Method, system, and computer program product for security within a global computer network

• US 7,624,110 B2
• Filed: 12/11/2003
• Issued: 11/24/2009
• Est. Priority Date: 12/13/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Smith, Todd Allen, Loiodice, Luca, Alagna, Michael Anthony, Payne, Charles Andrew
• Primary Examiner(s): LEWIS, CHERYL RENEA
• Application Number:
  US10/733,655
• Publication Number:
  US 20040123157A1
• Time in Patent Office: 2,175 Days
• Field of Search: 707/3, 707/10, 707100-1041, 707/9, 713/152, 713/155, 713/166, 715/234, 715/205
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2127 Bluffing
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

In a first embodiment, an information handling system determines whether a resource is likely misrepresented as a trusted resource within a global computer network. In a second embodiment, the information handling system outputs an indication of whether a resource within a global computer network is recognized as a known trusted resource.

Claims

1. A tangible computer-readable memory medium storing program instructions within a security program that are executable on an information handling system to:

receive data from an external network coupled to the information handling system, wherein the received data includes a first set of data for a web page;

analyze the first set of data to make a determination whether the first set of data indicates that it is from a first source coupled to the external network, but is actually from a second source coupled to the external network, wherein the determination is based, at least in part, on an age of the first set of data;

upon the determination that the first set of data is actually from the second source, provide output from the information handling system indicative of the determination.

2. The tangible computer-readable memory medium of claim 1, wherein the first set of data includes information indicating that it is from a source trusted by a user of the information handling system.

3. The tangible computer-readable memory medium of claim 2, wherein the first set of data is intended to cause the user to supply confidential information to a source other than the trusted source.

4. The tangible computer-readable memory medium of claim 3, wherein the confidential information is financial information of the user.

5. The tangible computer-readable memory medium of claim 3, wherein the confidential information is login information of the user.

6. The tangible computer-readable memory medium of claim 1, further comprising program instructions within the security program that are executable on the information handling system to block display of the web page by the information handling system upon the determination that the first set of data is actually from the second source.

7. The tangible computer-readable memory medium of claim 1, wherein the output from the information handling system is provided by the security program to a user of the information handling system that requested the web page.

8. The tangible computer-readable memory medium of claim 1, wherein the output from the information handling system is provided by the security program via a network to a security provider.

9. A method, comprising:

a security program on a first computing device receiving a web page via a wide-area network, wherein the web page includes information indicating that its origin is a first source that is trusted by a user of the first computing device;

the security program on the first computing device sending data that is requested by the web page to the origin of the web page;

the security program on the first computing device analyzing the origin'"'"'s response to the sent data to make a determination whether the origin of the web page is the first source; and

upon the determination that the origin of the web page is not the first source, providing output from the first computing device that is indicative of the determination.

10. The method of claim 9, wherein the web page solicits confidential information from the user.

11. The method of claim 9, further comprising the security program blocking display of the web page by the first computing device upon the determination that the origin of the web page is not the first source.

12. The method of claim 9, wherein the output is provided to a user of the first computing device that requested the web page.

13. The method of claim 9, wherein the output is provided via a network to a security provider.

14. A method, comprising:

a security program on a computing device making a determination of the likelihood that a web page received via a computer network is misrepresented as being from a trusted source, including;

the security program analyzing a layout of the received web page;

the security program determining that the layout of the received web page is similar to a layout of a known mistrusted web page;

upon determining that the layout of the received web page is similar to the layout of the known mistrusted web page, the computing device providing output indicative of the likelihood that the received web page is misrepresented as being from the trusted source.

15. The method of claim 14, wherein said making said determination further includes the security program determining whether the web page'"'"'s markup language contains the trusted source'"'"'s name or logo and whether the web page has the same organization of content as the trusted source.

16. The method of claim 14, further comprising the security program blocking display of the web page by the computing device upon determining that the layout of the received web page is similar to the layout of the known mistrusted web page.

17. The method of claim 14, wherein the output is provided to a user of the computing device that requested the web page.

18. The method of claim 14, wherein the output is provided via a network to a security provider.

19. A method, comprising:

a security program on a computing device making a determination of the likelihood that a web page received via a computer network is misrepresented as being from a trusted source, wherein the determination is based on one or more of the following criteria;

an age of the web page, a size of the web page, a number of hyperlinks to the web page from trusted sources; and

the computing device providing output indicative of the determination.

