RU2836104C1 - System and method for safe interaction of computer with internet - Google Patents

Abstract

FIELD: computer engineering.

SUBSTANCE: invention relates to computer engineering and can be used to protect computers and automated systems from malicious software effects and leakage of confidential information. System comprises: stand-alone computer 1, web server 2, device for simulating user input 4, network computer 5, video camera 6, network computer display 8, communication channel 10, stand-alone computer 1 is connected to web server 2 via communication channel 10, web server 2 is connected to device 4 for simulating user input. Video camera 6 is directed to display screen 8 of the network computer and is connected to web server 2, on stand-alone computer 1, web browser 3 is installed for displaying web pages received from a web server, and web browser 11 is installed on network computer 5 to display web pages obtained from Internet 7.

EFFECT: enabling interaction of a computer with the Internet without the risk of downloading malicious software or malicious software impact on the computer and hindering the transmission of confidential information on the computer to the Internet.

13 cl, 5 dwg

Description

AREA OF TECHNOLOGY

The invention relates to the field of computer technology and can be used to protect computers and automated systems from malicious software effects originating from the Internet and from leakage of confidential information into the Internet.

LEVEL OF TECHNOLOGY

There is a patent RU 2602956 C2 "System and method for protecting against leakage of confidential data in wireless networks", where when trying to transmit data to the Internet, their confidentiality is determined by the presence of fields in the data that characterize them as confidential. The disadvantage of this solution is the possibility of an intruder deleting these fields and transmitting confidential data to the Internet in this form.

Known is the patent US 10505900 B2 "Data leak protection in upper layer protocols", where the gateway connecting the automated system to the Internet checks the traffic according to a set of preset rules for possible presence of confidential information, and makes a decision on the transfer or refusal to transfer the information. The disadvantages of this solution are the need to specify a complex set of rules that cannot guarantee coverage of all options for the presence of confidential information in the traffic and must be regularly updated in accordance with the needs of users of the automated system.

The patent GB 2558055 A "Publishing data across a data diode for secured process control communications" is known, where the protection of the automated system from malicious software from the Internet is carried out using a gateway that functions as a "data diode", i.e. a device that allows data to pass only in one direction - from the automated system to the Internet, but not vice versa. The disadvantage of this solution is the impossibility of obtaining information from the Internet by users of the automated system.

Known patent RU 2724796 C1 "System and method for protecting automated systems using a gateway", where the protection of an automated system from malicious software from the Internet is carried out using a gateway on which a trusted operating system and a trusted security service are installed, implementing a security configuration that includes a set of rules for filtering traffic and signatures of computer attacks. The disadvantage of this solution is the possibility of vulnerabilities in the gateway operating system and the gateway security service, despite the fact that they are considered trusted, which can be used by an attacker for malicious software impact on the automated system and the inability to resist new malicious software impacts not included in the security configuration.

DISCLOSURE OF THE ESSENCE OF THE INVENTION

In the context of the growing role of Internet technologies in the life of society, the problem of protecting automated systems from internal threats, such as the leakage of confidential information from an automated system to the Internet due to the actions of unscrupulous users, and external threats, such as malicious software emanating from the Internet (computer viruses, worms, Trojan programs, etc.), is becoming increasingly urgent.

A significant threat to an organization is the intentional or accidental transfer of confidential information to the Internet by dishonest employees. The greatest potential damage from unauthorized transfer of information occurs in the case of copying and pasting into input fields on Internet sites or when sending files to Internet resources. Existing methods of protection against leakage of confidential information (Data Leak Prevention (Protection), DLP) involve installing programs that analyze information when attempting to transfer it to the Internet according to various criteria, and allow or prohibit its transfer. However, developing criteria that completely prevent leakage of confidential information is a complex task, the practical solution of which usually contains errors. A pressing task is to develop a method of interaction with the Internet that significantly complicates the transfer of confidential information to the Internet, without requiring the development of criteria for detecting an attempt at such transfer.

When working with the Internet, even with the use of an antivirus program, the required level of protection from malicious software impacts is not ensured. These programs provide protection only from known threats included in their signature database. Thus, they are always one step behind the intruders. Therefore, the issue of developing methods of interaction with the Internet that are invariant to any software impacts from this network is relevant.

