Patent Application
20070283166
The subject application is described with reference to certain figures, including:
The subject application is directed a system and method for state intrusion detection. In particular, the subject application is directed to a system and method that provides real time intrusion detection based on state transition information. Turning now to
Communicatively coupled to the computer network 102 via a suitable communications link 110, is a document processing device 104. It will be appreciated by those skilled in the art that the document processing device 104 is advantageously represented in
Operatively coupled to the document processing device 104 is a controller 106, as illustrated in
The system 100 further includes a data storage device 108, communicatively coupled to the document processing device 104. Preferably, the data storage device 108 is suitably adapted to provide storage services to the operations running on the document processing device 104. As will be appreciated by those skilled in the art, the data storage device 108 is any mass storage device known in the art including, for example and without limitation, a hard disk drive, other magnetic storage devices, optical storage devices, flash memory devices, or any combination thereof. In the preferred embodiment of the subject application, the data storage device 108 is capable of storing log data, state transition data, and the like. It will be appreciated by those skilled in the art that while illustrated in
As depicted in
Turning now to
Also included in the controller 200 is random access memory 206, suitably formed of dynamic random access memory, static random access memory, or any other suitable, addressable and writable memory system. Random access memory provides a storage area for data instructions associated with applications and data handling accomplished by processor 202.
A storage interface 208 suitably provides a mechanism for non-volatile, bulk or long term storage of data associated with the controller 200. The storage interface 208 suitably uses bulk storage, such as any suitable addressable or serial storage, such as a disk, optical, tape drive and the like as shown as 216, as well as any suitable storage medium as will be appreciated by one of ordinary skill in the art.
A network interface subsystem 210 suitably routes input and output from an associated network allowing the controller 200 to communicate to other devices. Network interface subsystem 210 suitably interfaces with one or more connections with external devices to the device 200. By way of example, illustrated is at least one network interface card 214 for data communication with fixed or wired networks, such as Ethernet, token ring, and the like, and a wireless interface 218, suitably adapted for wireless communication via means such as WiFi, WiMax, wireless modem, cellular network, or any suitable wireless communication system. It is to be appreciated however, that the network interface subsystem suitably utilizes any physical or non-physical data transfer layer or protocol layer as will be appreciated by one of ordinary skill in the art. In the illustration, the network interface 214 is interconnected for data interchange via a physical network 220, suitably comprised of a local area network, wide area network, or a combination thereof.
Data communication between the processor 202, read only memory 204, random access memory 206, storage interface 208 and network interface subsystem 210 is suitably accomplished via a bus data transfer mechanism, such as illustrated by bus 212.
Also in data communication with bus 212 is a document processor interface 222. Document processor interface 222 suitably provides connection with hardware to perform one or more document processing operations. Such operations include copying accomplished via copy hardware 224, scanning accomplished via scan hardware 226, printing accomplished via print hardware 228, and facsimile communication accomplished via facsimile hardware 230. It is to be appreciated that a controller suitably operates any or all of the aforementioned document processing operations. Systems accomplishing more than one document processing operation are commonly referred to as multifunction peripherals or multifunction devices.
Functionality of the subject system 100 is accomplished on a suitable document processing device that includes the controller 200 of
In the preferred embodiment, the engine 302 allows for printing operations, copy operations, facsimile operations and scanning operations. This functionality is frequently associated with multi-function peripherals, which have become a document processing peripheral of choice in the industry. It will be appreciated, however, that the subject controller does not have to have all such capabilities. Controllers are also advantageously employed in dedicated or more limited purposes document processing devices that are subset of the document processing operations listed above.
The engine 302 is suitably interfaced to a user interface panel 310, which panel allows for a user or administrator to access functionality controlled by the engine 302. Access is suitably via an interface local to the controller, or remotely via a remote thin or thick client.
The engine 302 is in data communication with printer function 304, facsimile function 306, and scan function 308. These devices facilitate the actual operation of printing, facsimile transmission and reception, and document scanning for use in securing document images for copying or generating electronic versions.
