Compromised insider honey pots using reverse honey tokens

Patent metadata

Field	Value
Publication number	US-9401927-B2
Application number	US-201514600855-A
Country	US
Kind code	B2
Filing date	Jan 20, 2015
Priority date	Jul 2, 2013
Publication date	Jul 26, 2016
Grant date	Jul 26, 2016

Abstract

According to one embodiment, a method for setting a trap to detect that an intruder has compromised a client end station (CES) in an attempt to gain unauthorized access to enterprise data provided by a server is described. The method includes causing a honey token to be placed on the CES secluded within a configuration repository, wherein the honey token is metadata and/or instructions indicating how applications can seemingly access the enterprise data but that is actually invalid, and the honey token is placed on the CES and not on the server. The method also includes causing attribute values to be installed on a security gateway for a security rule causing the security gateway to monitor network traffic for attempted use of the honey token, and to generate an alert when a set of one or more packets that include the honey token are received.

First claim

What is claimed is:

1. A method for setting a trap to detect if an intruder has compromised a client end station in an attempt to gain unauthorized access to enterprise data provided by a server executing on a server end station, the method comprising:
causing a honey token to be located on the client end station secluded within a browser local storage, wherein the browser local storage is used by a web browser and has stored therein at least one of a cookie, a proprietary storage format data element, and username and password credentials to be used by the web browser, wherein the honey token includes information that permits the web browser to seemingly access the enterprise data provided by the server, wherein the honey token does not actually allow access to any of the enterprise data provided by the server, wherein the server is unaware of the honey token, and wherein the honey token is a reverse honey token in that it exists on the client end station and not on the server; and
causing a set of one or more attribute values to be installed on a security gateway implemented in an electronic device and coupled between the client end station and the server, wherein the set of attribute values are to be utilized for a security rule that causes the security gateway to,
monitor network traffic for attempted use of the honey token to gain access to the enterprise data provided by the server, and

generate an alert when a set of one or more packets that include the honey token are received.

2. The method of claim 1 , wherein the security rule further causes the security gateway to:
block the set of packets from reaching the server by not forwarding the set of packets toward the server.

3. The method of claim 1 , wherein said causing the honey token to be placed on the client end station comprises:
transmitting a generation program to the client end station, wherein the client end station executes the generation program to create the honey token.

4. The method of claim 1 , wherein said causing the set of attribute values to be installed on the security gateway comprises:
transmitting the set of attribute values to the security gateway.

5. The method of claim 1 , further comprising:
causing one or more different honey tokens, based upon a time schedule, to be placed on the client end station.

6. The method of claim 5 , further comprising:
causing, responsive to receiving the set of packets that include the honey token, an estimated time that the client end station was compromised to be presented to a user, wherein the estimated time is determined based upon the honey token and the time schedule.

7. The method of claim 1 , wherein the server end station and the security gateway operate within a local area network (LAN) and wherein the client end station connects to the LAN through the Internet.

8. The method of claim 1 , wherein the honey token includes a username and password.

9. The method of claim 1 , wherein the honey token comprises a cookie value of a Hypertext Transfer Protocol (HTTP) cookie.

10. The method of claim 9 , wherein the honey token comprises a URL.

11. The method of claim 1 , wherein the honey token comprises a proprietary storage format data element.

12. The method of claim 1 , wherein the browser local storage is at least one of a database, set of files, data structure, and HTML5 client-side storage.

13. The method of claim 1 , wherein the set of attribute values comprises a part of the honey token that is less than all of the honey token.

14. The method of claim 1 , wherein the honey token is different from another honey token caused to be located on another client end station.

15. A system for setting a trap to detect if an intruder has compromised a client end station in an attempt to gain unauthorized access to enterprise data provided by a server executing on a server end station, the system comprising:
a module that,
causes a honey token to be located on the client end station secluded within a browser local storage, wherein the browser local storage is used by a web browser and has stored therein at least one of a cookie, a proprietary storage format data element, and username and password credentials to be used by the web browser, wherein the honey token includes information that permits the web browser to seemingly access the enterprise data provided by the server, wherein the honey token does not actually allow access to any of the enterprise data provided by the server, wherein the server is unaware of the honey token, and wherein the honey token is a reverse honey token in that it exists on the client end station and not on the server, and
causes a set of one or more attribute values to be installed on a security gateway to cause the security gateway to utilize a security rule to detect an attempted use of the honey token to gain access to the enterprise data provided by the server; and

the security gateway implemented in an electronic device and coupled between the client end station and the server that,
monitors network traffic, using the security rule and the set of attribute values, for the attempted use of the honey token, and
generates an alert when a set of one or more packets that include the honey token are received.

16. The system of claim 15 , wherein the security rule further causes the security gateway to:
block the set of packets from reaching the server by not forwarding the set of packets toward the server.

17. The system of claim 15 , wherein the module causes the honey token to be placed on the client end station by being configured to:
transmit a generation program to the client end station, wherein the client end station executes the generation program to create the honey token.

18. The system of claim 15 , wherein the module causes the set of attribute values to be installed on the security gateway by being configured to:
transmit the set of attribute values to the security gateway.

19. The system of claim 15 , wherein the module is further configured to:
cause one or more different honey tokens, based upon a time schedule, to be placed on the client end station.

20. The system of claim 19 , wherein the security gateway is further configured to:
cause, responsive to receiving the set of packets that include the honey token, an estimated time that the client end station was compromised to be presented to a user, wherein the estimated time is determined based upon the honey token and the time schedule.

21. The system of claim 15 , wherein the server end station and the security gateway operate within a local area network (LAN) and wherein the client end station connects to the LAN through the Internet.

22. The system of claim 15 , wherein the honey token includes a username and password.

23. The system of claim 15 , wherein the honey token comprises a cookie value of a Hypertext Transfer Protocol (HTTP) cookie.

24. The system of claim 23 , wherein the honey token comprises a URL.

25. The system of claim 15 , wherein the honey token comprises a proprietary storage format data element.

26. The system of claim 15 , wherein the browser local storage is at least one of a database, set of files, data structure, and HTML5 client-side storage.

27. The system of claim 15 , wherein the set of attribute values comprises a part of the honey token that is less than all of the honey token.

28. The

Assignees

• Imperva Inc

Inventors

• Shulman Amichai
• Cherny Michael
• Dulce Sagie

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1491 Primary

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title