The technical result of the claimed invention is the possibility of implementing interaction between a computer and the Internet without the risk of downloading malicious software or malicious software impact on the computer and the possibility of significantly complicating the transfer of confidential information located on the computer to the Internet.

The claimed technical result is achieved by using a system for secure interaction of a computer with the Internet, comprising a stand-alone computer 1, a web server 2, a device for simulating user input 4, a network computer 5, a video camera 6, a network computer display 8, a communication channel 10, wherein the stand-alone computer 1 is connected to the web server 2 via the communication channel 10, the web server 2 is connected to a device 4 for simulating user input, the device 4 for simulating user input is connected to the network computer 5, the video camera 6 is directed at the display screen 8 of the network computer and is connected to the web server 2, wherein the stand-alone computer 1 has a web browser 3 installed, configured to display web pages received from the web server, wherein the network computer 5 has a web browser 11 installed, configured to display web pages received from the Internet 7,

wherein the autonomous computer 1 is configured to send, via communication channel 10, information entered by the user into the web browser 3 of the autonomous computer to the web server 2;

the web server 2 is configured to receive information from the autonomous computer 1 and extract signals from it from the information input devices of the autonomous computer 1 and transmit them to the device 4 for simulating user input;

the device 4 for simulating user input is designed with the ability to repeat the signals received from the input devices of the autonomous computer 1 and transmit them to the input/output ports of the network computer 5;

network computer 5 is connected to the Internet network 7 and is configured to interact with the Internet network 7 to display web pages in the web browser 3 of network computer 5 after receiving input signals from the device 4 for simulating user input;

video camera 6 is designed with the ability to shoot from the display screen 8 of network computer 5 web pages displayed as a result of receiving input signals from device 4 for simulating user input, and transmitting the video broadcast to web server 2;

web server 2 is designed with the ability to receive a video broadcast from video camera 6, generate web pages containing a video broadcast from video camera 6, and transmit them to autonomous computer 1 via a communication channel.

In one embodiment of the system, the autonomous computer 1, web server 2, user input simulating device 4, video camera 6, display 8 and communication channel 10 are not connected to the Internet network 7.

In one embodiment of the system, web browser 11 is constantly open on network computer 5 in full-screen mode.

In one embodiment of the system, the input devices of the autonomous computer 1 are a keyboard and a mouse, and the device 4 for simulating user input repeats the signals sent by the keyboard and mouse of the autonomous computer 1 and transmits them to the input/output ports of the network computer 5.

In one embodiment of the system, the stand-alone computer 1 and the network computer 5 are tablet computers of the same model, and the device for inputting information of the stand-alone computer 1 is a touch screen, and the device 4 for simulating user input of information is made in the form of a robot that inputs information into the network computer 5 by moving the manipulator along the touch screen of the network computer 5, repeating the movement of the fingers of a person working with the stand-alone computer 1.

In one embodiment of the system, the autonomous computer 1 and the network computer 5 are smartphones of the same model, and the device for inputting information of the autonomous computer 1 is a touch screen, and the device 4 for simulating user input of information is made in the form of a robot that inputs information into the network computer 5 by moving the manipulator along the touch screen of the network computer 5, repeating the movement of the fingers of a person working with the autonomous computer 1.

In one embodiment of the system, the autonomous computer 1 and the web server 2 interact via a wired communication channel.

In one embodiment of the system, the autonomous computer 1 and the web server 2 interact via a fiber-optic communication channel.

In one embodiment of the system, the autonomous computer 1 and the web server 2 interact via a radio channel.

In one embodiment, the communication channel 10 between the autonomous computer 1 and the web server 2 includes a simulator 9 of a wireless access point to the Internet network, implementing the standard protocol of a wireless access point to the Internet network Wi-Fi or Bluetooth, but not connected to the Internet network 7, wherein the simulator is connected to the web server 2 via a wired, fiber-optic or radio channel, and the autonomous computer 1 is connected to the simulator 9 via a radio channel using the standard Wi-Fi or Bluetooth protocol.

