Abstract:
Methods, apparatuses, and computer-readable media protect sensitive data from being submitted in response to malicious e-mail. Responsive to initiating interaction with a remote site by clicking on a link, a method for protecting sensitive data from being submitted to a suspicious remote site responsive to a malicious e-mail comprises the steps of determining whether each remote target site a user attempts to access requests input of sensitive data; monitoring transmissions between a user&#39;s computer and remote target sites; and determining that a suspicious remote site is attempting to glean sensitive data from the user, responsive to a condition from a group of conditions consisting of: determining that a remote target site the user is attempting to access requests input of sensitive data; and detecting an attempt to transmit sensitive data between the user&#39;s computer and a remote target site.

Description:
TECHNICAL FIELD 
   The present invention relates to protecting sensitive information, and more particularly to a method for protecting sensitive data from being submitted to a suspicious remote site responsive to a malicious e-mail. 
   BACKGROUND ART 
   The advent of connecting two or more computers to form a network has dramatically altered the way business and personal transactions take place. Aspects such as e-mail, file transfers, surfing the web, instant messaging, e-commerce, and more are becoming day-to-day occurrences. The arrival of this technology also brought with the challenge of protecting sensitive information on a system that, by its very nature, is built for information exchange. Networks serve as the repository of a great deal of sensitive information. This storehouse of information has not gone unnoticed by would be thieves and con artists. As techniques to convey sensitive information over a network have evolved, so have attempts to pilfer that information. One such means by which thieves trick users into providing sensitive information is called Phishing. 
   Phishing is a fraudulent e-mail campaign that attempts to elicit confidential and/or financial information from unwitting victims. Phishing generally entails sending large numbers of e-mails with compelling reasons why the recipient should click on a link to an official-looking, yet bogus, website. Once there, the user is encouraged to input confidential information such as credit card, Social Security, and bank account numbers. 
   Proposals for limiting the effectiveness of phishing include e-mail authentication techniques using antispam standards and scanning for “cousin” 
   domains, whereby trademark owners would be notified when a similar sounding Uniform Resource Locator (URL) or site contains spoofed content. Features such as Norton Privacy Control in Symantec&#39;s Norton Internet Security (NIS) product and McAfee Personal Firewall help to stem the increasing number of phishing attacks by allowing users to identify confidential data that they wish to protect. Upon seeing the specific confidential data being transmitted via HTTP (via the web), instant messenger, or SMTP (via e-mail), the user is notified of the pending release of confidential information, and prompted to provide verification that the disclosure is authorized. Unfortunately, when a phishing attack is successful, the user believes that they are transmitting their confidential information to a reputable website, thus circumventing the intervention. Furthermore, users are not always as diligent as they should be about entering or updating their sensitive data into a security product such as NIS. 
   What is needed is an effective and automated way to protect confidential and sensitive information from deceptive and fraudulent e-mail campaigns. It would be desirable to recognize the attempted transmission of confidential and/or sensitive information to seemingly illicit destinations prior to the information&#39;s release. The present invention addresses these and other problems, as well as provides additional benefits. 
   DISCLOSURE OF INVENTION 
   Methods, apparatuses, and computer-readable media protect sensitive data from being submitted in response to malicious e-mail. Responsive to initiating interaction with a remote site by clicking on a link, a method for protecting sensitive data from being submitted to a suspicious remote site responsive to a malicious e-mail comprises the steps of determining whether each remote target site a user attempts to access requests input of sensitive data; monitoring transmissions between a user&#39;s computer and remote target sites; and determining that a suspicious remote site is attempting to glean sensitive data from the user, responsive to a condition from a group of conditions consisting of: determining that a remote target site the user is attempting to access requests input of sensitive data; and detecting an attempt to transmit sensitive data between the user&#39;s computer and a remote target site. 
