Application for assisting in conducting covert cyber operations

• US 9,965,133 B1
• Filed: 07/18/2012
• Issued: 05/08/2018
• Est. Priority Date: 07/22/2011
• Status: Active Grant

• Current Assignee: Ntrepid, LLC
• Original Assignee: Ntrepid Corporation
• Inventors: Lindsey, Teddy, Adams, Benjamin, Dickun, Michael, Sobel, Brian
• Primary Examiner(s): Weber, Joy M
• Application Number:
  US13/551,712
• Time in Patent Office: 2,120 Days
• Field of Search: 715744
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 9/4451 User profiles; Roaming
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A covert application, including one or more modules can be provided to assist individuals in conducting covert cyber operations. Furthermore, the covert application can operate in a secure operating environment, which provides a reliable and protected computing environment from which a user can conduct cover cyber operations. The covert application can allow a user to create and utilize one or more personas. Personas created by the covert application can appear to originate from any part of the world, and personas can allow a user of the covert application to interact through various Internet services, such as email, instant messaging, online forums, and website browsing.

Claims

1. A method, comprising:

activating a persona within a covert application, wherein the persona comprises a persistent digital identity that represents a user'"'"'s presence on the Internet, wherein the covert application comprises a persona builder module user interface that displays a plurality of selectable buttons, and wherein the activating the persona further comprises clicking on one of a displayed build persona button or a developed persona button of the plurality of selectable buttons;

configuring one or more network environment attributes of the persona within the covert application;

configuring one or more operating system environment attributes of the persona within the covert application; and

configuring one or more application environment attributes of the persona within the covert application,

wherein the activating the persona further comprises configuring a locale for the persona, wherein the locale is a geographic location where the persona purports to be located, which is different from an actual geographic location of the persona where network traffic originates,

wherein the configuring the one or more network environment attributes of the persona is based on the locale that is configured for the persona, and

wherein the configuring the one or more network environment attributes comprises altering identifiers that comprise location information within one or more network packets transmitted by the covert application at a direction of the persona;

generating a communication within the covert application;

rerouting the network traffic of the communication to the purported geographic location that is different from the actual geographic location of the persona where the network traffic originates;

identifying an attempt to transmit the communication over a network connection;

scanning the communication and performing a unified check of the communication based on one or more rules;

transmitting the communication over the network connection, when the communication complies with the one or more rules; and

displaying a warning message, when the communication does not comply with the one or more rules,

wherein the one or more rules include a time rule, an email address rule, a cultural rule, or a persona rule.

2. The method of claim 1, wherein the activating the persona further comprises:

configuring an operating system for the persona; and

configuring an application for the persona.

3. The method of claim 2, wherein the configuring the one or more operating system environment attributes is based on the operating system that is configured for the persona.

4. The method of claim 2, wherein the configuring the one or more application environment attributes is based on the application that is configured for the persona.

5. The method of claim 2, wherein the application comprises a web browser.

6. The method of claim 1, wherein the configuring the one or more operating system environment attributes comprises altering identifiers of one or more operating system attributes associated with the persona.

7. The method of claim 1, wherein the configuring the one or more application system environment attributes comprises altering identifiers of one or more attributes for an application associated with the persona.

8. The method of claim 1, further comprising:

displaying a real-time visualization of geospatial data within a user interface of the covert application;

displaying a marker that indicates a locale of a persona associated with a user within the user interface of the covert application;

displaying persona information of the persona associated with the user within the user interface of the covert application; and

displaying one or more icons within the user interface of the covert application, wherein each icon initiates a module of the covert application.

9. The method of claim 1, further comprising:

displaying one or more active personas and one or more archived personas within a user interface of the covert application;

displaying one or more emails for the one or more active personas within the user interface of the covert application;

displaying one or more calendar entries for the one or more active personas within the user interface of the covert application;

displaying one or more contacts for the one or more active personas within the user interface of the covert application;

displaying one or more system messages for the one or more active personas within the user interface of the covert application.

10. The method of claim 1, further comprising:

displaying one or more locales within a user interface of the covert application and associating a selected locale with the persona;

displaying one or more geosites within the user interface of the covert application and associating a selected geosite with the persona;

displaying a persona identifier field within the user interface of the covert application and associating an entered persona identifier with the persona;

displaying one or more Internet services within the user interface of the covert application and associating the one or more selected Internet services with the persona; and

creating the persona within the covert application based on the selected locale, the selected geosite, the entered persona identifier, and the selected one or more Internet services.

11. The method of claim 1, further comprising:

browsing a web page within the covert application; and

automatically storing the browsed web page within a database of the covert application.

12. The method of claim 1, further comprising:

associating one or more email accounts with a persona of the covert application; and

displaying one or more emails from the one or more email accounts within a user interface of the covert application.

13. The method of claim 1, further comprising:

automatically storing data in a database within the covert application, wherein the stored data is identified as a journal entry;

retrieving the stored data from the database by selecting the journal entry from within a user interface of the covert application; and

displaying the stored data within the user interface of the covert application.

14. The method of claim 1, further comprising:

creating a contact within the covert application;

associating the contact with the persona;

creating a detail within the covert application;

associating the detail with the contact and with the persona;

storing the contact within a database of the covert application; and

displaying the contact within a user interface of the covert application.

15. The method of claim 1, further comprising:

creating one or more details that are associated with a persona within the covert application;

storing the one or more details within a database of the covert application;

displaying the one or more details within a user interface of the covert application;

accessing the one or more details from an integrated module of the covert application; and

utilizing the one or more details to perform functionality within the integrated module.

