Apparatus, methods and articles of manufacture for securing computer networks

• US 7,661,134 B2
• Filed: 12/21/2001
• Issued: 02/09/2010
• Est. Priority Date: 12/21/2001
• Status: Expired due to Fees

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Radatti, Peter V.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Assistant Examiner(s): Moise, Emmanual L
• Application Number:
  US10/032,251
• Publication Number:
  US 20030120953A1
• Time in Patent Office: 2,972 Days
• Field of Search: 713/201, 726/22, 726/11, 726/26
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Apparatus, methods, and articles of manufacture are claimed for securing, maintaining, monitoring and controlling computer networks and clients located therein by use of client hash code tables, which are stored on a server. Clients subsequently provide client state codes which are compared to the hash code tables to ensure only acceptable client modifications have taken place. In the event of unacceptable client modifications, mechanisms are used to notify appropriate resources.

Claims

1. A method for securing, maintaining, monitoring and controlling computer networks and clients located therein, comprising:

providing a hash code table of a client said hash code table being provided for storing a plurality of files;

providing a client state code of a client;

comparing said client state code to said hash code table, and generating an alert mechanism when a deviation threshold is reached based on a deviation between said hash code table values for said client and said client state code;

wherein said hash code table includes the hash codes for files on computers within the network that are to be secured;

the method further including;

transmitting across a network from clients located in the network a client state code;

providing at least one server within the network assigned to recognize said client state code transmission,

wherein said server maintains a baseline for said client, and

wherein said baseline comprises said hash code table of a said client;

wherein the step of providing a hash code table of a network device further comprises providing a secure hash code table;

wherein the step of providing a secure hash code table further comprises generating a secure hash code table; and

wherein the step of generating a secure hash code table further comprises generating a secure hash code table using at least one compiled client hash value, wherein said compiled client hash value is generated by;

providing a secure system state data file;

grouping said secure system data file into one or more groups; and

, extracting the modal hash value from any of said groups.

2. A method as in claim 1 further comprising the step of reporting the results of said comparison.

3. A method as in claim 1 further comprising the step of logging the results of said comparison.

4. A method as in claim 1 further comprising the step of securing a client in lock down mode.

5. A method as in claim 1 further comprising the step of initiating a client status mechanism.

6. A method as in claim 1 further comprising the step of initiating an Auto Restore component.

7. A method as in claim 1 wherein the step of providing a client state code further comprises generating a client state code.

8. The method of claim 1, wherein said clients within said network are identical clients, and wherein said client state codes of the said identical clients are identical.

9. The method of claim 1, wherein said clients within said network have one or more files present thereon which are common to one or more clients on said network, said files,

wherein said hash code table includes file names and hash codes which are concatenated and stored in said table.

10. The method of claim 1, wherein said method involves initiating a client process from a computer, and wherein providing a hash code table of a client comprises providing a hash code table for the computer from which the client process was initiated.

11. The method of claim 1, wherein the client state code is transmitted along with authentication.

12. A computer storage component including software containing the hash code table generated by a method for securing, maintaining, monitoring and controlling computer networks and clients located therein, comprising:

providing a hash code table of a client said hash code table being provided for storing a plurality of files;

providing a client state code of a client;

comparing said client state code to said hash code table, and generating an alert mechanism when a deviation threshold is reached based on a deviation between said hash code table values for said client and said client state code;

wherein said hash code table includes the hash codes for files on computers within the network that are to be secured;

the method further including;

transmitting across a network from clients located in the network a client state code;

providing at least one server within the network assigned to recognize said client state code transmission,

wherein said server maintains a baseline for said client, and

wherein said baseline comprises said hash code table of a said client;

wherein the step of providing a hash code table of a network device further comprises providing a secure hash code table;

wherein the step of providing a secure hash code table further comprises generating a secure hash code table; and

wherein the step of generating a secure hash code table further comprises generating a secure hash code table using at least one compiled client hash value, wherein said compiled client hash value is generated by;

providing a secure system state data file;

grouping said secure system data file into one or more groups; and

, extracting the modal hash value from any of said groups.

