Method and system for prevention of malware infections

• US 9,306,972 B2
• Filed: 09/17/2014
• Issued: 04/05/2016
• Est. Priority Date: 09/17/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Fireglass Ltd. (Gen Digital Inc.)
• Inventors: Amiga, Dan
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/488,360
• Publication Number:
  US 20150135264A1
• Time in Patent Office: 566 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

A system and method for prevention of malware infections, the system comprising: a secured server configured to authenticate a user and issue an identifier (ID) uniquely associated with the user, to receive a user input and to send commands based on the received input; a protection module configured to validate transmissions from the secured server, to reconstruct commands based on the commands sent from the secured server, and send the reconstructed commands comprising the unique user ID and a rendering processor configured to receive the reconstructed command from the protection module, to execute the reconstructed command, to acquire data from another machine based on the reconstructed command and to generate an image to represent the acquired data, the image comprising a stamp relating the image to the unique ID, wherein the protection module is placed in a transmission channel connecting between the secured server and the rendering processor.

Claims

1. A system for prevention of malware infections, the system comprising:

a secured server configured to authenticate a user and issue an identifier (ID) uniquely associated with the user, to receive a user input and to send commands based on the received input;

a protection module configured to validate transmissions from the secured server, to reconstruct and translate commands based on the commands sent from the secured server, and send the reconstructed commands comprising the unique user ID to a rendering processor, wherein the protection module is a built-in security component and is placed in a transmission channel connecting between the secured server and the rendering processor;

the rendering processor configured to receive the reconstructed command from the protection module, to execute the reconstructed command, to acquire data from another machine based on the reconstructed command and to generate an image to represent the acquired data, the image comprising a stamp relating the image to the unique user ID by, at least, embedding the unique user ID in a portion of said image; and

a secured transmission module configured to transmit the generated images to the secured server while ensuring that the generated images are sent securely to the user associated with the unique user ID,

wherein the secured server is further configured to receive the generated image via the secured transmission module, extract from the image the acquired data and the unique user ID and send the acquired data to the user associated with the extracted unique user ID.

2. The system of claim 1, wherein the protection module is configured to receive data by a one way physical link and send data by a one way physical link.

3. The system of claim 1, wherein the protection module is further configured to check the transmissions against a policy and/or schema of a relevant messaging protocol and/or comprises an Intrusion Prevention System (IPS) configured to validate the transmissions sent to the rendering processor.

4. The system of claim 1, wherein the protection module further comprises a video output transmission component configured to transform commands to video and to transmit the video-transformed commands to the rendering processor, wherein the rendering processor is configured to transform the video back to valid browser commands.

5. The system of claim 1, wherein the secured transmission module is configured to transmit the images by a one-way transmission protocol.

6. The system of claim 1, wherein some components of the secured transmission module is comprised in the protection module or placed between the protection module and the rendering processor.

7. The system of claim 1, wherein the transmission module comprises CAPTCHA mechanism that has to be solved by the user in order to receive the generated image.

8. The system of claim 1, wherein the protection module comprises an intrusion prevention system placed in-line with the protection module, wherein the intrusion prevention system is configured to ensure that transmissions sent to the rendering processor are valid according to a predefined policy.

9. The system of claim 1, wherein the rendering processor comprises a plurality of servers enabling numerous corresponding browsing sessions by multiple users at the same time on the same another machine.

10. The system of claim 1, wherein the security module further comprises a list of rendering processors to which it can transmit reconstructed commands.

11. The system of claim 1, wherein the secured transmission module is configured to convert data received via the rendering processor to a static format or video while removing potentially malicious content from the data, and wherein the secured server is configured to reconstruct the data from the static format or video.

12. The system of claim 1, wherein the transmission module comprises video output and input transmission components to transform the generated images to analog one-way video transmission.

13. The system of claim 12, wherein the video output component comprises a display monitor and the video input component comprises a camera configured to capture frames presented on the display monitor.

14. The system of claim 1, wherein the protection module comprises an internal video output component configured to transform constructed commands to analog one-way video transmission, and wherein the system further comprises an internal video input component configured to transform the video received from the internal video output component to valid command.

15. The system of claim 1, wherein the secured transmission module comprises a one-way by-pass transmission module for sending a CAPTCHA and/or security log created by the protection module to the secured server.

16. A method for prevention of malware infections, the method comprising:

receiving a user input, authenticating the user and issuing an identifier (ID) uniquely associated with the user, and sending commands based on the received input by a secured server;

validating transmissions from the secured server, reconstructing and translating commands based on the commands sent from the secured server, and sending the reconstructed commands comprising the unique user ID by a protection module to a rendering processor, wherein the protection module is a built-in security component and is placed in a transmission channel connecting between the secured server and the rendering processor;

receiving the reconstructed command from the protection module, executing the reconstructed command, acquiring data from another machine based on the reconstructed command and generating an image to represent the acquired data by the rendering processor, the image comprising a stamp relating the image to the unique user ID by, at least, embedding the unique user ID in a portion of said image;

transmitting the generated images to the secured server by a secured transmission module, while ensuring that the generated images are sent securely to the user associated with the unique user ID; and

receiving the generated image by the secured server via the secured transmission module, extracting from the image the acquired data and the unique user ID mad sending the acquired data to the user associated with the extracted unique user ID.

17. The method of claim 16, further comprising checking the transmissions against a policy and/or schema of a relevant messaging protocol and/or validating the transmissions sent to the rendering processor.

18. The method of claim 16, further comprising transforming commands to video and transmitting the video-transformed commands to the rendering processor, and transforming the video back to valid browser commands by the rendering processor.

19. The method of claim 16, further comprising ensuring that transmissions sent to the rendering processor are valid according to a predefined policy by an intrusion prevention system placed in-line with the protection module.

20. The method of claim 16, further comprising converting data received via the rendering processor to a static format or video while removing potentially malicious content from the data, and reconstructing the data by the secured server from the static format or video.

21. The method of claim 16, further comprising transforming the images generated by the rendering processor to analog one-way video transmission by video output and input transmission components.

22. The method of claim 17, further comprising displaying frames by the video output component and capturing frames by the video input component.

23. The method of claim 16, further comprising transforming constructed commands to analog one-way video transmission by an internal video output component in the protection module and transforming the analog one-way video transmission received from the internal video output component to valid command.