The claimed technical result is also achieved by using a method for secure interaction of a computer with the Internet, which consists of sending by a stand-alone computer 1 via a communication channel 10 information entered by the user into a web browser 3 on the stand-alone computer 1 to a web server 2, which extracts signals from the information input devices of the stand-alone computer 1 from this information and inputs them into the network computer 5 using a device 4 for simulating user input connected to the network computer 5, wherein the web server 2 receives a video broadcast signal from a video camera 6 filming the display screen 8 of the network computer 5, generates and transmits the Internet pages received and opened in the web browser 11 by the network computer 5 to the stand-alone computer 1 in the form of a web page containing a video broadcast from the video camera 6 filming the display screen 8 of the network computer 5 with the web browser 11 open, and the stand-alone computer 1 displays in the web browser 3 the received from the web server 2 web pages.

In one embodiment of the method, the autonomous computer 1, the web server 2, the user input simulating device 4, the video camera 6, the display 8 and the communication channel 10 are not connected to the Internet 7. In one embodiment of the method, the network computer 5 is connected to the Internet 7 and is configured to interact with the Internet 7.

BRIEF DESCRIPTION OF DRAWINGS

Fig. 1 shows an example of traditional user interaction with the Internet using a computer.

Fig. 2 shows a diagram of the proposed system for interaction between an autonomous computer 1 and a web server 2 via a wired communication channel 10.

Fig. 3 shows a diagram of the proposed system for secure interaction of a computer with the Internet during interaction between an autonomous computer 1 and a web server 2 using a wireless access point simulator 9 in the Internet.

Fig. 4 shows an example of the application of the proposed system of secure interaction of a computer with the Internet to protect an automated system consisting of three user computers from malicious software effects originating from the Internet and from the leakage of confidential information into the Internet.

Fig. 5 shows an example of working with the Internet on a stand-alone computer 1. In web browser 3, a web page is opened at the URL address of web server 2, for example, 192.168.1.1.

This web page is an “entry point” through which the user of the stand-alone computer 1, connected to the web server 2, can enter commands and information for subsequent transmission to the network computer 5, and also receive information from the video camera 6, transmitting the display screen 8 of the network computer 5. As an example, in Fig. 5, in the window of the web browser 3, an image of the web browser 11, launched on the network computer 5, with the open website https://patents.google.com/ is visible.

The system for secure interaction of a computer with the Internet network includes a stand-alone computer 1 with an installed web browser 3, a web server 2, a device for simulating user input 4, a network computer 5 with an installed web browser 11, a video camera 6, a display 8, a communication channel 10, and may include an imitator of a wireless access point 9 to the Internet network. The network computer 5 with an installed web browser 11 is connected to the Internet network 7, system components 1, 2, 4, 6, 8, 9, 10 are not connected to the Internet network 7. A video camera 6, which films the display screen 8 of a network computer 5 with an open web browser 11, is connected to a web server 2 in such a way that a video signal from the camera is transmitted to the web server 2 and then the web server 2 organizes a video broadcast to the web browser 3 installed on the stand-alone computer 1 (as shown in Fig. 5). The video broadcast can be organized by one of the known methods (see, for example, CN 108337528 B).

A communication channel 10 is organized between the autonomous computer 1 and the web server 2, via which the web server 2 transmits a video broadcast from the video camera 6 to the autonomous computer 1, and the autonomous computer 1 transmits to the web server 2 the data entered by the user using the information input devices (keyboard, mouse, touch screen, etc.). This communication channel may include a wireless access point simulator 9 to the Internet 7, not connected to the Internet, connected to the web server 2 via a wired, fiber-optic or radio channel, with which the autonomous computer 1 interacts via a radio channel using standard wireless access protocols (Wi-Fi, Bluetooth, etc.). Web server 2 receives data from the data stream from stand-alone computer 1 from the input devices of stand-alone computer 1 (keyboard, mouse, touch screen, etc.) and transmits them to the device for simulating user input 4, which inputs into network computer 5 the data entered by the user of stand-alone computer 1 into web browser 3.

As a stand-alone computer 1, web server 2, and network computer 5, a computing device of any type that has the ability to interact with other computing devices on a network can be used: a computer, laptop, smartphone, tablet PC, etc. Web server 2 should, in addition, have the ability to connect video cameras 6 and organize video broadcasting from them to devices connected to it via communication channel 10. Fig. 4 shows that one web server can be used in several proposed systems, organizing video broadcasting in time-sharing mode to several stand-alone computers from several video cameras, and transmitting information to devices simulating user input connected to the corresponding network computers.

