RU2602956C2 - System and method for protection from leakage of confidential data in wireless networks - Google Patents

Abstract

FIELD: data protection.

SUBSTANCE: disclosed is a method for safe transmission of outbound traffic containing confidential information over a wireless network including a wireless access point that is used to transmit outcoming and incoming traffic with inbound traffic control and determination of the type of traffic transfer protocol; if the type of the protocol is determined unsafe, the structure of the obtained data in the incoming traffic is analyzed to define fields which indicate the possibility of entering confidential information, with subsequent formation of samples of certain fields; detecting an attempt of transmitting confidential information via an unsecured network in outcoming traffic, at that only the presence of change in the field, for which the sample is formed, is determined; determining the type of network resource using the information on the matched sample; selecting the method of safe connection based on the type of the network resource onto which confidential information is transmitted using the rules of selection, which are formed according to the types of network resources.

EFFECT: technical result consists in preventing leakage of confidential information during transmission via a wireless network.

21 cl, 4 dwg

Description

Technical field

The present invention relates to systems and methods for protecting against leakage of user confidential data when transmitting data through a public wireless network to a remote server.

State of the art

Wireless networks have become very popular as a tool with which people access the Internet. In addition, interest in this method of access is constantly growing due to the wide distribution of modules for connecting to a wireless network in modern devices. Such devices are mobile phones, smartphones, PDAs, laptops, tablet computers, digital music players, etc. Depending on the connection module, you are connected to various types of wireless networks and continue to work on the Internet.

Wireless types of networks are both networks that comply with GSM, GPRS, EDGE, SDMA (known as 3G), WiMax and LTE (known as 4G) standards, and networks that comply with IEEE 802.11 standards (known as Wi-Fi networks). A feature of the first type of network is the deployment of a network in a large geographic area. But at the same time, the network is characterized by a relatively low data transfer rate. In addition, access to such networks is usually paid. The second type of network is designed for deployment in a small geographical area, while this type of network has a relatively high data transfer rate.

As a result, the second type of network has found great popularity among companies that, to attract customers or increase competitiveness, create wireless local area networks (WLANs) based on Wi-Fi networks and provide free access to them to their customers, for example, to connect to the Internet. Examples of such companies are hotels, catering venues such as McDonald's, shopping centers, airports and subways.

Each wireless network has an access point through which various client devices are connected to this network. A wireless access point is a wireless complex of transceiver equipment designed to provide wireless access to an existing network (wireless or wired) or create a new one. A wireless access point allows not only to organize a wireless network and provide wireless connection to various client devices, but also due to various operating modes, it can expand an existing wireless network, work in the mode of connecting to a provider via a wireless network, work as a wireless bridge for connecting two isolated friends from a friend of wired networks, etc.

In turn, users of client devices using access points of Wi-Fi networks are willing to connect to them, using the provided opportunity to access the Internet to communicate on social networks, read news, view mail, perform banking operations, etc.

It should be understood that the user, when connecting to such wireless networks, runs the risk of being cheated, and his activity on the network may be available to third parties. Therefore, there was a need to warn the user about the possible consequences of using such networks and inform the user about the power of attorney (or security) of the selected access point.

In the technical field, there are a number of approaches designed to solve this drawback. So, in patent application US 20130097710 A1 describes an approach for assessing the risk of connecting to a wireless access point. The approach is based on using a third-party server, the so-called reputation center, to assess the risk of connecting to a wireless access point. To do this, the device sends data identifying the wireless access point to a third-party server. And a third-party server finds stored information about the risk assessment of the corresponding access point. Next, the server sends a response with information about the risk assessment (trust) of the specified wireless access point.

Another problem is that, as a rule, information, including confidential information, is often transmitted in the open form when interacting with Internet sites. Consequently, information transmitted via wireless networks can be intercepted by cybercriminals and subsequently used for personal gain. Therefore, a need arose to detect the inadvertent transmission of sensitive data over the network.

Analysis of the prior art allows us to conclude that inefficiency and, in some cases, the impossibility of using previous technologies to solve this problem. Thus, it is required to create a solution that will allow real-time automatic detection of wireless network security, heuristically detect the transfer of confidential data and create secure channels for transmitting confidential data, depending on the required protection. The invention described below allows to solve the tasks.

Disclosure of invention

The present invention is intended to protect against leakage of confidential user data when transmitting said data via a wireless network to a remote server.

The technical result of the present invention is to prevent leakage of user confidential information while transmitting said confidential information through a wireless network. The technical result of the present invention is achieved by selecting the appropriate option for protecting confidential information according to a certain level of security of the wireless network and then transmitting confidential information in accordance with the selected protection option.

