Internet site authentication service

• US 7,475,425 B2
• Filed: 10/04/2007
• Issued: 01/06/2009
• Est. Priority Date: 11/18/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Mastrianni, Steven J., Chefalas, Thomas E., Bantz, David F.
• Primary Examiner(s): Lanier; Benjamin E
• Application Number:
  US11/867,545
• Publication Number:
  US 20080028465A1
• Time in Patent Office: 460 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The authenticity of a website is tested with software that runs on a personal computing device and a service that is provided via the Internet. The software on the personal computing device is in the form of a proxy, or transparent component in the Internet Protocol implementation. The proxy receives all outbound messages, analyzes them and forwards or modifies them without the user'"'"'s intervention. The service tests the IP address and/or the behavior of the target website.

Claims

1. A system for automatic detection of masquerading websites, wherein an Internet Domain Name Service (DNS) server returns an address of the masquerading website to a requester device due to a prior DNS server attack whereby one or more Internet Domain Name Service (DNS) table entries that map Universal Resource Locators (URLs) to Internet Protocol addresses have been changed, said system comprising:

an authentication server for performing a test on a target website'"'"'s IP address and behavior, said testing performed by said authentication server including;

first testing a both a domain name and an Internet address of a requested web-site against a list of domain name and Internet address pairs maintained by the authentication server to determine whether the pair is valid; and

, second testing a status of a requested site as maintained by the authentication server, said second testing conducted on the domain name of the requested site wherein said authentication server maintains a status list including a list of domain names, each with an associated status, said second testing to ensure the authentication server itself maintains a correct mapping of domain name and Internet address; and

a plurality of workstations, each said plurality of workstations including a program for alerting an Internet user of said masquerading web sites based upon said test, wherein said program compares said behavior of said target website'"'"'s IP address and behavior with a criterion for acceptability, said criterion for acceptability verifying that the response capacity of said target website is greater than a threshold value.