13. The computer storage component of claim 12,

wherein the step of generating a secure hash code table further comprises generating a secure hash code table using at least one compiled client hash value.

14. The computer storage component of claim 12,

wherein the stop of generating a secure hash code table further comprises generating a secure hash code table using at least one exemplary system.

15. The computer storage component of claim 12,

wherein the step of generating a secure hash code table further comprises generating a secure hash code table using at least one baseline secure value.

16. A method for securing, maintaining, monitoring and controlling computer networks and clients located therein, comprising:

providing a hash code table of a client on at least one storage component of a computer network device or client;

providing a client state code of a client on at least one storage component of a computer network device or client;

comparing said client state code to said hash code table, wherein said hash code table is operable for one or more client platforms;

wherein providing a hash code table includes gathering baseline values to define modal values and generating said hash code table using said defined modal values,

wherein each of said clients uses the same or different operating platform as another of said client, and wherein regardless of the operating platform used by a said client, said client state code is compared to said generated hash code table.

17. A method for securing, maintaining, monitoring and controlling computer networks and clients located therein, comprising:

providing a network of computing components, including at least a plurality of clients, and at least one server;

providing a hash code table of a client said hash code table being provided for storing a plurality of files;

providing a client state code of a client;

comparing said client state code to said hash code table, and generating an alert mechanism when a deviation threshold is reached based on a deviation between said hash code table values for said client and said client state code;

wherein said hash code table includes the hash codes for files on computers within the network that are to be secured;

the method further including;

transmitting across a network from clients located in the network a client state code;

providing at least one server within the network assigned to recognize said client state code transmission,

wherein said server maintains a baseline for said client, and

wherein said baseline comprises said hash code table of a said client;

wherein the step of providing a hash code table of a network device further comprises providing a secure hash code table;

wherein the step of providing a secure hash code table further comprises generating a secure hash code table; and

wherein the step of generating a secure hash code table further comprises generating a secure hash code table using at least one compiled client hash value, wherein said compiled client hash value is generated by;

providing a secure system state data file;

grouping said secure system data file into one or more groups; and

, extracting the modal hash value from any of said groups.

18. A computer storage component including software containing the hash code table generated by a method for securing, maintaining, monitoring and controlling computer networks and clients located therein, comprising:

providing a network of computing components, including at least a plurality of clients, and at least one server;

providing a hash code table of a client said hash code table being provided for storing a plurality of files;

providing a client state code of a client;

comparing said client state code to said hash code table, and generating an alert mechanism when a deviation threshold is reached based on a deviation between said hash code table values for said client and said client state code;

wherein said hash code table includes the hash codes for files on computers within the network that are to be secured;

the method further including;

transmitting across a network from clients located in the network a client state code;

providing at least one server within the network assigned to recognize said client state code transmission,

wherein said server maintains a baseline for said client, and

wherein said baseline comprises said hash code table of a said client;

wherein the step of providing a hash code table of a network device further comprises providing a secure hash code table;

wherein the step of providing a secure hash code table further comprises generating a secure hash code table; and

wherein the step of generating a secure hash code table further comprises generating a secure hash code table using at least one compiled client hash value, wherein said compiled client hash value is generated by;

providing a secure system state data file;

grouping said secure system data file into one or more groups; and

, extracting the modal hash value from any of said groups.

19. A method for securing, maintaining, monitoring and controlling computer networks and clients located therein, comprising:

providing a network of computing components, including at least a plurality of clients, and at least one server;

providing a hash code table of a client on at least one storage component of a computer network device or client;

providing a client state code of a client on at least one storage component of a computer network device or client;

comparing said client state code to said hash code table, wherein said hash code table is operable for one or more client platforms;

wherein providing a hash code table includes gathering baseline values to define modal values and generating said hash code table using said defined modal values,

wherein each of said clients uses the same or different operating platform as another of said client, and wherein regardless of the operating platform used by a said client, said client state code is compared to said generated hash code table.