A job queue 312 is suitably in data communication with printer function 304, facsimile function 306, and scan function 308. It will be appreciated that various image forms, such as bit map, page description language or vector format, and the like, are suitably relayed from scan function 308 for subsequent handling via job queue 312.
The job queue 312 is also in data communication with network services 314. In a preferred embodiment, job control, status data, or electronic document data is exchanged between job queue 312 and network services 314. Thus, suitable interface is provided for network based access to the controller 300 via client side network services 320, which is any suitable thin or thick client. In the preferred embodiment, the web services access is suitably accomplished via a hypertext transfer protocol, file transfer protocol, uniform data diagram protocol, or any other suitable exchange mechanism. Network services 314 also advantageously supplies data interchange with client side services 320 for communication via FTP, electronic mail, TELNET, or the like. Thus, the controller function 300 facilitates output or receipt of electronic document and user information via various network access mechanisms.
Job queue 312 is also advantageously placed in data communication with an image processor 316. Image processor 316 is suitably a raster image process, page description language interpreter or any suitable mechanism for interchange of an electronic document to a format better suited for interchange with device services such as printing 304, facsimile 306 or scanning 308.
Finally, job queue 312 is in data communication with a parser 318, which parser suitably functions to receive print job language files from an external device, such as client device services 322. Client device services 322 suitably include printing, facsimile transmission, or other suitable input of an electronic document for which handling by the controller function 300 is advantageous. Parser 318 functions to interpret a received electronic document file and relay it to a job queue 312 for handling in connection with the afore-described functionality and components.
In the preferred embodiment of the subject application, the data storage device 108, includes a list or table of all available state transitions corresponding to operations performed by the document processing device 104 in a state transition file. Preferably, the list or table of all available state transitions is stored on the data storage device 108 in an extensible markup language file. In accordance with one aspect of the subject application, the state transition file further includes data representative of instructions to require signing of certain transitions, as set forth by a system administrator. In addition, the state transition file is preferably encrypted and digitally signed, so as to prevent tampering of the file and restrict access only to those users authorized to modify the file. In order to monitor and detect intrusions, the system 100 employs a log file, which stores state transition data corresponding to each state transition made during an operation.
The populating of the log file is accomplished by assigning, after receipt of state transition data, a unique identifier to the state transition. Once the unique identifier has been assigned to that state transition data, a determination is made whether the state transition file indicates that this state transition data is to be signed. When the state transition data does not require signing, the transition data is stored in the log file, associated with the current operation. When the state transition data requires signing, as set forth by the instructions of the state transition file, the state transition data is signed via any suitable means known in the art. The signature and transition data is then stored in the log file. The skilled artisan will appreciate that this process is repeated until all state transitions of the current operation have been performed. Stated differently, each operation comprises executable code defining transitions between states of the document processing device, whereby the completion of an operation coincides with the completion of the execution of such code, resulting in a log file. It will further be appreciated by those skilled in the art that the log file is capable of being maintained on the data storage device 108 such that each successive operation performed by the document processing device 104 is also monitored and the state transition data is stored thereon.
The analysis and detection of intrusions by unauthorized parties is advantageously accomplished using the log file generated during the performance of operations by the document processing device 104. To analyze this file for the detection of anomalies, i.e., evidence of intrusion, the controller 106, or other hardware, software, or combination thereof, in operative connection with the data storage device 108 retrieves the log file and the state transition file. It will be appreciated that while the subject application directs the use of the controller 106 component of the document processing device 104 to perform the analysis, the subject application is not limited to the controller 106 performing such analysis. The skilled artisan will appreciate that any administrative device, known in the art, capable of interfacing with the data storage device 108, is capable of being implemented to perform analysis of the data stored thereon.