16. The method according to claim 1, wherein the generating the communication within the covert application further comprises:

providing at least one Internet application that is appropriate for a region containing the locale of the persona.

17. An apparatus, comprising:

a memory configured to store one or more modules, wherein the persona comprises a persistent digital identity that represents a user'"'"'s presence on the Internet;

a processor configured to execute the one or more modules stored on the memory,

wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

activate a persona within a covert application, wherein the persona comprises a persistent digital identity that represents a user'"'"'s presence on the Internet, wherein the covert application comprises a persona builder module user interface that displays a plurality of selectable buttons, and wherein the activating the persona further comprises clicking on one of a displayed build persona button or a developed persona button of the plurality of selectable buttons;

configure one or more network environment attributes of the persona within the covert application;

configure one or more operating system environment attributes of the persona within the covert application;

configure one or more application environment attributes of the persona within the covert application;

generate a communication within the covert application,

wherein the activating the persona further comprises configuring a locale for the persona, wherein the locale is a geographic location where the persona purports to be located, which is different from an actual geographic location of the persona where network traffic originates,

wherein the configuring the one or more network environment attributes of the persona is based on the locale that is configured for the persona, and

wherein the configuring the one or more network environment attributes comprises altering identifiers that comprise location information within one or more network packets transmitted by the covert application at a direction of the persona;

reroute the network traffic of the communication to the purported geographic location that is different from the actual geographic location of the persona where the network traffic originates;

identify an attempt to transmit the communication over a network connection;

scan the communication and performing a unified check of the communication based on one or more rules;

transmit the communication over the network connection, when the communication complies with the one or more rules; and

display a warning message, when the communication does not comply with the one or more rules,

wherein the one or more rules include a time rule, an email address rule, a cultural rule, or a persona rule.

18. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

display a real-time visualization of geospatial data within a user interface of the covert application;

display a marker that indicates a locale of a persona associated with a user within the user interface of the covert application;

display persona information of the persona associated with the user within the user interface of the covert application; and

display one or more icons within the user interface of the covert application, wherein each icon initiates a module of the covert application.

19. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

display one or more active personas and one or more archived personas within a user interface of the covert application;

display one or more emails for the one or more active personas within the user interface of the covert application;

display one or more calendar entries for the one or more active personas within the user interface of the covert application;

display one or more contacts for the one or more active personas within the user interface of the covert application;

display one or more system messages for the one or more active personas within the user interface of the covert application.

20. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

display one or more locales within a user interface of the covert application and associating a selected locale with the persona;

display one or more geosites within the user interface of the covert application and associating a selected geosite with the persona;

display a persona identifier field within the user interface of the covert application and associating an entered persona identifier with the persona;

display one or more Internet services within the user interface of the covert application and associating the one or more displayed Internet services with the persona; and

create the persona within the covert application based on the selected locale, the selected geosite, the entered persona identifier, and the selected one or more Internet services.

21. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

browse a web page within the covert application;

and

automatically store the browsed web page within a database of the covert application.

22. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

associate one or more email accounts with a persona of the covert application;

and

display one or more emails from the one or more email accounts within a user interface of the covert application.

23. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

automatically store data in a database within the covert application, wherein the stored data is identified as a journal entry;

retrieve the stored data from the database by selecting the journal entry from within a user interface of the covert application; and

display the stored data within the user interface of the covert application.

24. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

create a contact within the covert application;

associate the contact with the persona;

create a detail within the covert application;

associate the detail with the contact and with the persona;

store the contact within a database of the covert application; and

display the contact within a user interface of the covert application.

25. The apparatus of claim 17, wherein the processor is further configured, when executing the one or more modules stored on the memory, to,

create one or more details that are associated with a persona within the covert application;

store the one or more details within a database of the covert application;

display the one or more details within a user interface of the covert application;

access the one or more details from an integrated module of the covert application; and

utilize the one or more details to perform functionality within the integrated module.

26. A computer program, embodied on a non-transitory computer-readable medium, configured to control a processor to implement a method, the method comprising:

activating a persona within a covert application, wherein the persona comprises a persistent digital identity that represents a user'"'"'s presence on the Internet, wherein the covert application comprises a persona builder module user interface that displays a plurality of selectable buttons, and wherein the activating the persona further comprises clicking on one of a displayed build persona button or a developed persona button of the plurality of selectable buttons;

configuring one or more network environment attributes of the persona within the covert application;

configuring one or more operating system environment attributes of the persona within the covert application; and

configuring one or more application environment attributes of the persona within the covert application,

wherein the activating the persona further comprises configuring a locale for the persona, wherein the locale is a geographic location where the persona purports to be located, which is different from an actual geographic location of the persona where network traffic originates,

wherein the configuring the one or more network environment attributes of the persona is based on the locale that is configured for the persona, and

wherein the configuring the one or more network environment attributes comprises altering identifiers that comprise location information within one or more network packets transmitted by the covert application at a direction of the persona;

generating a communication within the covert application;

rerouting the network traffic of the communication to the purported geographic location that is different from the actual geographic location of the persona where the network traffic originates;

identifying an attempt to transmit the communication over a network connection;

scanning the communication and performing a unified check of the communication based on one or more rules;

transmitting the communication over the network connection, when the communication complies with the one or more rules; and

displaying a warning message, when the communication does not comply with the one or more rules,

wherein the one or more rules include a time rule, an email address rule, a cultural rule, or a persona rule.