Apparatus and methods for intercepting, examining and controlling code, data and files and their transfer in instant messaging and peer-to-peer applications

• US 20040143763A1
• Filed: 04/06/2004
• Published: 07/22/2004
• Est. Priority Date: 02/03/1999
• Status: Active Grant

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Radatti, Peter V.
• Granted Patent: US 7,917,744 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention comprises apparatus and methods for processing instant messaging or peer-to-peer code, that is, for intercepting, examining and/or controlling instant messaging and/or peer-to-peer code in a network. A protocol parser is implemented in order to intercept the code as it passes through the channel and transfer the code to a proscribed code scanner. “Man in the middle” technology may be used as well through decryptor/encryptor components placed between client and server which permit examination of the code by a proscribed code scanner as it passes through a communications channel. Embodiments for various platforms, including Unix® and Windows® NT are disclosed.

Claims

1. ) An apparatus for processing code comprising:

a protocol parser; and

,

a proscribed code scanner;

whereby said protocol parser intercepts instant messaging or peer-to-peer code on a communications channel and transmits said code for review by said proscribed code scanner.

2. ) An apparatus as in claim 1 further comprising a translation means whereby said translation means translates said code to authorized program parameters.

3. ) An apparatus as in claim 1 further comprising a protocol scanner, whereby said protocol parser transmits said instant messaging or peer-to-peer code to said proscribed code scanner through said protocol scanner.

4. ) An apparatus as in claim 1 whereby said proscribed code scanner further comprises a scanning means and an indicator means.

5. ) An apparatus as in claim 1 further comprising a certification means.

6. ) An apparatus as in claim 4 whereby said indicator means provides an indication of the presence of proscribed code after scanning said intercepted code.

7. ) An apparatus as in claim 1, whereby said proscribed code scanner comprises a malicious code scanner.

8. ) An apparatus as in claim 1, wherein said protocol parser further comprises a configuration means for configuring interception parameters.

10. ) An apparatus as in claim 3, wherein said protocol scanner further comprises a configuration means for configuring interception parameters.

12. ) An apparatus as in claim 1, further comprising a decryption component, whereby said protocol parser intercepts said instant messaging or peer-to-peer code being transmitted through said communications channel and transfers said code to said decryption component for decryption and scanning by said proscribed code scanner.

13. ) An apparatus as in claim 12, further comprising an SSL decryption component.

14. ) An apparatus as in claim 12, further comprising an S/MIME decryption component.

15. ) An apparatus as in claim 1, further comprising an encryptor, wherein said code, after being processed by said proscribed code scanner, may be encrypted by said encryptor.

16. ) An apparatus as in claim 12, further comprising an encryptor, wherein said code, after being processed by said proscribed code scanner, may be encrypted by said encryptor.

9. ) An apparatus for processing code comprising:

a protocol parser; and

,

a proscribed code scanner;

whereby said protocol parser intercepts short messaging code on a communications channel and transmits said code for review by said proscribed code scanner.

11. ) An apparatus for processing code comprising:

a protocol parser;

a protocol scanner; and

,

a proscribed code scanner comprised of a scanning means and an indicator means;

whereby said protocol parser intercepts instant messaging or peer-to-peer code on a communications channel and transmits said code to said proscribed code scanner through said protocol scanner.

17. ) An apparatus for processing code comprising:

a protocol parser;

a proscribed code scanner;

a protocol scanner;

a decryption component, whereby said protocol parser intercepts instant messaging or peer-to-peer code on a communications channel and transfers said code to said decryption component for decryption and scanning by said proscribed code scanner.

18. ) A method for processing code comprising:

intercepting instant messaging or peer-to-peer code on a communications channel;

parsing said code; and

,

scanning said code for the presence of proscribed code; and

,

providing an indicator for the presence of said proscribed code.

19. ) A method as in claim 18 further comprising translating said code to authorized program parameters.

20. ) A method as in claim 18 further comprising said code.

21. ) A method as in claim 18 further comprising returning said code to said communication channel if said indicator is negative.

22. ) A method as in claim 18 further comprising transferring said code to another communication channel.

23. ) A method as in claim 18 further comprising further indicating the presence of said proscribed code if said indicator is positive.

24. ) A method as in claim 18 wherein intercepting said code further comprises intercepting the code according to configured parameters.

25. ) A method as in claim 18 wherein scanning said code for the presence of proscribed code further comprises scanning said code for the presence of malicious code.

26. ) A method as in claim 18 further comprising decrypting said code.

27. ) A method as in claim 26 further comprising reencrypting said code if said indicator is negative.

28. ) A method as in claim 18 further comprising encrypting said code.

29. ) A method as in claim 26 wherein decrypting said code is preceded by intercepting said code prior to decrypting said code.

30. ) A method as in claim 26 wherein said code is secured through SSL encryption.

31. ) A method as in claim 26 wherein said code is secured through S/MIME encryption.

32. ) A method as in claim 26 further comprising the step of:

reencrypting said code if said indicator is negative.

33. ) A method as in claim 26 further comprising providing a separate system inserted in said communications channel, and with at least one of said steps of intercepting said code;

decrypting said code;

scanning said code for the presence of proscribed code, and providing an indicator for the presence of said proscribed code, occurring on said separate machine.

34. ) A method for processing code comprising:

intercepting instant messaging or peer-to-peer code on a communications channel;

parsing said code;

scanning said code for the presence of proscribed code; and

,

providing an indicator for the presence of said proscribed code.

35. ) A method for processing code comprising:

intercepting instant messaging or peer-to-peer code on a communications channel;

decrypting said code

parsing said code;

scanning said code for the presence of proscribed code; and

,

providing an indicator for the presence of said proscribed code.

36. ) A method for processing code comprising:

intercepting instant messaging or peer-to-peer code on a communications channel;

parsing said code;

scanning said code for the presence of proscribed code; and

,

providing an indicator for the presence of said proscribed code.