As one embodiment, a method for transmitting outgoing traffic containing confidential information through a wireless network is provided, comprising the steps of: determining a connection to a network resource via a wireless network and the security level of said wireless network, at least based on an analysis of the available data About the mentioned wireless network; in accordance with a certain level of security, the type of protocol used to transmit traffic through said wireless network is determined, where the type of protocol is defined as safe or insecure; determine in outgoing traffic an attempt to transmit confidential information, at least using a protocol whose type is defined as unsafe; make a choice of a method for secure connection when transmitting confidential information based on the type of network resource to which confidential information is transferred; using the selected method of secure connection for further transmission of outgoing traffic containing confidential information; transmit outgoing traffic containing confidential information over a secure connection.

In another embodiment of the method, the analysis of the available data about the network is performed using heuristic records that contain a combination of criteria characterizing a wireless network and a security verdict of the corresponding wireless network.

In yet another embodiment of the method, incoming traffic is monitored, during which at least the following actions are performed: determine the structure of the transmitted data; search for fields that may indicate the ability to enter confidential information; form samples in accordance with the found fields.

In another embodiment of the method, at least an HTML file is defined as the structure of the transmitted data in the incoming traffic.

In another embodiment of the method, the determination in outgoing traffic of an attempt to transmit confidential information is based, at least, on the analysis of data in outgoing traffic by comparing them with samples created during the control of incoming traffic.

In another embodiment of the method, the sample consists of at least two parts, where the first part contains information about the return delivery address, and the second part contains a field where potentially confidential information should be entered when transmitting data in outgoing traffic.

In another embodiment of the method, the information contained in the first part of the sample is understood as a hyperlink.

In another embodiment of the method, the security level of the wireless network is defined as unsafe.

In yet another embodiment of the method, wireless network information is information used or obtained when setting up a wireless network.

In another embodiment of the method, the security level of the wireless network is determined using information contained in a remote database containing information about the most popular wireless networks.

In yet another embodiment of the method, confidential information, at least, is understood to mean both the personal data of the user and the data set by the user as requiring protection.

In another embodiment of the method, the data set by the user as requiring protection is at least the password and login to the user's mailbox, last name, first name, middle name, login to enter the social network, social card number, TIN (individual tax payer number ), financial information such as a bank account and credit card number.

In yet another embodiment of the method, a secure connection method for transmitting confidential information is at least one of the following approaches:

- approach using SSL protocol;

- An approach with creating a permanent VPN connection;

- An approach with creating a temporary VPN connection.

As another embodiment, a system is proposed for transmitting outgoing traffic containing confidential information through a wireless network, which includes: means for intercepting network traffic associated with means for analyzing wireless networks and means for controlling traffic, while means for intercepting network traffic is designed to determine the connection to a network resource via a wireless network and transmitting outgoing traffic, including including confidential information, according to the established mu compound; said means for analyzing wireless networks associated with means for storing a base of wireless networks and means for monitoring traffic, wherein means for analyzing wireless networks is for determining a security level of said wireless network, at least based on an analysis of available data about said wireless network; said means for storing a base of wireless networks for storing information about the analyzed wireless networks; said traffic control means associated with the security means, wherein the traffic control means is intended to determine the type of protocol used when transmitting traffic through said wireless network, where the protocol type is defined as safe or insecure, and to determine attempts to transmit confidential information in outgoing traffic, at least least, using a protocol whose type is defined as unsafe; said security measure intended to: select a secure connection method for transmitting confidential information, where the selection is made based on the type of network resource to which confidential information is transmitted; creating the selected method of secure connection for further transmission of outgoing traffic containing confidential information.

In another embodiment of the system, the wireless network analysis tool analyzes the available data about the wireless network using heuristic entries that contain a combination of criteria characterizing the wireless network and the security verdict of the corresponding wireless network and are stored on the wireless base storage medium.

In another embodiment of the system, the means for storing the base of wireless networks is periodically updated with new information about new wireless networks from external sources.

In another embodiment of the system, traffic control means associated with sample base storage means for storing information about created samples that indicate the presence of confidential information, while the traffic control means is designed to control incoming traffic during which it performs at least , the following actions: defines the structure of the transmitted data; searches for fields that may indicate the ability to enter confidential information; forms samples in accordance with the found fields.

In yet another embodiment of the system, at least an HTML file is defined as the structure of the transmitted data in the incoming traffic.

In another embodiment of the system, the traffic control tool, when determining attempts to transmit confidential information in the outgoing traffic, analyzes the transmitted data contained in the outgoing traffic by comparing them with the samples created during the control of the incoming traffic.

In yet another embodiment of the system, the sample consists of at least two parts, where the first part contains information about the return delivery address, and the second part contains a field where potentially confidential information should be entered when transmitting data in outgoing traffic.

In another embodiment of the system, the hyperlink is understood as the information contained in the first part of the sample.

In yet another embodiment of the system, the wireless network data is information used or obtained when setting up the wireless network.

In another embodiment of the system, the security level of a wireless network is determined using information contained in a remote database containing information about the most popular wireless networks.

