Denying unauthorized access to a private data processing network
View Patent ↗Systems and methods for denying access to a data processing system by an intruder are provided. Input/output (I/O) on the intruder's connection may be taken over and responses mimicking a local terminal session passed back. On an attempted reconnect by the intruder, the user name and password used by the intruder to access the system may be captured. The password may then be changed on the edge system and the intruder's terminal session disconnected, or alternatively, continue to log the intruder's activity.
1. A computer program product for denying an intruder access embodied in a non-transitory computer-readable storage medium, the program product comprising instructions for:
receiving an identifier of a socket corresponding to an intruder terminal session from an intruder detection system;
passing a broken connection message to the terminal session;
outputting responses on said socket in reply to intruder input, said responses having characteristics of a local terminal session; and
listening for a login request from the intruder, said login request directed to an edge node of a data processing network.
2. The computer program product of claim 1 further comprising programming instructions for, if said login request is received, capturing a login identifier and a password in response to the login request.
3. The program product of claim 2 further comprising programming instructions for sending a login prompt on said socket in response to said login request, wherein the login identifier is received in response to said login prompt.
4. The program product of claim 2 further comprising programming instructions for:
logging into the edge node using the login identifier and the password; and
changing the password.
5. The program product of claim 4 further comprising programming instructions for forking a subprocess, wherein the steps of logging into the edge node and changing the password are performed by the subprocess.
6. The program product of claim 5 further comprising programming instructions for disconnecting the socket.
7. The program product of claim 5 further comprising programming instructions for:
returning a login error message to said intruder if the step of changing the password fails; and
prompting the intruder to retry a login.
8. A data processing system for denying an intruder access comprising:
circuitry operable for receiving an identifier of a socket corresponding to an intruder terminal session from an intruder detection system;
circuitry operable for passing a broken connection message to the terminal session;
circuitry operable for outputting responses on said socket in reply to intruder input, said responses having characteristics of a local terminal session; and
circuitry operable for listening for a login request from the intruder, said login request directed to an edge node of a data processing network.
9. The data processing system of claim 8 further comprising circuitry operable for, if said login request is received, capturing a login identifier and a password in response to the login request.
10. The data processing system of claim 9 further circuitry operable for sending a login prompt on said socket in response to said login request, wherein the login identifier is received in response to said login prompt.
11. The data processing system of claim 9 further comprising:
circuitry operable for logging into the edge node using the login identifier and the password; and
circuitry operable for changing the password.
12. The data processing system of claim 11 further comprising circuitry operable for forking a subprocess, wherein the steps of logging into the edge node and changing the password are performed by the subprocess.
13. The program product of claim 12 further comprising circuitry operable for logging intruder activity on the socket.