Method and device for detecting computer intrusion

• US 7,797,744 B2
• Filed: 06/17/2003
• Issued: 09/14/2010
• Est. Priority Date: 06/17/2002
• Status: Expired due to Fees

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property II LP (AT&T, Inc.)
• Inventors: Hall, Robert J.
• Primary Examiner(s): PATEL, NIRAV B
• Application Number:
  US10/463,817
• Publication Number:
  US 20040064732A1
• Time in Patent Office: 2,646 Days
• Field of Search: 713187-194, 713150-155, 726 22- 25, 709223-225, 709217-219, 709/229, 717/127, 717/176, 717/177, 717/124, 717/126, 705/51, 705/52
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method and device for detecting intrusion on a computer system utilizes a target server running software that is executed for a client only upon receiving authorization from a monitoring server to execute the software. When an attempt to execute software on the target server by a client is not authorized, monitoring server notifies the system administrator of the unauthorized attempt.

Claims

1. A method for computer intrusion detection on a computer system including a target server accessible by a client and administered by a system administrator capable of authorizing attempts to execute software on the target server, a client and a monitoring server coupled to the target server, the method comprising steps of:

running on the target server a monitored latent software performing a latent software function upon successful completion of authorization by the monitoring server;

creating, via the system administrator, an authorization on the monitoring server prior to an attempt to execute the monitored latent software, wherein the authorization comprises an authorized client and a time interval;

receiving the attempt to execute the monitored latent software on the target server from the client, wherein said client is located remotely from said target server and said monitored latent software is monitored by the monitoring server that is physically separated from the target server and the client;

sending a query from the target server to the monitoring server to receive authorization to execute the monitored latent software;

after sending the query, suspending execution of the monitored latent software until a response is received by the target server from the monitoring server;

determining by the monitoring server whether the client is authorized to execute the monitored latent software by determining that the client is the authorized client and the attempt occurs during the time interval in the authorization; and

sending a message to the system administrator indicating detection of an intrusion when the attempt to execute the monitored latent software is not authorized, wherein the monitored latent software includes an implementing subroutine for performing the latent software function and a nested authorization subroutine for determining if the attempt to access the monitored latent software is authorized, wherein the implementing subroutine is resident entirely on the target server and the authorization subroutine includes a portion resident on the target server and a portion resident on the monitoring server.

2. The method of claim 1 wherein the portion of the authorization subroutine on the target server using a query queries the monitoring server and the monitoring server using a response responds to the query during the determination step.

3. The method of claim 2 wherein the query and response are secure.

4. The method of claim 2 including the step of signing the response.

5. The method of claim 2 including the step of signing the query.

6. The method of claim 3 including the step of encrypting the query.

7. The method of claim 2 including the step of signing and encrypting the query and response.