Apparatus and methods for intercepting, examining and controlling code, data and files and their transfer

• US 20020129237A1
• Filed: 03/06/2001
• Published: 09/12/2002
• Est. Priority Date: 03/06/2001
• Status: Active Grant

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Radatti, Peter V., Eliseo, Timothy R.
• Granted Patent: US 7,404,212 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention comprises apparatus and methods for processing code, that is, for intercepting, examining and/or controlling code streams in a network. “Man in the middle” technology by use of decryptor/encryptor components are placed between client and server which permit alteration of the code as it passes through a communications channel. The code may then be examined by way of a proscribed code scanner. A protocol parser may also be implemented in order to intercept the code as it passes through the stack and transfer the code to the decryptor/encryptor components.

Claims

1. An apparatus for processing altered code comprising:

a decryptor; and

,

a proscribed code scanner;

wherein said decryptor decrypts said code in order that said proscribed code scanner processes said code for the presence of proscribed code.

2. An apparatus as in claim 1 further comprising an encryptor, wherein said code, after being processed by said proscribed code scanner, may be reencrypted by said encryptor.

3. An apparatus as in claim 1 further comprising a protocol parser, wherein said code is intercepted by said protocol parser as it passes through a communications channel.

4. An apparatus for processing secure code transmitted through a communications channel comprising:

a protocol parser;

a decryption component; and

,

a proscribed code scanner;

wherein said protocol parser intercepts secure code being transmitted through said communications channel and transfers said code to said decryption component for decryption and scanning by said proscribed code scanner.

5. An apparatus as in claim 4 further comprising an encryptor, wherein said code, after being processed by said proscribed code scanner, may be reencrypted by said encryptor.

6. An apparatus as in claim 5, further comprising an SSL decryptor.

7. An apparatus as in claim 5, further comprising an S/MIME decryptor.

8. A method for processing altered code comprising:

decrypting said code;

scanning said code for the presence of proscribed code; and

,

providing an indicator for the presence of said proscribed code.

9. A method as in claim 8 further comprising the step of:

reencrypting said code if said indicator is negative.

10. A method as in claim 8 further comprising the step of:

further indicating the presence of said proscribed code if said indicator is positive.

11. A method as in claim 8 wherein the step of decrypting said code is preceded by the step of intercepting said code prior to decrypting said code.

13. A method as in claim 12 wherein said code is secured through SSL encryption.

14. A method as in claim 12 wherein said code is secured through S/MIME encryption.

15. A method as in claim 12 further comprising the step of:

reencrypting said code if said indicator is negative.

16. A method as in claim 12 further comprising the step of:

further indicating the presence of said proscribed code if said indicator is positive.

17. A method as in claim 12 further comprising the step of providing a separate system inserted in said communications channel, and with at least one of said steps of intercepting said code;

decrypting said code;

scanning said code for the presence of proscribed code, and providing an indicator for the presence of said proscribed code, occurring on said separate machine.

12. A method for processing secure code transmitted through a communications channel comprising:

intercepting said code;

decrypting said code;

scanning said code for the presence of proscribed code; and

,

providing an indicator for the presence of said proscribed code.