20. The method of claim 19, wherein the determination is based, at least in part, on the age of the web page and the size of the web page.

21. The method of claim 19, wherein the determination is based, at least in part, on the age of the web page and the number of hyperlinks to the web page from trusted sources.

22. The method of claim 19, further comprising the security program blocking display of the web page by the computing device upon determining that the web page is likely misrepresented as being from the trusted source.

23. The method of claim 19, wherein the output is provided to a user of the computing device that requested the web page.

24. The method of claim 19, wherein the output is provided via a network to a security provider.

25. A tangible computer-readable memory medium storing program instructions within a security program that are executable on a computing device to:

make a determination of the likelihood that a web page received via a computer network is misrepresented as being from a trusted source coupled to the computer network, including;

analyzing a layout of the received web page;

determining that the layout of the received web page is similar to a layout of a known mistrusted web page;

upon determining that the layout of the received web page is similar to the layout of the known mistrusted web page, provide output from the computing device indicative of the likelihood that the received web page is misrepresented as being from the trusted source.

26. The tangible computer-readable memory medium of claim 25, further comprising program instructions within the security program that are executable on the computing device to block display of the web page by the computing device upon determining that the layout of the received web page is similar to the layout of a known mistrusted web page.

27. The tangible computer-readable memory medium of claim 25, wherein the output from the computing device is provided by the security program to a user of the computing device that requested the web page.

28. The tangible computer-readable memory medium of claim 25, wherein the output from the computing device is provided by the security program via a network to a security provider.

29. A tangible computer-readable memory medium storing program instructions within a security program that are executable on a computing device to:

make a determination of the likelihood that a web page received at the computing device from a computer network is misrepresented as being from a trusted source, wherein the determination is based on one or more of the following criteria;

an age of the web page, a size of the web page, a number of hyperlinks to the web page from known trusted sources; and

provide output from the computing device indicative of the determination.

30. The tangible computer-readable memory medium of claim 29, further comprising program instructions within the security program that are executable on the computing device to block display of the web page by computing device upon determining that the web page is likely misrepresented as being from the trusted source.

31. The tangible computer-readable memory medium of claim 29, wherein the output from the computing device is provided by the security program to a user of the computing device that requested the web page.

32. The tangible computer-readable memory medium of claim 29, wherein the output from the computing device is provided by the security program via a network to a security provider.

33. A tangible computer-readable memory medium storing program instructions within a security program that are executable on a computing device to:

receive a web page via a wide-area network, wherein the web page includes information indicating that its origin is a first source that is trusted by a user of the computing device;

send data that is requested by the web page to the origin of the web page;

analyze the origin'"'"'s response to the sent data to make a determination whether the origin of the web page is the first source; and

upon the determination that the origin of the web page is not the first source, provide output from the computing device indicative of the determination.

34. The tangible computer-readable memory medium of claim 33, further comprising program instructions within the security program that are executable on the computing device to block display of the web page by the computing device upon the determination that the origin of the web page is not the first source.

35. The tangible computer-readable memory medium of claim 33, wherein the output from the computing device is provided by the security program to a user of the computing device that requested the web page.

36. The tangible computer-readable memory medium of claim 33, wherein the output from the computing device is provided by the security program via a network to a security provider.

37. A tangible computer-readable memory medium storing program instructions within a security program that are executable on an information handling system to:

receive data from an external network coupled to the information handling system;

analyze the received data to make a determination whether the received data indicates that it is from a first source coupled to the external network, but is actually from a second source coupled to the external network, and wherein the determination is based, at least in part, on a size of the received data;

upon the determination that the received data is actually from the second source, provide output from the information handling system indicative of the determination.

38. The tangible computer-readable memory medium of claim 37, wherein the received data is data for a first web page, and wherein the determination is based, at least in part, on the size of the first web page.

39. The tangible computer-readable memory medium of claim 37, further comprising program instructions within the security program that are executable on the information handling system to block display of the received data by the information handling system upon the determination that the received data is actually from the second source.

40. The tangible computer-readable memory medium of claim 37, wherein the output from the information handling system is provided by the security program to a user of the information handling system that requested the received data.

41. The tangible computer-readable memory medium of claim 37, wherein the output from the information handling system is provided by the security program via a network to a security provider.