Resisting the spread of unwanted code and data

• US 10,419,456 B2
• Filed: 07/29/2016
• Issued: 09/17/2019
• Est. Priority Date: 06/09/2005
• Status: Active Grant

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Scales, Nicholas John
• Primary Examiner(s): Tolentino, Roderick
• Assistant Examiner(s): Jackson, Jenise E
• Application Number:
  US15/223,257
• Publication Number:
  US 20160337381A1
• Time in Patent Office: 1,145 Days
• Field of Search: 726 24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method or system of receiving an electronic file containing content data in a predetermined data format, the method comprising the steps of: receiving the electronic file, determining the data format, parsing the content data, to determine whether it conforms to the predetermined data format, and if the content data does conform to the predetermined data format, regenerating the parsed data to create a regenerated electronic file in the data format.

Claims

1. A method for processing an electronic file to create a substitute electronic file containing only allowable content data, the method comprising:

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the electronic file and an associated set of rules specifying allowable content data;

determining at least an allowable portion of the content data that conforms with the associated set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, the at least an allowable portion of the content data;

creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted allowable content data;

forwarding the substitute electronic file; and

forwarding the electronic file if a portion, part or whole of the content data does not conform only when an intended recipient of the electronic file has pre-approved the purported predetermined file type when associated with the sender of electronic file,

wherein the electronic file is not scanned for unwanted code.

2. The method according to claim 1 in which the associated set of rules is a subset of a set of rules for each file type.

3. The method according to claim 1 comprising determining whether the content data conforms to prior known examples of acceptable data.

4. The method according to claim 3 in which the associated set of rules specifies values or range of values that includes only allowable control characters.

5. The method according to claim 3 in which the associated set of rules specifies values or range of values that define predetermined size limits.

6. The method according to claim 5 wherein one of the predetermined size limit is a size of a line in an image file.

7. The method according to claim 1 further comprising storing the electronic file in a scrambled format in memory.

8. The method according to claim 7, wherein each byte of data is stored in a bit reversed order.

9. The method according to claim 7, wherein the data is stored such that each pair of data bytes received is placed in a reversed memory order.

10. The method according to claim 1, further comprising replacing any content data that does not conform with warning text.

11. The method according to claim 1, wherein the electronic file is an e-mail and the method further comprises forwarding a substitute e-mail to the intended recipient if the content data conforms to the associated set of rules.

12. The method according to claim 11, wherein the substitute e-mail is forwarded from an e-mail client to a hard disk drive.

13. The method according to claim 1, wherein the substitute e-mail is forwarded from an Internet server provider server to an e-mail client server.

14. The method according to claim 1, further comprising receiving the electronic file from a removable memory device, and forwarding the substitute electronic file to a computing device.

15. A device for processing an electronic file to create a substitute electronic file containing only allowable content data comprising:

a memory; and

a computer processor in communication with the memory, the processor executes a program stored in said memory to perform the steps of;

receiving an electronic file, said file containing content data in a pre-determined data file type;

determining a purported predetermined file type of the electronic file and an associated set of rules specifying allowable content data;

determining at least an allowable portion of the content data that conforms with the associated set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, the at least an allowable portion of the content data;

creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted at least an allowable portion of the content data;

forwarding the substitute electronic file; and

forwarding the electronic file if a portion, part or whole of the content data does not conform only when an intended recipient of the electronic file has preapproved the purported predetermined file type when associated with the sender of the electronic file,

wherein the electronic file is not scanned for unwanted code.

16. A semiconductor device comprising:

a memory for storing computer instructions executable by a computer to perform the steps of;

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the electronic file and an associated set of rules specifying allowable content data;

determining at least an allowable portion of the content data that conforms with the associated set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, the at least an allowable portion of the content data;

creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted at least an allowable portion of the content data;

forwarding the substitute electronic file; and

forwarding the electronic file if a portion, part or whole of the content data does not conform only when an intended recipient of the electronic file has pre-approved the purported predetermined file type when associated with the sender of the electronic file,

wherein the electronic file is not scanned for unwanted code.

17. The semiconductor device according to claim 16, wherein the semiconductor device is a semi-permanent or permanent memory device.

18. A network card comprising:

a semiconductor device configured to store computer instructions executable by a computer to perform the steps of;

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the electronic file and an associated set of rules specifying allowable content data;

determining at least an allowable portion of the content data that conforms with the associated set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, the at least an allowable portion of the content data;

creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted at least an allowable portion of the content data;

forwarding the substitute electronic file; and

forwarding the electronic file if a portion, part or whole of the content data does not conform only when an intended recipient of the electronic file has pre-approved the purported predetermined file type when associated with the sender of the electronic file,

wherein the electronic file is not scanned for unwanted code.

19. A non-transitory computer-readable storage medium comprising a computer program executable by a computer to perform the steps of:

receiving an electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the electronic file and an associated set of rules specifying allowable content data;

determining at least an allowable portion of the content data that conforms with the associated set of rules corresponding to the determined purported predetermined file type;

extracting, from the electronic file, the at least an allowable portion of content data;

creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted at least an allowable portion of the content data;

forwarding the substitute electronic file; and

forwarding the electronic file if a portion, part or whole of the content data does not conform only when an intended recipient of the electronic file has pre-approved the purported predetermined file type when associated with the sender of the electronic file,

wherein the electronic file is not scanned for unwanted code.