In yet another embodiment of the system, confidential information, at least, is understood to mean both the personal data of the user and the data set by the user as requiring protection.

In another embodiment of the system, under the data set by the user as requiring protection, are at least the password and login to the user's mailbox, last name, first name, middle name, login to enter the social network, social card number, individual taxpayer number, financial information such as a bank account and credit card number.

In yet another embodiment of the system, secure connection methods for transmitting confidential information are at least the following approaches:

- approach using SSL protocol;

- An approach with creating a permanent VPN connection;

- An approach with creating a temporary VPN connection.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 shows an example of a public wireless network with Internet access.

FIG. 2 illustrates a block diagram of a system for securely transmitting confidential information over a wireless network.

FIG. 3 shows a flow diagram of a system for securely transmitting confidential information over a wireless network.

FIG. 4 shows an example of a general purpose computer system on which the invention may be implemented.

Although the invention may have various modifications and alternative forms, the characteristic features shown by way of example in the drawings will be described in detail. It should be understood, however, that the purpose of the description is not to limit the invention to its specific embodiment. On the contrary, the purpose of the description is to cover all changes, modifications that are within the scope of this invention, as defined in the attached formula.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details necessary to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined in the scope of the attached claims.

In FIG. 1 shows a special case of the implementation of a wireless network 105 with access to the Internet. Internet access is provided via a wireless access point 110 with an IEEE 802.11 connection standard (known as Wi-Fi). Wi-Fi technology allows devices 120 users to access various network resources 140 through, for example, the Internet, as if these devices 120 were connected using a standard (cable) connection, for example, Ethernet. In addition, in the General case, when organizing a wireless network 105, the access point 110 is connected to the provider 130 using one of the standard methods: ADSL technology, 3G or a local Ethernet network.

To connect to a deployed Wi-Fi 105 access point 110, each device 120 must have a Wi-Fi standard wireless adapter. The devices 120 can be all modern computer devices, for example personal computers, laptops, tablet computers, smartphones and mobile phones. Connection will be made within the coverage area of the wireless access point 110 of the corresponding Wi-Fi network 105. The range of the wireless access point 110 may be limited only by the hardware or software equipment of the wireless access point 110. The territory of the wireless network can serve as public areas (for example, airports, cafes, offices), as well as private areas (for example, hotels, private houses and apartments of users). As a rule, the difference between public and private wireless networks is the presence of a secure password for access to private networks and the ability to connect to such a network only for a limited circle of proxies. For example, to connect to the hotel’s wireless network, an access password is required and, as a rule, this password is known to all hotel guests who are not trusted. Therefore, although the network has an access password, it will not be private. There may also be differences due to data transfer features. For example, in public wireless networks, data is usually transmitted in clear text, and in private wireless networks in encrypted form.

It is worth noting that, depending on the implementation option, network resources 140 can be either a device or a part of information stored on some third-party computer system, which can be remotely accessed from another computer, for example, via the Internet. Information can be understood, for example, a web page hosted on an Internet server. Access to network resources 140 can be either free or limited, and is carried out by contacting the network address or domain name of the network resource, where the network address is a unique identifier for the resource. An example of an address can be IP (Internet Protocol Address) - a unique network address of a node in a computer network built using IP protocol, for example 208.73.211.176, or URL (Uniform Resource Locator) - a universal pointer to a network resource, which is a standardized way records of the address of a resource on the Internet, for example, “http://www.kaspersky.com”.

So, when the device 120 and the network resources 140 interact, using the wireless network 105, all network traffic between the device 120 and the network resources 140 will be transmitted through the access point 110. In this case, the network traffic may contain both general information and confidential information. At the same time, if the access point 110 of the wireless network 105 is not sufficiently protected or compromised by the attacker 150 (the attacker may have privileged access), or is specially created by him, the attacker 150 will gain access to the network traffic passing through the access point 110, and subsequently to confidential information user. Confidential information within the framework of the claimed invention is understood to mean any information that is the subject of ownership and is subject to protection in accordance with the requirements established by the owner of the information. Examples of such information are personal data, in particular a password from a mailbox, name, surname, middle name, login for entering a social network, social card number, TIN (individual tax payer number), financial information such as a bank account and credit number cards.

An example of insufficient security of a wireless network is the situation when a wireless network is created on the territory of the hotel that contains an access password. Therefore, when connecting a hotel’s client (user) to this wireless network, as a rule, he will have an opinion that such a network is protected, since he was provided with a private key (password) to connect to it, but in most cases this opinion is false. The provided password for the wireless network can be known not only to this client, but also to another hotel client or even to third parties. This is due to the fact that when creating such networks they are worried not about network security, but about the convenience of providing the Internet access service for clients and the subsequent use of a wireless network. Therefore, as a rule, the password from such networks is either very simple, or it can be easily obtained, because it can be placed, for example, on a bulletin board or customer information sheets, or to select a password using an attack using the key selection method (English brute force).