As previously stated, the state transition file is encrypted, so as to prevent unauthorized access thereto, thus requiring the controller 106 to first decrypt the file for access to the state transition list or table stored thereon. Once the state transition file has been decrypted and opened for reading by the analyzing controller 106, the first state transition data, associated with the first operation, is retrieved from the log file. It will be appreciated by those skilled in the art that such retrieval of transition data is advantageously performed on a line-by-line basis of the log file. The skilled artisan will further appreciate that other methodologies of retrieval, as are known in the art, are equally capable of being implemented in accordance herewith. Once the first state transition data has been retrieved, the controller 106 then determines whether or not the transition data is required to be signed, as will be understood by those skilled in the art. When the first state transition does not require a signature, the controller 106 retrieves the next state transition data from the log file and proceeds to determine whether it requires signing.
When the state transition data is required to be signed, the signature attached to the transition data of the log file is compared to the signature stored in the state transition file. When the signatures do not match, an error notification is made to a system administrator, noted in the log, or the like. When the signatures do match, the controller 106 determines whether any additional state transition data remains in the log file associated the operation being currently analyzed. When any additional transitions remain, the next transition data is retrieved and the process repeats. When no additional state transition data remains, the type of operation is determined by the controller 106 from the log file and used to retrieve the corresponding state transition data from the state transition file. That is, the controller 106 retrieves all the state transitions from the state transition file that should be present in the identified operation type. When one or more transition states are missing, indicating tampering, notification is sent to the administrator, noted in the log file, or the like. The controller 106 then retrieves the next operation from the log file and the analysis continues from there as set forth above.
In performing real-time analysis and intrusion detection, the system 100 employs the controller 106, or other software, hardware, software/hardware combination, to continually monitor the data of the log file. Preferably, such monitoring occurs following the performance of each new operation performed by the document processing device 104. For purposes of example only, the subject application employs the controller 106 as a real-time monitoring component of the system 100. Those skilled in the art will appreciate, however, that an administrative device, in data communication with the document processing device 104, is equally capable of performing the real-time intrusion detection, as contemplated herein. Upon the elapse of a predetermined period of time, as set by the administrator or the like, the log file is retrieved by the controller 106 and the last verified operation identification data is gathered. The last verified operation identification data is preferably contained within the log file and corresponds to the last operation that was analyzed and verified as being free from intrusion. Using the identification data, the controller 106 searches the log file for the next succeeding operation performed by the document processing device 104. The skilled artisan will understand that the succeeding operation is the next operation performed temporally, i.e., in chronological order, based upon the identification data. The controller 106 then retrieves the first state transition data from the log file and performs the comparison with the state transition file, as explained above. A notification is generated upon the determination that the signatures of state transition data of the log file and the transition file do not match and sent to the administrator, or the like. When the signatures of are valid, the state transitions associated with the current operation are retrieved from the state transition file and compared with the state transition data of the log file to determine whether any state transitions are missing. When one or more state transitions are not present in the log file for the current operation, a notification is generated and sent to an appropriate administrator, noted in the log file, or the like. When the controller 106 determines that the state transitions of the log file matches that of the state transition file, the current operation is saved as the last verified operation and the system 100 returns to waiting for a new operation.
The foregoing system 100 and components shown in
When it is determined at step 408 to not sign the received state transition data, flow proceeds to step 410, whereupon the state transition data is stored in the log file. When the state transition data is to be signed, flow progresses to step 412, whereupon the controller 106 digitally signs the state transition data in accordance with the instructions retrieved from the state transition file. The signed state transition data is then stored in the log file at step 414. It will be understood by those skilled in the art that steps 402 through step 414 are repeated for each state transition performed for the selected document processing operation. It will further be appreciated by the skilled artisan that the state transition data for each subsequent state transition, whether or not signed, is also stored in the log file. The skilled artisan will further understand that the log file is also capable of being updated in accordance with the methodology described in
Turning now to
The first transition data is retrieved from the log file corresponding to the first operation in the log file at step 508. A determination is then made at step 510 whether the state transition requires a digital signature, i.e., whether the state transition data must be digitally signed. When it is determined that a signature is required for the given state transition data, flow proceeds to step 512, whereupon the signature in the log file is compared to the signature of the state transition file of the given state transition. A determination is then made at step 514 whether the signature of the log file is valid. When the signature is not valid at step 514, flow proceeds to step 528, whereupon a notification is sent to an administrator, thereby notifying the administrator of the detected anomaly. When the signature is valid, flow proceeds to step 516, whereupon a determination is made whether another state transition is present in the log file. When additional state transitions remain in the log, flow proceeds to step 518, whereupon the next state transition is retrieved from the log file. Following retrieval of the next state transition in the log file, flow returns to step 510, whereupon the controller 106 determines whether the next state transition requires a digital signature, thereafter operations proceed as discussed above.