The video camera 6 must be able to connect to the web server 2 using one of the USB, HDMI and similar interfaces (see, for example, patent US 20220109818 A1).

The device for simulating user input 4 in the case of using a conventional computer as a stand-alone and network computers 1 and 5 can be implemented on the basis of a hardware simulator of a keyboard and mouse (see, for example, patent CN 104503822 A), sending electrical signals to the input/output ports of the network computer 5, repeating signals from a real keyboard and mouse connected to the stand-alone computer 1.

The device for simulating user input 4 in the case of using a smartphone or tablet PC as a stand-alone and network computers 1 and 5 can be implemented on the basis of a robot, originally intended for testing touch screens (see patent US 20160089792 A1 and the website https://tactileautomation.com/shop/touch-panel-test-systems/robotic-touch-panel-tester-taktouch-1000/ with a demonstration of the robot's operation), entering information into a device with a touch screen (network computer 5) using a mechanical manipulator, repeating the movements of the user of stand-alone computer 1.

IMPLEMENTATION OF THE INVENTION

During normal interaction of a computer with the Internet, arbitrary information can be transmitted by the user from his computer to the Internet and received by the computer from the Internet. This creates a threat of leakage of confidential information from the computer to the Internet and a threat of receiving malicious software impact on the computer from the Internet.

The proposed method and system for secure interaction of a computer with the Internet operate as follows. The user of the stand-alone computer 1 sees the Internet pages opened on the network computer 5 in the web browser 11 in the form of a video broadcast in the web browser 3 and enters requests to open Internet pages and perform actions on the Internet pages opened on the network computer 5, working with the video broadcast opened in the web browser 3 as with a regular web browser. The requests of the user of the stand-alone computer 1 are transmitted to the web server 2 via the communication channel 10. The web server 2 selects from the data stream from the stand-alone computer 1 the data received by the stand-alone computer 1 from the information input devices and transmits them to the device 4 for simulating information input by the user. The device 4 for simulating user input enters the data received from the web server into the network computer 5. The video camera 6 films the display screen 8 of the network computer 5 with the open web browser 11 with the Internet pages requested by the user and transmits the video broadcast to the web server 2, which in turn transmits this video broadcast to the autonomous computer 1 via the communication channel 10.

Let us describe step by step the user's interaction with the Internet on a stand-alone computer 1 with a web browser 3 when working in the proposed system.

1. The user opens web browser 3 on standalone computer 1.

2. The user enters the URL of the web server 2.

3. In the window of the web browser 3 of the stand-alone computer 1, the screen of the display 8 of the network computer 5 with the open web browser 11 is displayed, broadcast by the video camera 6 (see Fig. 5).

4. The user hovers the mouse cursor over the address bar in the web browser image 11 and enters the address of the requested website.

5. Data about the mouse movement and the entered text are transmitted by web browser 3 to web server 2.

6. Web server 2 transmits the received data to device 4 for simulating user input.

7. The device 4 for simulating user input enters the received data into the network computer 5.

8. Network computer 5 enters the received data into web browser 11.

9. Network computer 5, using web browser 11, opens the web site requested by the user if its address is entered in full, or displays part of the entered address, or moves the mouse cursor toward the address bar.

10. Video camera 6 transmits the updated image of display screen 8 to web server 2.

11. Web server 2 transmits the updated image of display screen 8 to stand-alone computer 1.

12. The stand-alone computer transmits the updated image of the display screen 8 to the web browser 3.

13. Web browser 3 updates the displayed screen of display 8 of network computer 5 with open web browser 11, showing the user the requested website or the data that he managed to enter (moved mouse cursor, part of the entered website address).

It should be noted that steps 1-13 are performed with each new movement of the "mouse" and entered character. Thus, the user does not see the difference between direct work with the web browser 11 and work with the video broadcast from the display screen 8 with the web browser 11 open.

