International Business Machines Corporation

Jeffery Lake Crume

Jose F Bravo

Nigel C P Hinds

Robert L Nielsen

Steven M Golberg

Sandra L Benedict

Described are techniques including a computer-implemented method of maintaining a list of newly assigned phone numbers. The method further comprises intermittently removing phone numbers from the list of newly assigned phone numbers. The method further comprises determining that a newly assigned phone number initiates a number of calls per unit time that exceeds a threshold number of calls per unit time. The method further comprises automatically flagging the newly assigned phone number as a possible robocaller.

Call limiting using burst detection

Detecting and defending against password spraying attacks is provided. Information is received regarding failed attempts to login to user accounts located on a target system of a network. Each password used to attempt a failed login to any of the user accounts located on the target system is recorded. It is determined whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold. In response to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, an alert is sent regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system.

Detection of and defense against password spraying attacks

Embodiments of the present invention provide a method, computer program product, and computer system for verifying transactions over a network. The method includes initiating a proposed transaction with a transaction server. The transaction server provides encoded details of the proposed transaction, in the form of a QR code, to the user. The QR code is scanned using a computing device, and is decoded using an application on the computing device. A set of transaction details associated with the decoded QR code is compared with the details of the proposed transaction. The proposed transaction is then confirmed or aborted using a separate communication channel.

Verifying online transaction integrity and authentication with QR codes

In an approach for authenticating a user attempting to access to a resource, a processor receives an indication of a user attempting to access a resource within a timeframe, wherein the indication includes a location of the user. A processor identifies a location requirement for the user attempting to access the resource, wherein the location requirement originates from an entry indicating an expected location of the user within the timeframe, and wherein the entry is unmodifiable by the user. A processor determines whether the expected location of the user matches, within a threshold, the received location of the user attempting to access the resource.

Expected location-based access control

A method, system, computer program product embodied in a computer readable storage medium, and computer system are disclosed for identifying a rogue domain name service (DNS) server. Embodiments include passively monitoring traffic on a target network; and identifying a DNS resolution response in the traffic on the network. The DNS resolution response includes a mapping of a domain to an internet protocol (IP) address. The DNS resolution response is compared with a preconfigured list of known mappings of domains to IP addresses. Based on the results of the comparison, it can be determined whether the DNS resolution response is correct. In cases where the DNS resolution response is incorrect, the provider of the DNS resolution response is a rogue DNS server.

System for detecting the presence of rogue domain name service providers through passive monitoring

A method, system, and computer program product embodied in a computer readable storage medium are disclosed for identifying a rogue domain name service (DNS) server. Embodiments include passively monitoring traffic on a target network; and identifying a DNS resolution response in the traffic on the network. The DNS resolution response includes a mapping of a domain to an internet protocol (IP) address. The DNS resolution response is compared with a preconfigured list of known mappings of domains to IP addresses. Based on the results of the comparison, it can be determined whether the DNS resolution response is correct. In cases where the DNS resolution response is incorrect, the provider of the DNS resolution response is a rogue DNS server.

The disclosure is directed to a device password reset. A method in accordance with an embodiment includes: receiving a phone call at a locked mobile device from a phone having a privileged phone number; initiating a password reset in response to the receipt of the phone call from the privileged phone number and the phone call exceeding a predetermined time duration threshold by: terminating, by the locked mobile device, the phone call from the phone having the privileged phone number; generating, by the locked mobile device, a temporary password; establishing, by the locked mobile device, a connection to the phone having the privileged phone number; displaying, by the locked mobile device, a password entry field; communicating, by the locked mobile device, the temporary password via the connection to the phone having the privileged phone number; and unlocking the locked mobile device upon successful entry of the temporary password in the password entry field displayed by the locked mobile device.

Mobile device password reset

The disclosure is directed to a mobile device password reset. A method in accordance with an embodiment includes: receiving a phone call at a locked mobile device from a phone having a privileged phone number; initiating a password reset in response to the receipt of the phone call from the privileged phone number and the phone call exceeding a predetermined time duration threshold by: terminating, by the locked mobile device, the phone call from the phone having the privileged phone number; generating, by the locked mobile device, a temporary password; establishing, by the locked mobile device, a connection to the phone having the privileged phone number; displaying, by the locked mobile device, a password entry field; communicating, by the locked mobile device, the temporary password via the connection to the phone having the privileged phone number; and unlocking the locked mobile device upon successful entry of the temporary password in the password entry field displayed by the locked mobile device.

Aspects of the invention provide a solution for detecting man-in-the-middle attacks in electronic transactions using prompts. One embodiment includes a method for authenticating an electronic transaction. The method includes: receiving an electronic transaction request from a user, determining an IP address associated with a client system from which the electronic transaction request originates, providing the user with a password associated with the electronic transaction request, receiving a telephonic communication from a telephonic device associated with the user, prompting the user, via a voice response unit, to input the password using the telephonic device, authenticating the user by comparing the inputted password and the provided password, determining a probable location of the user based on the determined IP address of the client system, communicating to the user the probable location of the user based on the determined IP address, and prompting the user to confirm the probable location of the user.

Detecting man-in-the-middle attacks in electronic transactions using prompts

Aspects of the present invention provide a solution for verifying the integrity of a transaction. In response to receipt of a confirmed electronic transaction from a user, a one time password is forwarded to the user. The user then initiates a telephonic communication with a verifier on the user's wireless device and provides the one time password to the verifier. The verifier authenticates the mobile telephonic device based on the device's caller identification number and determines whether the one time password provided by the user matches the one forwarded to the user. After the user is authenticated, the verifier communicates the details of the transaction that were received and the user confirms whether the details match those originally entered.

Verification of transactional integrity

A system, method and program product for controlling access to a restricted item. A method is provided that includes: receiving a request for access to a restricted item at a computer system associated with a provider, said request originating from a client system; determining an IP address of the client system; determining a mobile phone number of a mobile phone associated with the requester; transmitting to a third party service provider the IP address and mobile phone number; and receiving back from the third party service provider a confirmation message indicating whether or not the IP address and mobile phone are located within an acceptable range of each other.

Mobile phone and IP address correlation service

A system, method and program product for defending against man in the middle (MITM) attacks directed at a target server. A system is provided that includes an activity recording system that records an incoming IP address, userid, and time of each session occurring with the target server; an activity analysis system that identifies suspect IP addresses by determining if an unacceptable number of sessions are occurring from a single incoming IP address during a predefined time period; and a countermeasure system for taking action against suspect IP addresses.

Detecting and defending against man-in-the-middle attacks

In a focal point network, adjacent nodes may agree to a relationship where one node (a focal point or server node) supplies network management services to the other node (a non-focal point or served node). A served node forwards management services data to its server node without waiting for any request. There is a risk that the nodes will become configured into a closed loop within which data, once introduced, will circulate endlessly. To eliminate this risk, a loop-detection message is generated when a node acquires a new server node and is itself a server node for other nodes. The message, which includes the originating node's name, is passed from served node to server node. Each node inspects the message. If it does not find its own name, it appends its name to the message and passes it on to its own server node. If the node does find its own name, it generates a loop-detected message that revokes the server/served relationship with the current server node.

Growing community of inventors

Raleigh, NC, United States of America

Jeffery Lake Crume