   The features and advantages described in this disclosure and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
     These and other more detailed and specific objects and features of the present invention are more fully disclosed in the following specification, reference being to the accompanying drawings, in which: 
       FIG. 1  is a block diagram of a system for protecting sensitive information from being submitted to a suspicious remote site responsive to a malicious e-mail, according to one embodiment of the present invention. 
       FIG. 2  is a flow diagram of one method embodiment to protect sensitive information from being submitted to a suspicious remote site responsive to a malicious e-mail. 
       FIG. 3  is block diagram of an exemplary network configuration for protecting sensitive information from being submitted to a suspicious remote site responsive to a malicious e-mail, according to one embodiment of the present invention. 
       FIG. 4  is a flow diagram of one method to detect and protect sensitive information from being submitted to a suspicious remote site by applying a cryptographic algorithm to the data, according to one embodiment of the present invention. 
   

   The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
   DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     FIG. 1  shows a high level block diagram for protecting sensitive information from being submitted to a suspicious remote site responsive to a malicious e-mail, according to some embodiments of the present invention. A click-through mode manager  100  monitors interactions between a client web browser and a website for the attempted submission of sensitive information. If the website interaction was initiated via a link such as a link found in an e-mail message, the release of the sensitive data is blocked until either the user can knowledgeably override the block, or the interaction with the website is initiated through a reliable means. For purposes of the present invention, “click-through mode” is defined as a state of interaction between a client computer and a remote network site where the interaction was initiated by clicking on a link. 
   It is to be understood that although the click-through mode manager  100  is illustrated as a single entity, as the term is used herein a click-through mode manager  100  refers to a collection of functionalities which can be implemented as software, hardware, firmware, or any combination of these. Where a click-through mode manager  100  is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as one or more device drivers or as one or more statically or dynamically linked libraries. A click-through mode manager  100  can be instantiated on and/or as part of a server, client, firewall, intrusion detection system, proxy, gateway, switch and/or any combination of these and/or other computing devices and/or platforms. 
   In one embodiment, a click-through mode manager  100  is comprised of a monitor system  110 , an alert system  120 , and a verification system  130 . While not necessarily residing at the same location or within the same device, the three systems interact amongst themselves to accomplish the functionality of the click-through mode manager  100 . According to one embodiment of the present invention, and as shown in  FIG. 1 , the monitor system  110 , the alert system  120 , and the verification system  130 , reside as a click-through mode manager  100  interposed between, and communicatively coupled to, a client computer  150  and a server  160 . In another embodiment the monitor system  110  and the alert system  120  reside within the client computer  150  apart from the verification system  130  without losing any functionality. The verification system  130  can reside within a server  160  and be in communication with the monitor system  110  and alert system  120  without detrimentally impacting the functionality and effectiveness of the click-through mode manager  110 . 
   In one embodiment of the present invention, the monitor system  110  is configured to observe  205  client network activities to detect  210  when a web browser or similar network accessing device initiates a domain connection to a remote site. In doing so the monitor system examines  215  whether the interaction between the client browser and the remote site was initiated through suspicious means. When the investigation confirms that the web browser is in click-through mode, the monitor system  110  observes the interactions between the client and the remote site to identify  230  either attempts by the remote site to glean sensitive information from the user, or the attempts by the user to transmit sensitive data between the client computer  150  and the remote site. The monitor system  110  communicates the attempted conveyance of sensitive data to the verification system  130  while temporarily blocking  235  the data transmission to the remote site. 
   Upon receiving notice of the attempted conveyance from the monitor system  110 , the verification system  130  identifies  410  sensitive data, such as an n-digit data string, for analysis. In one embodiment, at least one cryptographic algorithm is applied  420  to the n-digit string to verify  430  that the data string is sensitive or confidential in nature. Once verified  430 , the result is communicated  460  back to the monitor system  110  and the alert system  120 . The alert system  120  notifies  140  the user that the submission of sensitive or confidential information is about to occur to a remote site whose reliability and veracity is suspect. When the user communicates  245  that he or she does not wish to convey the data to a remote site initiated via suspect means, the alert system  120  prompts  250  the user to reconnect to the site using a more reliable alternate means such as manually entering the URL into the address bar of a web browser or using a bookmark/favorite option of the client computer&#39;s web browser. 