The proposed method and system for secure interaction of a computer with the Internet network make it possible to protect against the threat of malicious software impact on the autonomous computer 1 from the Internet network by completely isolating the autonomous computer 1 from Internet traffic. Information from the Internet network 7 is transmitted to the user's autonomous computer 1 exclusively through the web server 2 in the form of a video broadcast from a video camera 6, which films the display screen of the network computer 5, on which a web browser is open with Internet pages requested by the user of the autonomous computer 1.

The video camera 6, the autonomous computer 1, the device for simulating user input 4, the communication channel 10 and the web server 2 are located in an isolated network segment not connected to the Internet. This eliminates the possibility of malicious software impacts on these components of the proposed system from the Internet 7.

The proposed method and system for secure interaction of a computer with the Internet make it possible to significantly complicate the transfer of confidential information from the stand-alone computer 1 to the Internet by limiting the volume of information transferred to the Internet to data manually entered by the user using the input devices of the stand-alone computer 1. This allows the user to fully receive information from the Internet in the form of an image of Internet pages opened in the web browser 11 on the network computer 5, but does not allow for the rapid transfer of information from the stand-alone computer 1 to the Internet using the method of copying and pasting information. For example, a text document of 30 pages contains approximately 55,000 characters. When working with the proposed system and manually entering text at a speed of 5 characters per second, the transfer of the contents of this document to the Internet will take about 3 hours of continuous operation. The transfer of non-text (for example, graphic) information is much more difficult when working with the proposed system. For example, to transfer a color photo measuring 1024×768 pixels, you will need to manually enter the colors of 786432 pixels. Transferring files from a stand-alone computer 1 to the Internet is also impossible.

In the absence of the proposed system, it is possible to transmit a large amount of information to the Internet by sending files or by copying and pasting into a form on a web page in a few seconds.

However, operations such as entering a website address, or entering a search query to find information on the Internet, or clicking on a link on a website do not require the transfer of a large amount of information and are performed without difficulty.

In this way, effective protection of the automated system, including the autonomous computer 1, is ensured both from the internal threat of leakage of confidential information from the autonomous computer 1 to the Internet, and from the external threat of malicious software impact on the autonomous computer 1 from the Internet without losing the ability to receive information from the Internet from the autonomous computer 1.

In the above description, embodiments of the present invention are described for clarity with reference to specific functional circuits and blocks.

However, it is understood that any suitable distribution of the functionality between different functional circuits or units may be used without prejudice to the present invention. For example, the shown functionality to be implemented by separate servers, computers or units may be implemented by the same server, computer or unit. Therefore, references to specific functional blocks or circuits should be considered only as references to suitable means for providing the described functionality, and not as an indication of a strict logical or physical structure of the system. The present invention may be implemented in any suitable form, including hardware, software or any combination of both. Although the present invention has been described in connection with certain embodiments, this should not be construed as limiting it to the specific form set forth herein. Rather, the scope of the present invention is limited only by the appended claims. Further, although individual features may be included in different claims, they may possibly be effectively combined, and inclusion in different claims does not mean that the combination of features is impracticable and/or disadvantageous. Furthermore, the order of the features in the claims does not indicate the specific order in which these features must be applied.

Taking into account the above, it can be concluded that the essential features of the claimed invention are not known from the prior art and ensure full compliance of the claimed invention with the patentability conditions of “novelty” and “inventive step”.

The claimed invention can be used in industry to organize secure interaction between a computer and the Internet.

Thus, the claimed invention satisfies the patentability condition of “industrial applicability”.

Claims (19)

