System and Method for Network Security Including Detection of Attacks Through Partner Websites

• US 20110214187A1
• Filed: 03/01/2011
• Published: 09/01/2011
• Est. Priority Date: 03/01/2010
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Silver Tail Systems, Inc. (Dell Technologies Inc.)
• Inventors: Lloyd, Jim, Frantz, Matt, Eynon, Mike, Mather, Laura, Wittenstein, Andreas
• Granted Patent: US 8,627,479 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 61/301 Name conversion
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A computer readable storage medium with instructions executable on a host computer. The instructions record a relationship between a partner site and the host computer, substitute a reference to the partner site with a partner site alias referencing the host computer, deliver the partner site alias to a client, replace the partner site alias for the reference to the partner site in response to receiving the partner site alias from the client and augment the address of the client with an address alias. The address alias is sent to the partner site. A partner action and the address alias are received from the partner site. The address is exchanged for the address alias. The partner action is delivered to the client utilizing the address. These operations are monitored to identify client activity that constitutes a security threat at the host computer or the partner site.

Claims

1. A computer readable storage medium with instructions for execution on a host computer, comprising instructions to:

(i) record a relationship between a partner site and the host computer;

(ii) substitute a reference to the partner site with a partner site alias referencing the host computer;

(iii) deliver the partner site alias to a client;

(iv) replace the partner site alias for the reference to the partner site in response to receiving the partner site alias from the client;

(v) augment the address of the client with an address alias;

(vi) send the address alias to the partner site;

(vii) receive from the partner site a partner action and the address alias;

(viii) exchange the address for the address alias;

(ix) deliver the partner action to the client utilizing the address; and

(x) monitor (ii) through (ix) to identify client activity that constitutes a security threat at the host computer or the partner site.

2. The computer readable storage medium of claim 1 further comprising executable instructions to analyze the logical structure of the partner site.

3. The computer readable storage medium of claim 2 further comprising executable instructions to analyze intercepted communications between the client and the partner site to evaluate the logical structure of the partner site.

4. The computer readable storage medium of claim 2 further comprising executable instructions to prepare a partner web site map detailing the intrinsic linkages among web pages, intrinsic access levels, intrinsic privilege levels and intrinsic security levels.

5. The computer readable storage medium of claim 2 wherein the executable instructions to monitor include executable instructions to evaluate security flaws in the logical structure of the partner site.

6. The computer readable storage medium of claim 2 wherein the executable instructions to monitor include executable instructions to determine whether an observed transition is consistent with the logical structure of the partner site.

7. The computer readable storage medium of claim 2 wherein the executable instructions to monitor include executable instructions to produce a session threat score based upon the monitoring and the logical structure of the partner site.

8. The computer readable storage medium of claim 2 further comprising executable instructions to issue a warning to the partner site in response to the identification of a structural security flaw in the logical structure of the partner site.

9. The computer readable storage medium of claim 1 wherein the executable instructions to monitor include executable instructions to detect the appearance of a new service that is inconsistent with a pre-existing list of partner site services.

10. The computer readable storage medium of claim 1 further comprising executable instructions to reconstruct a plurality of partner site sessions to identify a security threat.

11. The computer readable storage medium of claim 1 further comprising executable instructions to encrypt communications between the host computer and the client.

12. The computer readable storage medium of claim 1 further comprising executable instructions to encrypt communications between the host computer and the partner site.

13. The computer readable storage medium of claim 1 wherein the host computer is configured as a dedicated physical server, a virtual server shared with other services, a portion of a sever farm or a virtual server farm in a computing cloud.

14. The computer readable storage medium of claim 1 wherein the executable instructions to monitor include executable instructions to access security information from client-facing data centers or internal service data centers.

15. The computer readable storage medium of claim 1 further comprising executable instructions to implement a remedial action in response to the security threat, wherein the remedial action is selected from blocking the client, delaying the client, diverting the client to a harmless webpage and supplying the client with spoofed information.

16. The computer readable storage medium of claim 1 further comprising executable instructions to warn a victim of the security threat utilizing an independent communication channel.