Network security system and method

• US 7,930,745 B2
• Filed: 04/28/2003
• Issued: 04/19/2011
• Est. Priority Date: 05/03/2002
• Status: Active Grant

• Current Assignee: Ko-Cheng Fang
• Original Assignee: Ko-Cheng Fang
• Inventors: Fang, Ko-Cheng
• Primary Examiner(s): Lanier; Benjamin E
• Application Number:
  US10/425,537
• Publication Number:
  US 20030208694A1
• Time in Patent Office: 2,913 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls

Abstract

A network security system and method for reacting to unauthorized data access in an inner data system by combining a redirect system is described. The examples of the redirect system include modified firewalls, IP sharing devices and gateways with examining mechanism. A user request is transmitted to the inner data system via the redirect system if the user request satisfies a certain safety condition. Otherwise, the user request is transmitted to a reaction system which provides virtual data similar to real data so that unauthorized users have the illusion of successfully hacking the inner data system. Meanwhile, the illegal activities are recorded and certain programs like Trojan programs can be used for executing reactions.

Claims

1. A network security system for controlling access to an inner data system, said network security system comprising:

an examination module for receiving a user access request to enter the inner data system, the user access request including a user name and password, checking the validity of the user name and password by the examination module, and generating an examination result that includes control instructions generated as a function of said checking;

a redirect system for receiving and executing the control instructions generated by the examination module, wherein the control instructions will instruct the redirect system to transfer the user into the inner data system if the examination result shows that the user name and password are valid; and

a reaction system for receiving the user access request from the redirect system when the examination result shows that the password is not valid, the reaction system being configured to respond to the user access request by providing response content which includes virtual data that has the same format as information contained within the inner data system,

wherein the reaction system is further configured to record at least one successive action after the response content is transmitted from the reaction system,

wherein the reaction system is further configured to execute one or more reaction programs designed to trace the IP address from which the user access request originated, and to send a Trojan code to the IP address from which the user access request originated, and

wherein users are permitted only a limited number of attempts for the password, and according to the number of attempts at the password, the redirect system will direct an authorized user to an operating system associated with the inner data system and will direct an unauthorized user to the redirect system.

2. The network security system of claim 1,

wherein the user access request includes an identification code, which identifies a device from which the user access request originates, and

wherein the redirect system will transfer the user into the reaction system if a plurality of user access requests included the same identification code and used invalid user passwords.

3. The network security system of claim 1, wherein the network security system starts a hacking prevention procedure before an intruder starts modifying real data that is stored in the inner data system.

4. The network security system of claim 1, wherein the examination module is provided in the inner data system.

5. A network security system for controlling access to an inner data system, said network security system comprising:

an examination module for receiving a user access request to enter the inner data system, the user access request including an identification code that identifies a device from which the user access request originated and also including a password, the examination module checking the validity of the password and generating an examination result that includes control instructions generated as a function of said determination;

a redirect system for receiving and executing the control instructions generated by the examination module, wherein the control instructions will instruct the redirect system to transfer the user into the inner data system if the examination result indicates that the password is valid; and

a reaction system for receiving the user access request from the redirect system when the control instructions indicate that a predetermined plural number of user access requests included the same identification code and incorrect passwords, the reaction system being configured to include virtual data that has the same format as information contained within the inner data system,

wherein users are permitted only a limited number of attempts for the password, and according to the number of attempts at the password, the redirect system will direct an authorized user to an operating system associated with the inner data system and will direct an unauthorized user to the redirect system and send a Trojan code to the unauthorized user.

6. The network security system of claim 5, wherein the reaction system is further configured to record at least one action conducted by an unauthorized user whose user access request has been received by the reaction system.

7. The network security system of claim 5, wherein the examination module is provided in the inner data system.

8. A network security system for controlling access to an inner data system, said network security system comprising:

a reaction system that includes virtual data that has the same format as information contained within the inner data system;

an examination module for receiving a user access request to enter the inner data system, the user access request including an identification code that identifies a device from which the user access request originated and also including a password, the examination module checking the validity of the password and generating an examination result that includes control instructions generated as a function of said determination; and

a redirect system for receiving and executing the control instructions generated by the examination module,

wherein the control instructions will instruct the redirect system to transfer the user access request to the inner data system if the examination result indicates that the password is valid or to transfer the user access request to the reaction system and send a Trojan code to the device from which the user access request originated if the control instructions indicate that a predetermined plural number of user access requests included the same identification code and incorrect passwords.

9. The network security system of claim 8, wherein the reaction system is further configured to record at least one action conducted by an unauthorized user whose user access request has been received by the reaction system.

10. The network security system of claim 8, wherein the examination module is provided in the inner data system.