An example of a compromised wireless network can be any public network, since any attacker 150 can gain access to such a network, and after various methods can gain privileged status (for example, administrative access rights) in the corresponding wireless network, for example, by using some or vulnerabilities in access point software. In addition, as a rule, data transmission in a public wireless network is carried out in open form, which is an even easier “attack” of an attacker. This is due to the fact that the creation of a secure (for example, encrypted) data transmission channel is the most resource-intensive than open transmission. Therefore, when transmitting confidential information, it is necessary to minimize the risk that this information will be intercepted by third parties (for example, an attacker 150).

Therefore, it is necessary to transmit confidential data while using a wireless network using the most suitable option for protecting confidential information. This problem is successfully solved by the presented invention.

In FIG. 2 is a structural diagram of a device 120 comprising a system for protecting against leakage of confidential information in a wireless network 200. System 200 allows you to protect confidential information from theft or interception by third parties while transmitting this information over a wireless network.

The device 120 contains a number of different applications that require access to network resources, or that are provided for the user to work. These applications periodically connect to network resources, for example, to update application versions. In addition, the user, using one of the applications (for example, application 1 shown in Fig. 2, which in turn is a browser, for example, “Google Chrome”), connects to a remote network resource, for example, a website. Connecting to the website is, for example, by clicking on the hyperlink that sends to the corresponding network address, or by entering the network address in the address bar of the browser. At this point, the system 200 begins to fulfill its purpose.

In one embodiment, the system 200 consists of means for intercepting network traffic 210, means for analyzing wireless networks 220, means for storing the base of wireless networks 230, means for monitoring traffic 240, means for storing the base of samples 250, and means of protection 260.

The means of intercepting network traffic 210 detects a connection to network resources, and if further interaction takes place over a wireless network using the Wi-Fi standard, it intercepts all transmitted and received information (network traffic). In one embodiment, the tool 210 may be part of a device 120 that connects to an access point 110, for example, a network interface 51 (as described in FIG. 4).

Information about the connected wireless network and network traffic intercepted by the interceptor 210 will be provided to the wireless network analysis tool 220 and the traffic control tool 240. In turn, the wireless network analysis tool 220, using the received information from the tool 210, determines the level of power of attorney (security) of the connected wireless network. The security level is determined based on an analysis of the data available on the device 120 about the connected wireless network and information received from the interception means 210 about the connected access point 110. Examples of the information provided from the interception means 210 can be information characterizing the access point, such as:

- network address of the wireless access point;

- availability of network security technologies (WPA, WPA2) and encryption key management scheme;

- the physical location of the device (street, building, library, metro, etc.), for example, due to the additional use of GPS;

- SSID and BSID;

- channel bandwidth;

- various statistics, for example, operating time and frequency of change of tincture parameters.

As the available data about the connected wireless network on the device 120, there may be information entered either by the user himself when setting up the wireless network, or set in the case of automatic authorization with a wireless access point, for example:

- name of the wireless network;

- The publicity status of the network (for example, public, private or personal);

- the presence and type of encryption during data transfer;

- availability and strength of the connection password;

- information about the set of powers that the user possesses after successful authorization;

- the popularity of the wireless network (for example, the number of unique popular devices that connected to the network for a month);

- the power of attorney of the wireless network (for example, selected by the user during the network setup process).

In general, the tool 220 analyzes the available information using heuristic entries stored in the storage facility of the wireless network base 230. Each heuristic entry contains a combination of criteria characterizing the corresponding wireless network and a verdict on its security. One of these combinations may include the following combinations:

- “Public / without authorization / unencrypted”, i.e. The wireless network has been defined by the user or automatically as a public network, for example, a metro network. In addition, there is no need to enter a password when connecting to a network, or authorization is formal, and data is transferred without any encryption.

- “Public / authorization / simple password / encrypted / low encryption type”, i.e. the network is defined as public, which requires authorization, contains a common password (for example, it is included in the list of 100 most popular passwords) and has an insufficient level of encryption (for example, WEP).

- “Private / authorization / password / encrypted / low type of encryption”, i.e. The network is defined as private, which requires authorization, contains a good-level password (for example, it does not fall into the list of the 100 most popular passwords and has more than 6 characters) and contains an insufficient level of encryption (for example, WPA).

- “Personal / authorization / password / encryption / high type”, i.e. the network is defined as the personal wireless network of the device user that requires authorization, contains a good password and a high type of encryption (for example, WPA2 AES).

- etc.

It is worth noting that heuristic entries can be formed both with the help of a user or a remote server (not shown in Fig. 2) of the company providing this technology, or by using self-learning methods. For example, a wireless network profile will be generated containing specific information, such as statistics on the operation of the wireless network, and the collected statistics will be analyzed.