   While the verification and alert steps transpire, the monitor system  110  continues to monitor  205  the type of connection that exists between the client web browser and the remote site. Upon the user reconnecting using a more reliable initiating methodology, the monitor system removes  265  the click-through designation of the remote site and permits transmission of sensitive data. 
     FIG. 2  is a flow diagram illustrating steps, according to one embodiment of the present invention, for protecting sensitive data from being submitted to a suspicious remote site responsive to a malicious e-mail. Confidential and/or sensitive data includes items such as credit card numbers, social security numbers, bank account numbers, driver&#39;s license numbers, and the like. Many of these numbers are used either to conduct financial transactions on-line, or to verify an individual&#39;s capacity to conduct financial transactions. 
   The click-through mode manager  100  addresses the need to protect sensitive data from unwitting submission to a remote site in response to a malicious e-mail by monitoring  205  a user&#39;s network activity through a client web browser or the like. In one embodiment of the present invention, a client computer  150  is communicatively coupled to a network  350  such as the Internet. The client computer  150  possesses the ability to interact with and display web pages using a device such as a client web browser. Examples of web browsers that are adaptable to display and interact with a website of the user&#39;s choice include Internet Explorer®, Mozilla®, Safari®, etc. As will be readily apparent to one skilled in the relevant art, the client computer  150  also possesses the ability to communicate electronically via the network  350  by using an e-mail client. E-mail clients include software programs such as Outlook®, Outlook Express®, Eudora, Pegasus, and the like. A client computer&#39;s  150  e-mail client and web browser are typically capable of interacting and exchanging information between themselves. For example, e-mails can often display static images of a web page and can provide a link to a domain or remote website. Likewise web browsers have the ability to act as a portal for e-mail and other forms of electronic communication via a domain. 
   As described herein, malicious e-mail attacks (sometimes referred to as phishing) take advantage of the inherent interaction between e-mail clients and web browsers. The click-through mode manager  100  detects  210  a client web browser&#39;s initiation of a connection to a remote site through an outside link  215 . Such an outside link  215  can be presented to the user in an e-mail received through an e-mail client such as Outlook®. As previously defined, this type of network connection is identified  220  as a “click-though” connection and places the web browser in a click-though mode. In click-through mode it is not reliably known to what URL the web browser has been directed. Unlike manually typing the URL in the address bar or selecting a site via the web browser&#39;s bookmark/favorite function, the actual URL address delivered to the web browser via a link is unknown to the user despite what is displayed in the client browser&#39;s address bar. 
   Click-though mode can be entered by clicking on a link found in an e-mail or in a webpage. As a result, the web browser is directed, often unintentionally, to a different or new website. For example, a legitimate yet compromised website can contain a suspect link that would direct a user to a remote site outside the current domain. Clicking on such a suspect link would cause the click-through mode manager  100  to enter click-though mode and prevent the submission of sensitive data, while other legitimate links on the web page would not result in such an action. As is apparent to one skilled in the art of web page construction, the determination that a remote site is suspect, malicious, or fraudulent depends on a variety of factors and considerations selected by the user. One such consideration is the nature of communication that transpires between the client and the remote site. 
   Once the client browser is in click-through mode, the click-through mode manager  100  observes  225  communications between the remote site and the client computer  150 . The click-through mode manager  100  verifies  230  a user&#39;s attempted submission of confidential or sensitive data by performing, in one embodiment, a check sum analysis of the sensitive data that the user is attempting to submit. Responsive to the submitted data being verified as sensitive, the click-through mode manager  100  blocks  235  the transmission of the data and/or alerts  240  the user with regard to the risk of transmitting sensitive data to a remote site while the web browser is in click-though mode. 
