Secure notification on networked devices

• US 8,839,433 B2
• Filed: 11/18/2010
• Issued: 09/16/2014
• Est. Priority Date: 11/18/2010
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: O'Reirdan, Michael, Livingood, Jason
• Primary Examiner(s): Nalven, Andrew
• Assistant Examiner(s): Doan, Huan V
• Application Number:
  US12/949,080
• Publication Number:
  US 20120131672A1
• Time in Patent Office: 1,398 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4753 for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08
• CPC Class Codes: H04N 21/4882 for displaying messages, e.g. warnings, reminders arrangements for providing short real-time information to substation in data switching networks H04L12/1895
• CPC Class Codes: H04N 21/64322 IP

Abstract

A system, device and method to securely notify a user of a compromise of a device are provided. The system, device and method may include a detection device adapted for determining a compromise of the device communicatively coupled to the first path, a user database including at least information regarding the device and other devices associated with the user, and the secure signal path to at least one of the other devices.

Claims

1. A method, comprising:

detecting one or more instances of malware on a first device;

identifying a second device associated with a user of the first device;

generating, by a device associated with a trusted party, a notification indicating detection of the one or more instances of malware on the first device, the notification comprising confirmation information that the user may utilize to access information associated with the notification via the first device, and one or more recommended remedial actions for removing the one or more instances of malware from the first device;

sending the notification to the second device;

receiving a user-inputted response from the first device; and

responsive to a determination that the user-inputted response corresponds to the confirmation information, providing access to the information associated with the notification.

2. The method of claim 1, wherein the confirmation information comprises a personal identification number, a challenge, or a Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA).

3. The method of claim 2, wherein the confirmation information comprises a personal identification number, and wherein the determination that the user-inputted response corresponds to the confirmation information comprises determining that the user-inputted response matches the personal identification number.

4. The method of claim 2, wherein the confirmation information comprises a challenge, and wherein the determination that the user-inputted response corresponds to the confirmation information comprises determining that the user-inputted response matches a predetermined response to the challenge.

5. The method of claim 2, wherein the confirmation information comprises a CAPTCHA, and wherein the determination that the user-inputted response corresponds to the confirmation information comprises determining that the user-inputted response matches a predetermined response to the CAPTCHA.

6. The method of claim 1, wherein identifying the second device comprises identifying the second device based on an Internet Protocol (IP) address associated with the first device, a telephone number associated with the first device, or a Media Access Control (MAC) address associated with the first device.

7. The method of claim 1, wherein the one or more instances of malware comprise a computer virus, a computer worm, a Trojan horse, a rootkit, a backdoor, spyware, adware, or crimeware.

8. The method of claim 1, wherein the first device comprises a desktop computer, a laptop computer, a tablet computer, or a smart phone.

9. The method of claim 1, wherein the second device comprises a video display device.

10. The method of claim 1, wherein the second device comprises a telephone or a smart phone, and wherein the notification comprises an automated telephone call or a Short Message Service (SMS) message.

11. The method of claim 1, wherein the notification comprises an image for display on the second device.

12. The method of claim 1, wherein the notification comprises one or more Uniform Resource Locator (URL) links corresponding to one or more recommended remedial actions for removing the one or more instances of malware from the first device.

13. The method of claim 1, wherein the notification comprises one or more registry entries associated with the one or more instances of malware or one or more files resident on the first device associated with the one or more instances of malware.

14. The method of claim 1, wherein detecting the one or more instances of malware on the first device comprises detecting the one or more instances of malware on the first device using emulation, signature-based detection, or heuristic-based detection.

15. The method of claim 1, wherein detecting the one or more instances of malware on the first device comprises comparing one or more files associated with the one or more instances of malware to one or more files submitted by users as potential instances of malware.

16. A method, comprising:

detecting, by at least one processor, one or more instances of malware on a first device;

sending, by a trusted party, a notification indicating detection of the one or more instances of malware on the first device to a second device associated with a user of the first device, wherein the notification comprises confirmation information that the user may utilize to access information associated with the notification via the first device, and one or more recommended remedial actions for removing the one or more instances of malware from the first device;

receiving a user-inputted response from the first device; and

responsive to a determination that the user-inputted response matches a predetermined response associated with the confirmation information, providing access to the information associated with the notification.

17. The method of claim 16, further comprising identifying the second device based on an Internet Protocol (IP) address associated with the first device, a telephone number associated with the first device, or a Media Access Control (MAC) address associated with the first device.

18. The method of claim 16, wherein the confirmation information comprises a personal identification number, a challenge, or a Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA).

19. The method of claim 16, wherein the one or more instances of malware comprise a computer virus, a computer worm, a Trojan horse, a rootkit, a backdoor, spyware, adware, or crimeware.

20. The method of claim 16, wherein the first device and the second device are each one of a set-top box, a desktop computer, a laptop computer, a tablet computer, or a smart phone, and wherein the first device is a different type of device from the second device.

21. A method, comprising:

identifying a video display device associated with a user of a computing device by a network address of the video display device;

sending, by a trusted party and to the video display device, a notification indicating detection of one or more instances of malware on the computing device, the notification comprising confirmation information that the user may utilize to access information associated with the notification via the computing device, and one or more recommended remedial actions for removing the one or more instances of malware from the computing device;

receiving a user-inputted response from the computing device; and

responsive to a determination that the user-inputted response matches a predetermined response associated with the confirmation information providing access to the information associated with the notification via the computing device.

22. The method of claim 21, wherein the confirmation information comprises a challenge, a personal identification number, or a Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA).

23. The method of claim 21, wherein identifying the video display device comprises identifying a set-top box.

24. The method of claim 21, wherein the one or more instances of malware comprise a computer virus, a computer worm, a Trojan horse, a rootkit, a backdoor, spyware, adware, or crimeware.

25. The method of claim 21, wherein the computing device and the video display device are each one of a set-top box, a desktop computer, a laptop computer, a tablet computer, or a smart phone, and wherein the computing device is a different type of device from the video display device.