Depending on the triggered heuristic, a verdict on the security level of the wireless network is issued. It should be noted that, depending on the implementation, the level of security can be determined both unambiguously (for example, safe or unsafe), and ambiguously (for example, as a percentage of ideal security or as a point scale). Next, information about the level of power of attorney of the wireless network will be transmitted to the means of traffic control 240.

In the frequent case, if the information for analyzing and verdicting the level of the power of attorney of the wireless network is not enough, then the tool 220 may transmit the request to the remote server (not shown in Fig. 2) to the company providing the corresponding services. In a preferred embodiment, the response to the request will contain a verdict on the level of the power of attorney, which is signed with an electronic digital signature in order to protect against distortion of the response by third parties in the event of an unexpected interception.

In yet another embodiment, the means 220 will also provide storage to the means 230 for verdicts rendered on connected wireless networks. Subsequently, the tool 220 before the next analysis of the wireless network can perform a preliminary analysis of previously stored information about the verdicts. In addition, the tool 230 may be updated with information about the security level of wireless networks and from external sources.

The traffic control tool 240, which is part of the system 200, allows, using the means of storage of the sample base 250, to detect the transfer of confidential information through a wireless network. After receiving information about the power of attorney level of the wireless network from the means 220, the means 240 begins to control the incoming and outgoing data streams (traffic). During the monitoring of incoming traffic, the tool 240 analyzes the entire incoming data stream entering the device 120 via a wireless network. It is worth noting that the analysis consists of two parts, i.e. primary and secondary analysis occurs. In the initial analysis of incoming traffic, the means 220 detects the type (safe or unsafe) of the protocol used when transmitting data, for example, by analyzing the protocol header. Another example of determining the type of protocol is the analysis of the ports through which traffic flows. In the event that a secure protocol type is defined, no secondary analysis is performed. Otherwise, if the protocol type is defined as unsafe, a secondary analysis is performed. An example of a secure protocol is the HTTPS protocol, and an unsafe protocol is the HTTP protocol.

Secondary analysis consists in analyzing the structure of the transmitted data (for example, an HTML file) within a specific protocol and searching for fields in the structure of the transmitted data, which may indicate the possibility of entering confidential information in order to create samples with such fields. For example, fields are entered in the HTML file into which the user can enter text called confidential information, for example, password, login or credit card number. After identifying such fields, the tool 240 forms samples based on them, which it sends to storage for the storage of the sample base 250. The samples will consist of at least two parts, where the first part contains the return delivery address (for example, URL), and the second part contains the identified area where potentially confidential information should be entered when transferring data in outgoing traffic. It is worth noting that when analyzing the structure of the transmitted data, it can be revealed that the transmission of the response containing the fields where potentially confidential information should be entered will be carried out using a secure type of data transfer protocol. Consequently, in the particular case of implementation, samples in which the first part contains the return delivery address according to the secure type of protocol will be subsequently skipped when analyzing outgoing traffic.

Further, during outgoing traffic monitoring, the tool 240 detects an attempt to transmit confidential information over an insecure connection in an insecure network using heuristic methods. One of the heuristic methods is the method of comparing data contained in outgoing traffic with generated samples (below is an example of the formation of samples). It can be noted that the comparison takes place in two stages, first a match is revealed with the first part of the sample, and then with the second part. When comparing the second part of the sample with the transmitted data, only the presence of any change with respect to the sample is determined. If a change is present, then the tool 240 suspends the transmission of confidential information and makes a request to the security tool 260. The request contains information about the triggered sample. It is worth noting that in the particular case of implementation, during the comparison of the first parts of the samples and the determination of the return delivery address according to the secure type of protocol, the second part is not analyzed.

Another heuristic is the method for detecting confidential information in POST requests, such as a credit card number. It is worth noting that in this case, the analysis of POST requests will be carried out subject to the determination of transmission over an insecure connection, which was detected during the analysis of incoming traffic.

Consider the examples of the above analysis of incoming traffic with the subsequent formation of samples and outgoing traffic.

Example 1

In the incoming traffic, an HTML file was received, received from a network resource to which the device 120 made a connection. Next, the tool 240 parses the embedded code in the HTML file. During the analysis, a search is made for the fields that contain the lines responsible for entering confidential information. If a suitable field is detected, the tool 240 generates a sample containing, as mentioned above, a network address (hyperlink) and an embedded code containing a confidential information input line. After the outgoing traffic means 240 will identify all POST requests and compare with the first parts of the created samples. If the first part matches, means 240 determines whether there is a change in accordance with the second part of the matched pattern. If a change is detected, i.e. the transmitted form differs from the form in the second part of the sample, then the transmission of confidential information is revealed.

An example of parsing the embedded code in an HTML file and generating a sample will be considered when interacting with the website “http://rbc.ru/”:

It can be seen from the example that when forming the sample, the first part will contain a hyperlink, namely, "" http://mail.qip.ru/auth/logon/ "", and the second part will be a tag form responsible for entering the name and password : "Input name =" pass "..." type = "password" ".