1. A system for secure interaction between a computer and the Internet, comprising a stand-alone computer 1, a web server 2, a device for simulating user input 4, a network computer 5, a video camera 6, a network computer display 8, a communication channel 10, wherein the stand-alone computer 1 is connected to the web server 2 via the communication channel 10, the web server 2 is connected to a device 4 for simulating user input, the device 4 for simulating user input is connected to the network computer 5, the video camera 6 is directed at the display screen 8 of the network computer and is connected to the web server 2, wherein the stand-alone computer 1 has a web browser 3 installed, configured to display web pages received from the web server, wherein the network computer 5 has a web browser 11 installed, configured to display web pages received from the Internet 7, wherein the autonomous computer 1 is configured to send, via communication channel 10, information entered by the user into the web browser 3 of the autonomous computer to the web server 2; the web server 2 is configured to receive information from the autonomous computer 1 and extract signals from it from the information input devices of the autonomous computer 1 and transmit them to the device 4 for simulating user input; the device 4 for simulating user input is designed with the ability to repeat the signals received from the input devices of the autonomous computer 1 and transmit them to the input/output ports of the network computer 5; network computer 5 is connected to the Internet network 7 and is configured to interact with the Internet network 7 to display web pages in the web browser 3 of network computer 5 after receiving input signals from the device 4 for simulating user input; video camera 6 is designed with the ability to shoot from the display screen 8 of network computer 5 web pages displayed as a result of receiving input signals from device 4 for simulating user input, and transmitting the video broadcast to web server 2; web server 2 is designed with the ability to receive a video broadcast from video camera 6, generate web pages containing a video broadcast from video camera 6, and transmit them to autonomous computer 1 via a communication channel. 2. The system according to item 1, characterized in that the autonomous computer 1, web server 2, device for simulating user input 4, video camera 6, display 8 and communication channel 10 are not connected to the Internet network 7. 3. The system according to item 1, characterized in that the web browser 11 is constantly open on the network computer 5 in full-screen mode. 4. The system according to claim 1, characterized in that the input devices of the autonomous computer 1 are a keyboard and a mouse, and the device 4 for simulating the input of information by the user repeats the signals sent by the keyboard and mouse of the autonomous computer 1 and transmits them to the input/output ports of the network computer 5. 5. The system according to claim 1, characterized in that the stand-alone computer 1 and the network computer 5 are tablet computers of the same model, and the device for inputting information of the stand-alone computer 1 is a touch screen, and the device 4 for simulating user input of information is made in the form of a robot that inputs information into the network computer 5 by moving the manipulator along the touch screen of the network computer 5, repeating the movement of the fingers of a person working with the stand-alone computer 1. 6. The system according to item 1, characterized in that the autonomous computer 1 and the network computer 5 are smartphones of the same model, and the device for inputting information of the autonomous computer 1 is a touch screen, and the device 4 for simulating user input of information is made in the form of a robot that inputs information into the network computer 5 by moving the manipulator along the touch screen of the network computer 5, repeating the movement of the fingers of a person working with the autonomous computer 1. 7. The system according to item 1, characterized in that the autonomous computer 1 and the web server 2 interact via a wired communication channel. 8. The system according to claim 1, characterized in that the autonomous computer 1 and the web server 2 interact via a fiber-optic communication channel. 9. The system according to item 1, characterized in that the autonomous computer 1 and the web server 2 interact via a radio channel. 10. The system according to claim 1, characterized in that the communication channel 10 between the autonomous computer 1 and the web server 2 includes a simulator 9 of a wireless access point to the Internet network, implementing the standard protocol of a wireless access point to the Internet network Wi-Fi or Bluetooth, but not connected to the Internet network 7, wherein the simulator is connected to the web server 2 via a wired, fiber-optic or radio channel, and the autonomous computer 1 is connected to the simulator 9 via a radio channel using the standard Wi-Fi or Bluetooth protocol. 11. A method for secure interaction of a computer with the Internet, which consists of sending by a stand-alone computer 1 via communication channel 10 information entered by a user into a web browser 3 on the stand-alone computer 1 to a web server 2, which extracts signals from the information input devices of the stand-alone computer 1 from this information and enters them into a network computer 5 using a device 4 for simulating user input connected to the network computer 5, wherein the web server 2 receives a video broadcast signal from a video camera 6 filming the display screen 8 of the network computer 5, generates and transmits the Internet pages received and opened in the web browser 11 by the network computer 5 to the stand-alone computer 1 in the form of a web page containing a video broadcast from the video camera 6 filming the display screen 8 of the network computer 5 with the web browser 11 open, and the stand-alone computer 1 displays in the web browser 3 the web pages received from the web server 2. 12. The method according to item 11, characterized in that the autonomous computer 1, web server 2, device for simulating user input 4, video camera 6, display 8 and communication channel 10 are not connected to the Internet network 7. 13. The method according to item 11, characterized in that the network computer 5 is connected to the Internet network 7 and is designed with the ability to interact with the Internet network 7.