Resisting the spread of unwanted code and data

• US 10,462,164 B2
• Filed: 02/04/2019
• Issued: 10/29/2019
• Est. Priority Date: 06/09/2005
• Status: Active Grant

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Scales, Nicholas John
• Primary Examiner(s): Tolentino, Roderick
• Assistant Examiner(s): Jackson, Jenise E
• Application Number:
  US16/267,189
• Publication Number:
  US 20190173895A1
• Time in Patent Office: 267 Days
• Field of Search: 726 24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of processing an electronic file to create a substitute electronic file containing only allowable content data, the method includes receiving, at a computer system, an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type, determining a purported predetermined file type of the incoming electronic file based upon the encoded and arranged content data, and an associated set of rules specifying allowable content data for the purported predetermined file type, determining nonconforming data in the content data that does not conform to the predetermined data format, determining that the nonconforming data is authorized, extracting, from the incoming electronic file, the nonconforming data, regenerating the nonconforming data to create the substitute electronic file in the purported file type, said substitute regenerated electronic file containing the nonconforming content data, if the nonconforming data is determined to be authorized, wherein the incoming electronic file is not scanned for unwanted code.

Claims

1. A method of processing an electronic file to create a substitute electronic file containing only allowable content data, the method comprising:

receiving, at a computer system, an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the incoming electronic file by analyzing the encoded and arranged content data, and an associated set of rules specifying allowable content data for the purported predetermined file type;

determining nonconforming data in the content data by determining that the nonconforming data does not conform to the predetermined data format;

determining that the nonconforming data is authorized by determining that the nonconforming data is not a threat;

extracting, from the incoming electronic file, the nonconforming data by removing the nonconforming data from the incoming electronic file; and

if the nonconforming data is determined to be authorized, regenerating the nonconforming data to create the substitute electronic file in the purported file type by inserting the nonconforming content data into the substitute electronic file,

wherein the incoming electronic file is not scanned for unwanted code.

2. The method according to claim 1 in which the data format corresponds to a subset of the predetermined set of rules for each file type.

3. The method according to claim 1, further comprising:

determining conforming data in the content data that conforms to the predetermined data format, including determining whether the conforming content data conforms to prior known examples of acceptable data.

4. The method according to claim 3 in which the data format only includes allowable control characters.

5. The method according to claim 3 in which the data format contains a plurality of data items, each with an associated predetermined size limit.

6. The method according to claim 5 wherein the predetermined size limit is the size of a line in an image file.

7. The method according to claim 1, wherein:

the method further comprises storing the incoming electronic file in a scrambled format in memory;

parsing the content data includes parsing the content data in the scrambled format in the memory in accordance with the predetermined data format comprising the set of rules corresponding to the determined purported predetermined file type; and

determining nonconforming data in the content data includes determining the nonconforming data in the content data in the scrambled format in the memory that does not conform to the predetermined data format.

8. The method according to claim 7, wherein each byte of data is stored in a bit reversed order.

9. The method according to claim 7, wherein the data is stored such that each pair of data bytes received is placed in a reversed memory order.

10. The method according to claim 1, further comprising forwarding the substitute regenerated electronic file only if the content data from within the electronic file is authorized.

11. The method according to claim 10 further comprising forwarding the incoming electronic file if a portion, part or whole of the content data does not conform only when the intended recipient of the electronic file has pre-approved the sender of the electronic file.

12. The method according to claim 1, further comprising replacing any content data that does not conform to the predetermined format with warning text.

13. The method according to claim 1, wherein the incoming electronic file is an e-mail and the method further comprises forwarding the regenerated e-mail to the intended recipient if the content data is authorized.

14. The method according to claim 13, wherein the substitute regenerated e-mail is forwarded from an e-mail client to a hard disk drive.

15. The method according to claim 13, wherein the substitute regenerated e-mail is forwarded from an Internet server provider server to an e-mail client server.

16. The method according to claim 1, further comprising receiving the incoming electronic file from a removable memory device, and forwarding the substitute regenerated electronic file to a computing device.

17. The method according to claim 1, further comprising:

determining conforming data in the content data that conforms to the predetermined data format;

determining the conforming data to be free of viral and otherwise unwanted code and data and suitable for regeneration; and

adding the conforming data to the substitute regenerated electronic file.

18. A non-transitory computer readable medium comprising a computer program configured to cause a processor to perform:

receiving, at a computer system, an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the incoming electronic file by analyzing the encoded and arranged content data, and an associated set of rules specifying allowable content data for the purported predetermined file type;

determining nonconforming data in the content data by determining that the nonconforming data does not conform to the predetermined data format;

determining that the nonconforming data is authorized by determining that the nonconforming data is not a threat;

extracting, from the incoming electronic file, the nonconforming data by removing the nonconforming data from the incoming electronic file; and

if the nonconforming data is determined to be authorized, regenerating the nonconforming data to create the substitute electronic file in the purported file type by inserting the nonconforming content data into the substitute electronic file,

wherein the incoming electronic file is not scanned for unwanted code.

19. A semiconductor device comprising a memory including instructions for performing:

receiving, at a computer system, an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the incoming electronic file by analyzing the encoded and arranged content data, and an associated set of rules specifying allowable content data for the purported predetermined file type;

determining nonconforming data in the content data by determining that the nonconforming data does not conform to the predetermined data format;

determining that the nonconforming data is authorized by determining that the nonconforming data is not a threat;

extracting, from the incoming electronic file, the nonconforming data by removing the nonconforming data from the incoming electronic file; and

if the nonconforming data is determined to be authorized, regenerating the nonconforming data to create the substitute electronic file in the purported file type by inserting the nonconforming content data into the substitute electronic file,

wherein the incoming electronic file is not scanned for unwanted code.

20. The semiconductor device according to claim 19, wherein the semiconductor device is a semi-permanent or permanent memory device.

21. A network card comprising a semiconductor device including a memory including instructions to cause a processor to:

receiving, at a computer system, an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the incoming electronic file by analyzing the encoded and arranged content data, and an associated set of rules specifying allowable content data for the purported predetermined file type;

determining nonconforming data in the content data by determining that the nonconforming data does not conform to the predetermined data format;

determining that the nonconforming data is authorized by determining that the nonconforming data is not a threat;

extracting, from the incoming electronic file, the nonconforming data by removing the nonconforming data from the incoming electronic file; and

if the nonconforming data is determined to be authorized, regenerating the nonconforming data to create the substitute electronic file in the purported file type by inserting the nonconforming content data into the substitute electronic file,

wherein the incoming electronic file is not scanned for unwanted code.