When it is determined at step 516 that no additional state transitions remain in the log file for the current operation being analyzed, flow proceeds to step 520, whereupon the operation is determined from the log file. That is, the executable code defining the transitions between states of the document processing device is determined as to type, i.e., a copy operation, a print operation, a facsimile operation, or the like. As will be appreciated by those skilled in the art, the type of operation necessarily dictates the state transitions that should be present in the log file. Thus, the controller 106 thereafter retrieves the state transitions associated with the current operation from the state transition file at step 522. A determination is then made at step 524 whether any state transitions are missing from the log file. That is, the controller 106 compares the list of state transitions that should be present in the current operation type, as stored in the state transition file, to the state transitions present in the log file corresponding to the current operation being analyzed. When one or more state transitions are missing, a notification is transmitted to the administrator, informing the administrator of the anomaly and possible intrusion. When no state transitions are missing, flow proceeds to step 526, whereupon a determination is made whether the log file contains state transition data associated with another operation. When another operation is present in the log file, flow returns to step 508, whereupon the first state transition of the next operation is retrieved from the log file and processing continues thereon, as set forth above. When no additional operations remain in the log file, the operation terminates.
Referring now to
Once the log file has been retrieved, flow proceeds to step 606, whereupon the last verified operation identification data is retrieved from the log file. Preferably, the data is representative of the most recently verified operation. At step 608, the controller 106 determines the next operation in the log file following the verified operation. As will be understood by those skilled in the art, the next operation refers to the next subsequent, or next most recent in time, operation performed by the document processing device 104 and recorded in the log file. At step 610, the signatures of the state transitions recorded in the log file are then compared to the signatures stored in the state transition file, as set forth above with respect to
A determination is then made at step 612 whether the signatures are valid, in the same manner as explained above. When the signatures are not valid, flow proceeds to step 420, whereupon a notification is transmitted to an administrator, thereby informing the administrator of the detected anomaly or intrusion. When the signatures are valid, flow proceeds from step 612 to step 614, whereupon the state transitions associated with the current operation type are retrieved from the state transition file. The methodology by which such retrieval is accomplished, set forth in
The subject application extends to computer programs in the form of source code, object code, code intermediate sources and partially compiled object code, or in any other form suitable for use in the implementation of the subject application. Computer programs are suitably standalone applications, software components, scripts or plug-ins to other applications. Computer programs embedding the subject application are advantageously embodied on a carrier, being any entity or device capable of carrying the computer program: for example, a storage medium such as ROM or RAM, optical recording media such as CD-ROM or magnetic recording media such as floppy discs. The carrier is any transmissible carrier such as an electrical or optical signal conveyed by electrical or optical cable, or by radio or other means. Computer programs are suitably downloaded across the Internet from a server. Computer programs are also capable of being embedded in an integrated circuit. Any and all such embodiments containing code that will cause a computer to perform substantially the subject application principles as described, will fall within the scope of the subject application.
The foregoing description of a preferred embodiment of the subject application has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the subject application to the precise form disclosed. Obvious modifications or variations are possible in light of the above teachings. The embodiment was chosen and described to provide the best illustration of the principles of the subject application and its practical application to thereby enable one of ordinary skill in the art to use the subject application in various embodiments and with various modifications as are suited to the particular use contemplated. All such modifications and variations are within the scope of the subject application as determined by the appended claims when interpreted in accordance with the breadth to which they are fairly, legally and equitably entitled.