   While maintaining the block of transmitting the sensitive data, the click-through mode manager  100  queries  245  the user whether he or she would like to transmit the sensitive data to a remote site whose network interaction was originated by clicking on a link located in a suspect e-mail. When the user elects to transmit sensitive data despite the risk, the click-through mode manager  100  overrides  245  the transmission block and transmits  255  the sensitive data to the remote site. A negative answer to the query prompts the user to be advised  250  of alternatives to establish reliable network connection with a domain. One such alternative is to manually either enter the URL in the web browser&#39;s address bar or similar network interaction system. Another reliable alternative is to select the domain via a bookmark or favorite that the user has previously established with the client browser based on a reliable interaction with a site. Upon the click-through mode manager  100  determining  260  the web browser has been directed to a web site via a reliable URL source, the web browser exits click-through mode and transmits  265  the sensitive data to the active site. 
     FIG. 3  illustrates a network configuration for protecting sensitive data from being submitted to suspicious remote sites responsive to a malicious e-mail according to one embodiment of the present invention. The click-through mode manager  100  can be employed in a variety of configurations and in a variety of network  370  environments. One configuration is to house the click-through mode manager  100  in a proxy server  310  interposed between a client computer  150  and a web server  160 . In another embodiment the click-through mode manager  100  can be configured to have the monitor system  110  and the alert system  120  resides on a client computer  156  while the verification system  130  resides external to the client computer  156  such as on a server  161 . The distributive nature of the click-through mode manager  100  allows network  370  interaction through many differing configurations. To ensure that the click-through mode manager  100  remains capable to monitor  205  and interact with a client computer&#39;s means of interacting with a network, the monitor system  110  and alert system  120  are ideally resident in or in direct communication with the client computer  150 ,  151 ,  152 , . . . n, and its associated web browser. In another embodiment of the present invention, the verification system  130  can be employed separately at a corporate or network gateway to alert a system administrator, or the like, that attempts to communicate sensitive data outside a particular network environment to a site initiated through a unverified URL is ongoing. 
     FIG. 4  illustrates a flow diagram for protecting sensitive data by applying a cryptographic algorithm to a data string according to one embodiment of the present invention. As the click-through mode manager  100  observes  225  network communications between a client computer  150  and a network  370 , the verification system  130  employs at least one cryptographic algorithm to determine the data string&#39;s nature. Many data strings possess inherent cryptographic properties. Credit card numbers, for example, are created so that the last digit serves as a verification of the previous 15 digits. The Luhn algorithm is a check sum algorithm that creates the 16 th  digit of a credit card number based on the first 15 numbers. Thus the application of the Luhn algorithm to the first 15 digits of a 16 digit number will provide a strong indication whether the 16 digit number is a valid credit card number. While it is possible to create a 16 digit number that passes the Luhn test and not be a credit card number, the likelihood of such a false positive is low. Furthermore, the Luhn algorithm is not the only way to determine whether a number is a credit card number. For example, the verification code on the back of a credit card also provides insight as to the numbers validity. Likewise, other numbers such as bank account numbers, driver&#39;s license numbers, and the like can be verified using cryptographic techniques known to one skilled in the relevant art. 
   In one embodiment, the click-through mode manager  100  identifies  410  an n-digit data string being submitted via a network connection. The data string can be transmitted as one number or broken into smaller segments such as n segments of m digits each where m may or may not equal n. At least one cryptographic algorithm, such as the Luhn algorithm, is used to verify  420  the sensitive natures of the n-digit data string. When the n-digit data string fails to match  430  any known cryptographic pattern for sensitive data, the number is ignored  450  and the block preventing the data strings transmission is removed. In situations where the n-digit number matches a known cryptographic technique, the n-digit data string is declared  440  sensitive data. This declaration and classification of the n-digit data string is conveyed  460  to the monitor system  110  and the alert system  120  for further action. 
   As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, managers, systems, functions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the modules, managers, functions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. The above description is included to illustrate the operation of various embodiments of the invention and the elements and steps of the various embodiments described above can be combined to provide further embodiments. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.