We also consider an example of parsing the embedded HTML code in the case when the return network address has a secure data transfer protocol, for example, when interacting with the http://mail.ru website:

It can be seen from the example that when forming the sample, the first part will contain a hyperlink that has a secure data transfer protocol, namely "" https://auth.mail.ru/cgi-bin/auth?from=splash ".

Example 2

In the incoming traffic, the interaction of a mobile application with a remote server was revealed, which allows you to pay for purchased goods with a credit card. In this case, in outgoing traffic, when POST requests are detected, in addition to determining the presence of a change, the card number will be determined using heuristic methods based on credit card knowledge (for example, http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail .htm? csnumber = 39698). In one of the implementation options, the place where confidential information is received will be checked (for example, whether the link is an official link of the bank).

In one particular case of the invention, if the received information on the level of power of attorney of the wireless network from the means 220 indicates that the wireless network is completely secure, then the means 240 will not monitor traffic. In turn, the tool 220 will track changes in the parameters of the wireless network and, if changes occur, reassess the level of power of attorney of the wireless network.

The security tool 260, using the information received from the tool 240, namely the information about the matched sample, allows you to select and then form the necessary secure connection method for transmitting confidential information. For this, the security tool 260, using the information on the matched pattern, determines the type of network resource to which confidential information should be transmitted. In the framework of the claimed invention, network resources are classified by type according to their purpose, and types may have the following form:

- services for financial transactions;

- services requiring authorization;

- corporate services;

- file and video hosting;

- other resources.

Next, the tool 260 selects the desired method of secure connection based on a certain type of network resource in accordance with the selection rules that are pre-formed according to the characteristics of each type of network resource. It is worth noting that the assignment of a network resource to a type of network resource is based on well-known methods, for example, comparison with a database of network resources, analysis according to the rules for determining the type of network resource, etc. Examples of features include the following assumptions:

- when transferring a credit card number and / or card control number to an appropriate network resource, it will be necessary to protect (secure) all subsequent data;

- when transferring a password or login to a mail site, it is also necessary to protect (secure) subsequently mail;

- when transferring a password or login to a thematic site, for example, a forum about cars, it may be sufficient to protect only the transfer of the most confidential information;

- when interacting with corporate services to which service information is transferred, it is required to secure not only the transfer of confidential information, but also all transmitted data during the session;

- when interacting with file hosting, it may not require protection when transferring information.

Therefore, the rules for choosing connection protection for the corresponding types of network resources can be of the form presented below, while it is important to note that when applying the selection rules, tool 260 is guided by the fact that the following rule is executed only if it is not possible to fulfill the previous rule:

- for the type of network connection “services for financial transactions”:

1) first of all, create a connection using the SSL protocol;

2) notify the user about the transfer of confidential information over an insecure wireless network;

3) block the transfer of confidential information;

4) disconnect from the remote server;

- for the type of network connection “services requiring authorization”:

1) create a connection using the SSL protocol;

2) create a temporary VPN connection;

3) notify the user about the transfer of confidential information over an insecure wireless network;

4) make a request to the user to continue transmission over an insecure wireless network;

5) disconnect from the remote server;

- for the type of network "connection corporate services":

1) create a permanent VPN connection;

2) create a temporary VPN connection and notify the user;

3) notify the user about the transfer of confidential information over an insecure wireless network;

4) disconnect from the remote server;

- for the type of network connection “file and video hosting”:

1) create a connection using the SSL protocol;

2) create a temporary VPN connection to transfer only confidential information;

3) notify the user about the transfer of confidential information over an insecure wireless network;

4) continue transmission over an insecure wireless network.

In addition, the specialist in the art should understand that it is possible to use other methods of forming the rules of choice. General rules for all types can be set, for example, if the network resource supports the SSL protocol, then this transmission method should be used first.

Next, the tool 260 makes a connection to a network resource according to the selected (defined) method of secure connection for transmitting confidential information. After that, the tool 240 allows the transmission of outgoing traffic, in particular the transfer of confidential information, on the created secure connection.

In FIG. 3 shows a diagram of the algorithm of the system. At 310, a network traffic interceptor 210 detects a wireless network connection using the Wi-Fi standard. At 320, a wireless network analysis tool 220 determines a power of attorney (security) of the connected wireless network. The power of attorney is determined based on the analysis of the data available on the device 120 about the connected wireless network and information received from the communication means 210, about the connected access point of the corresponding wireless network. Examples of the analyzed information are given in the description of FIG. 2. It is worth noting that in one embodiment, the analysis of information will be carried out using heuristic records that are stored in the storage facility of the base of wireless networks 230. Each heuristic record contains a combination of criteria characterizing the corresponding wireless network and a verdict on its security. At step 330, the tool 220, depending on the triggered heuristic record, issues a verdict on the security level of the wireless network. If the security level is sufficient to ensure the preservation of confidential information during transmission in a wireless network, the tool 220 does not query the tool 240 and proceeds to step 340, which monitors the status of the wireless network in order to detect any changes. If changes are detected, then tool 220 will review the network security level.

