Content sanitation via transcoding

• US 20030196104A1
• Filed: 04/10/2002
• Published: 10/16/2003
• Est. Priority Date: 04/10/2002
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Wesley, Ajamu A., Baber, Stephen C.
• Granted Patent: US 7,171,691 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A content sanitization process performed via a transcoding engine. The transcoding engine can include one or more patterns, each pattern identifying malicious content in a well-formed document. The transcoding engine also can include an annotation processor configured to annotate portions of the well-formed document which match the patterns. Finally, the transcoding engine can include a content sanitization processor configured to normalize the annotated portions in a transcoded document. In a preferred aspect of the invention, the transcoding engine can include a privacy policy resolution processor configured to identify terms of a privacy policy and to annotate portions of the well-formed document which violate the terms.

Claims

1. A transcoding engine comprising:

a plurality of patterns, each said pattern identifying malicious content in a well-formed document;

an annotation processor configured to annotate portions of said well-formed document which match said patterns; and

,

a content sanitization processor configured to normalize said annotated portions in a transcoded document.

2. The transcoding engine of claim 1, further comprising a privacy policy resolution processor configured to identify terms of a privacy policy and to annotate portions of said well-formed document which violate said terms.

3. The transcoding engine of claim 1, wherein said patterns comprise a set of Xpath expressions.

4. The transcoding engine of claim 1, wherein said patterns comprise a set of extensible stylesheet (XSL) transformation expressions.

5. The transcoding engine of claim 1, wherein said patterns comprise a set of Xpath and XSL transformation expressions.

6. The transcoding engine of claim 1, wherein said privacy policy resolution process has been configured to particularly process privacy policies specified according to the Platform for Privacy Preferences (P3P).

7. A content sanitization method, the method comprising the steps of:

ensuring that a subject document has been well-formed;

locating malicious content in said well-formed document;

annotating said malicious content for further processing; and

, transcoding said well-formed document, said transcoding producing a transcoded document, but excluding said annotated content from said transcoded document.

8. The method of claim 7, further comprising the steps of:

accessing a privacy policy, said privacy policy comprising one or more privacy terms;

locating content in said well-formed document which violates one or more of said privacy terms in said privacy policy; and

,

annotating said located content which violates said privacy terms.

9. The method of claim 7, wherein said locating step comprises the step of locating fields of a form element which contain candidate text that can be interpreted as malicious content, and wherein said annotating step comprises the step of annotating said located fields for further processing.

10. The method of claim 9, wherein said transcoding step further comprises the steps of:

determining whether said annotated fields can be normalized;

if it is determined that said annotated fields can be normalized, normalizing said annotated fields; and

,

if it is determined that said annotated fields cannot be normalized, discarding said form element during said transcoding step.

11. The method of claim 10, wherein said normalizing step comprises one of the steps of truncating said annotated fields, and re-factoring said annotated fields.

12. A machine readable storage having stored thereon a computer program for performing content sanitization, said computer program comprising a routine set of instructions for causing the machine to perform the steps of:

ensuring that a subject document has been well-formed;

locating malicious content in said well-formed document;

annotating said malicious content for further processing; and

,

transcoding said well-formed document, said transcoding producing a transcoded document, but excluding said annotated content from said transcoded document.

13. The machine readable storage of claim 12, further comprising the steps of:

accessing a privacy policy, said privacy policy comprising one or more privacy terms;

locating content in said well-formed document which violates one or more of said privacy terms in said privacy policy; and

,

annotating said located content which violates said privacy terms.

14. The machine readable storage of claim 12, wherein said locating step comprises the step of locating fields of a form element which contain candidate text that can be interpreted as malicious content, and wherein said annotating step comprises the step of annotating said located fields for further processing.

15. The machine readable storage of claim 14, wherein said transcoding step further comprises the steps of:

determining whether said annotated fields can be normalized;

if it is determined that said annotated fields can be normalized, normalizing said annotated fields; and

,

if it is determined that said annotated fields cannot be normalized, discarding said form element during said transcoding step.

16. The machine readable storage of claim 15, wherein said normalizing step comprises one of the steps of truncating said annotated fields, and re-factoring said annotated fields.