Point of sale system protection against information theft attacks

Patent metadata

Field	Value
Publication number	US-9912692-B1
Application number	US-201514671578-A
Country	US
Kind code	B1
Filing date	Mar 27, 2015
Priority date	Mar 27, 2015
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

A method includes selectively implementing, via a component resident and executing on a point of sale system, one or more of a set of proactive operations to counter an information theft attack against the point of sale system. The set of proactive operations comprises: generating false information that appears to be actual information and creating at least one process executable in the point of sale system that comprises the false information; injecting false information that appears to be actual information into at least one process executing in the point of sale system; replacing actual information with false information that appears to be actual information; and blocking at least one process in the point of sale system to prevent actual information from being taken from the point of sale system.

First claim

What is claimed is:

1. A method comprising:
providing, via a software component resident and executing on a point of sale system, a plurality of proactive operational modes selectable by at least one entity through a control and monitoring interface associated with the software component, wherein the proactive operational modes are operative to counter one or more information theft attacks attempting to obtain information comprising sensitive data, entered through the point of sale system, from a volatile memory of the point of sale system, wherein the one or more information theft attacks are initiated by malware resident on the point of sale system, and wherein the proactive operational modes comprise:
a first operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, by creating at least one process executable in the point of sale system that comprises the false information;
a second operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, by injecting the false information into at least one process executing in the point of sale system;
a third operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, during a given information theft attack that is detected to be in progress by replacing real information from the volatile memory of the point of sale system that is in transit during the given information theft attack with the false information; and
a fourth operational mode configured to restrict access to at least one operating system function in the point of sale system usable by a given information theft attack to obtain the information from the volatile memory of the point of sale system;

receiving, at the software component, a selection of one or more of the plurality of proactive operational modes; and
implementing, via the software component, the one or more selected proactive operational modes;
wherein the point of sale system comprises a processor and memory configured to execute the software component.

2. The method of claim 1 , wherein the at least one created process appears to be a real process executable in the point of sale system.

3. The method of claim 1 , further comprising validating the generated false information in a manner in which the real information is validated.

4. The method of claim 1 , wherein at least one of the plurality of proactive operational modes is initiated after detection of the malware.

5. The method of claim 1 , wherein at least one of the plurality of proactive operational modes is initiated before detection of the malware.

6. The method of claim 1 , wherein the volatile memory comprises random access memory, and wherein a given information theft attack comprises a scraping attack of the random access memory.

7. The method of claim 1 , wherein the control and monitoring interface enables the at least one entity to adjust a rate of generation of the false information.

8. The method of claim 1 , wherein the control and monitoring user interface enables the at least one entity to detect that the given information theft attack is in progress.

9. An article of manufacture comprising a processor-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by a processor and a memory associated with a point of sale system perform steps of:
providing, via a software component resident and executing on a point of sale system, a plurality of proactive operational modes selectable by at least one entity through a control and monitoring interface associated with the software component, wherein the proactive operational modes are operative to counter one or more information theft attacks attempting to obtain information comprising sensitive data, entered through the point of sale system, from a volatile memory of the point of sale system, wherein the one or more information theft attacks are initiated by malware resident on the point of sale system, and wherein the proactive operational modes comprise:
a first operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, by creating at least one process executable in the point of sale system that comprises the false information;
a second operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, by injecting the false information into at least one process executing in the point of sale system;
a third operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, during a given information theft attack that is detected to be in progress by replacing real information from the volatile memory of the point of sale system that is in transit during the given information theft attack with the false information; and
a fourth operational mode configured to restrict access to at least one operating system function in the point of sale system usable by a given information theft attack to obtain the information from the volatile memory of the point of sale system;

receiving, at the software component, a selection of one or more of the plurality of proactive operational modes; and
implementing, via the software component, the one or more selected proactive operational modes.

10. The article of claim 9 , wherein the control and monitoring interface enables the at least one entity to adjust a rate of generation of the false information.

11. The article of claim 9 , wherein the control and monitoring user interface enables the at least one entity to detect that the given information theft attack is in progress.

12. An apparatus comprising:
a processor operatively coupled to a memory to form a point of sale system configured to:
provide, via a software component resident and executing on the point of sale system, a plurality of proactive operational modes selectable by at least one entity through a control and monitoring interface associated with the software component, wherein the proactive operational modes are operative to counter one or more information theft attacks attempting to obtain information comprising sensitive data, entered through the point of sale system, from a volatile memory of the point of sale system, wherein the one or more information theft attacks are initiated by malware resident on the point of sale system, and wherein the proactive operational modes comprise:
a first operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, by creating at least one process executable in the point of sale system that comprises the false information;
a second operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, by injecting the false information into at least one process executing in the point of sale system;
a third operational mode configured to utilize false information, wherein the false information comprises false sensitive data generated to appear to be real sensitive data, during a given information theft attack that is detected to be in progress by repla

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Fleyder Uri
• Kerner Rotem
• Rabinovich Zeev
• Salinas Rotem
• Ben Porat Lior
• Frank Daniel

Classifications

• G06Q20/20

  Point-of-sale [POS] network systems · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• G06F21/629

  to features or functions of an application · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title