If the security level is not sufficient to ensure the preservation of confidential information during transmission in a wireless network, then the tool 220 makes a request to the tool 240 to control the passing traffic. The request contains information about the network security level. Next, the means 240, after detecting the transmission of traffic in step 345, determines the type of protocol used, which will be determined as safe or unsafe. One way to determine the type of protocol is to analyze the protocol headers. In the event that the protocol is determined to be safe, further analysis of the corresponding traffic is not performed, which is indicated by means 220 and means 260. Otherwise, if the protocol is determined as unsafe, at step 350, means 240 monitors the corresponding incoming traffic via a wireless network. During monitoring, the tool 240 determines the structure of the transmitted data (for example, an HTML file) within a specific protocol and searches for fields in the structure of the transmitted data, which may indicate that it is possible to enter confidential information in order to create samples with such fields. Samples will consist of at least two parts, where the first part contains the return delivery address (for example, URL), and the second part contains the identified area where potentially confidential information should be entered when transmitting data in outgoing traffic. For example, inbound traffic intercepted data, which is an HTML file. Next, a search is made for the fields inside which contain lines responsible for entering confidential information. When these fields are detected, the tool 240 forms an appropriate pattern. Next, at step 360, the tool 240 analyzes the outgoing traffic from the device 120. In the framework of the claimed invention, the analysis can be understood as identifying attempts to transmit confidential information using an insecure protocol (over an insecure channel) by comparing the data contained in the outgoing traffic with the generated samples, and identifying by determining the availability of confidential information according to known determination algorithms, for example, algorithms for determining a credit card number or control card amounts. It can be noted that in the particular case, the comparison with the sample takes place in two stages; first, the coincidence with the first part of the sample is revealed, and then with the second part. When comparing the second part of the sample with the transmitted data, only the presence of any change with respect to the sample is determined. An example of an analysis of outgoing traffic is the earlier example with an HTML file. In this case, all POST requests will be detected in outgoing traffic and compared with the first part of the samples, and then with the second.

At 365, the means 240 detects the presence of confidential information in the outgoing traffic. In the event that confidential information is not identified, the tool 240 passes outgoing traffic. Otherwise, if confidential information is detected, then the means 240 makes a request to the means of protection 260 to create a method of protection. In one implementation option, the request will contain information about the triggered sample.

At step 370, security tool 260 determines the necessary secure connection method for transmitting confidential information. For this, the tool 260 determines the type of network resource to which confidential information is transferred in accordance with a given classification. In one embodiment, the type of network resource is determined by analyzing the network address (hyperlink) or analyzing information about the matched sample, if it was transmitted by means of 240. After that, the necessary method of secure connection is selected based on a certain type of network resource and in accordance with the specified rules of choice. The selection rules are formed according to the characteristics of each type of network resources. Examples of type features and selection rules themselves are given in the description of FIG. 2.

At step 380, tool 260 creates the selected secure connection method for further transfer of confidential information or all outgoing traffic (depending on the selection rule that worked). After that, outgoing traffic containing confidential information is transmitted over the created secure connection.

In FIG. 4 shows a computer system on which the described invention can be used.

FIG. 4 represents an example of a general purpose computer system (it can be either a personal computer or a server) 20, comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented, like any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26, contains basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating ROM systems 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer can be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 4. Other devices, for example, routers, network stations, peer-to-peer devices or other network nodes, may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims.

Claims (21)

