communicate via the connectionless port at a time when no device was connected to the connectionless port.

2. The method of claim 1 wherein the port is a user datagram protocol (UDP) port.

3. The method of claim 1 further comprising using the computer to generate the key and sending the key to the external device.

4. The method of claim 1 wherein the packet that would be generated by the computer is the Internet Control Message Protocol (ICMP) packet that would be sent if the port were not in use.

5. The method of claim 1 wherein the external device is a second computer.

6. A system for preventing a remote user of a computer from discovering that the computer is in communication with an external device, comprising:

a computer having a connectionless port; and

an external device connected to the connectionless port;

wherein the external device is configured to reply to any packet received via the connection to the connectionless port in which valid authorization information is not present with the packet that would be generated by the computer in response to an attempt to communicate via the connectionless port at a time when no device was connected to the connectionless port.

7. A computer program product for preventing a remote user of a computer from discovering that the computer is in communication with an external device connected to the computer via a connectionless port, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

providing a key to be used to generate valid authorization information to be included in all valid data packets sent between the computer and the external device; and

causing the external device to reply to any packet in which the required valid authorization information is not present with the packet that would be generated by the computer in response to an attempt to communicate via the connectionless port at a time when no device was connected to the connectionless port.