1. A method for safely transmitting outgoing traffic containing confidential information from a computer device to a remote network resource through a wireless network having a wireless access point through which outgoing and incoming traffic is transmitted, said method comprising the steps of:
a) determine the connection to the network resource through a wireless network having a wireless access point;
b) determine the security level of the aforementioned wireless network based on the analysis of data available on the computer device about the aforementioned wireless network and information about the connected wireless access point;
c) in accordance with a certain level of security, incoming traffic is monitored, during which the type of protocol used to transmit traffic through the mentioned wireless network is determined, where the protocol type is defined as safe or insecure;
d) when determining the type of protocol as unsafe, analyze the structure of the received data in the incoming traffic to determine the fields in the structure that indicate the possibility of entering confidential information, followed by the formation of samples of certain fields;
e) determine in outgoing traffic an attempt to transmit confidential information through an insecure network, at least for a protocol whose type is defined as insecure, and only the presence of at least one change in the field for which the sample is generated is determined;
e) determine the type of network resource using information about the matched pattern;
g) make a choice of a method for secure connection when transmitting confidential information based on a certain type of network resource to which confidential information is transmitted using selection rules that are formed according to the characteristics of the types of network resources;
h) use the selected method of secure connection for further transmission of outgoing traffic containing confidential information;
i) transmit outgoing traffic containing confidential information over a secure connection. 2. The method according to claim 1, in which the analysis of the available data about the mentioned network is performed using heuristic records that contain a combination of criteria characterizing a wireless network and a security verdict of the corresponding wireless network. 3. The method according to p. 1, in which at least an HTML file is defined as the structure of the transmitted data in the incoming traffic. 4. The method according to claim 1, wherein the sample consists of at least two parts, where the first part contains information about the return delivery address, and the second part contains a field where potentially confidential information should be entered when transmitting data in outgoing traffic . 5. The method of claim 4, wherein the information contained in the first part of the sample is understood as a hyperlink. 6. The method of claim 1, wherein the wireless network data is information used or obtained when setting up the wireless network. 7. The method of claim 1, wherein the security level of the wireless network is determined using information contained in a remote database containing information about the most popular wireless networks. 8. The method according to p. 1, in which confidential information, at least, is understood as the personal data of the user and the data set by the user as requiring protection. 9. The method according to claim 8, in which the data set by the user as requiring protection is at least the password and login to the user's mailbox, last name, first name, middle name, login for entering the social network, social card number, TIN (individual tax number), financial information such as a bank account and credit card number. 10. The method of claim 1, wherein the method of securely connecting to transmit confidential information is at least one of the following approaches:
- approach using SSL protocol;
- An approach with creating a permanent VPN connection;
- An approach with creating a temporary VPN connection. 11. A system for securely transmitting outgoing traffic containing confidential information through a wireless network having a wireless access point through which outgoing and incoming traffic is transmitted, wherein said system includes:
a) a means of intercepting network traffic associated with a means of analyzing wireless networks and a means of controlling traffic, the means of intercepting network traffic is intended to determine the connection to a network resource through a wireless network having a wireless access point, and transmit outgoing traffic, including confidential information on the created secure connection;
b) said means for analyzing wireless networks associated with means for storing a base of wireless networks and means for controlling traffic, while the means for analyzing wireless networks is used to determine the security level of said wireless network based on analysis of data on the said wireless network and information about connected wireless access point;
c) said means for storing the base of wireless networks, designed to store information about the analyzed wireless networks;
d) said traffic control means associated with the protection means, wherein the traffic control means is intended to control incoming traffic during which:
- determines the type of protocol used when transmitting traffic through the mentioned wireless network, where the type of protocol is defined as safe or insecure,
- for the type of protocol that is defined as unsafe, it analyzes the structure of the received data in the incoming traffic to determine the fields in the structure that indicate the possibility of entering confidential information, followed by the formation of samples of certain fields;
- and determining in outgoing traffic attempts to transmit confidential information through an insecure network, at least for a protocol whose type is defined as unsafe, only the presence of at least one change in the field for which the sample is generated is determined;
e) said protective equipment intended for:
- determining the type of network resource using information about the matched pattern;
- choosing a secure connection method for transmitting confidential information, where the selection is made on the basis of a certain type of network resource to which confidential information is transmitted, using selection rules that are formed according to the characteristics of the types of network resources;
- creating the selected method of secure connection for further transmission of outgoing traffic containing confidential information. 12. The system of claim 11, wherein the wireless network analysis tool analyzes available data about said wireless network using heuristic entries that contain a combination of criteria characterizing the wireless network and the security verdict of the corresponding wireless network and are stored on the wireless base storage means networks. 13. The system of claim 11, wherein the means for storing the base of wireless networks is periodically updated with new information about new wireless networks from external sources. 14. The system of claim 11, wherein at least an HTML file is defined as the structure of the transmitted data in the incoming traffic. 15. The system of claim 11, wherein the sample consists of at least two parts, where the first part contains information about the return delivery address, and the second part contains a field where potentially confidential information should be entered when transmitting data in outgoing traffic . 16. The system of claim 15, wherein the information contained in the first part of the sample is understood as a hyperlink. 17. The system of claim 11, wherein the wireless network data is information used or obtained when setting up the wireless network. 18. The system of claim 11, wherein the security level of the wireless network is determined using information contained in a remote database containing information about the most popular wireless networks. 19. The system according to claim 11, in which confidential information, at least, refers to both the personal data of the user and the data set by the user as requiring protection. 20. The system according to claim 19, in which under the data set by the user as requiring protection are at least the password and login to the user's mailbox, last name, first name, middle name, login to enter the social network, social card number, individual tax number, financial information such as a bank account and credit card number. 21. The system of claim 11, wherein the methods of secure connection for transmitting confidential information are at least the following approaches:
- approach using SSL protocol;
- An approach with creating a permanent VPN connection;
- An approach with creating a temporary VPN connection.

Images