Systems and methods for computer security

• US 20050262566A1
• Filed: 05/19/2004
• Published: 11/24/2005
• Est. Priority Date: 05/19/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Gassoway, Paul
• Granted Patent: US 8,407,792 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method for maintaining computer security comprises receiving an incoming email destined for an email server, determining whether the received incoming email is infected with malicious code and blocking the incoming email determined to be infected with malicious code from reaching the email server.

Claims

1. A method for maintaining computer security comprising:

receiving an incoming email destined for an email server;

determining whether the received incoming email is infected with malicious code; and

blocking the incoming email determined to be infected with malicious code from reaching the email server.

2. The method of claim 1, wherein determining whether the received incoming email is infected with malicious code comprises:

parsing the incoming email;

converting the incoming email into an internal format; and

using a virus signature file to determine whether the converted incoming email includes malicious code.

3. The method of claim 2, further comprising reassembling the converted incoming email back into its original format if it is determined that the email does not include malicious code.

4. The method of claim 3, further comprising forwarding the reassembled email to the email server.

5. The method of claim 2, wherein the virus signature file contains information about known email viruses.

6. The method of claim 5, wherein the virus signature file contains known viruses that may be included in a body of the email itself and in attachments to the email.

7. The method of claim 2, further comprising continuously updating the virus signature file.

8. The method of claim 2, further comprising periodically downloading an updated virus signature file in order to make its copy current.

24. The computer system of claim 2, further comprising a system for periodically downloading an updated virus signature file in order to make its copy current.

9. A method for maintaining computer security comprising:

receiving an email from an email server destined for an end user;

determining whether the received email is infected with malicious code; and

blocking the received email determined to be infected with malicious code from reaching the end user.

10. The method of claim 9, wherein determining whether the received email is infected with malicious code comprises:

parsing the received email;

converting the received email into an internal format; and

using a virus signature file to determine whether the converted email includes malicious code.

11. The method of claim 10, further comprising reassembling the converted email back into its original format if it is determined that the email does not include malicious code.

12. The method of claim 11, further comprising forwarding the reassembled email to the end user.

13. The method of claim 10, wherein the virus signature file contains information about known email viruses.

14. The method of claim 13, wherein the virus signature file contains known viruses that may be included in a body of the email itself and in attachments to the email.

15. The method of claim 10, further comprising continuously updating the virus signature file.

16. The method of claim 10, further comprising periodically downloading an updated virus signature file in order to make its copy current.

27. The computer system of claim 10, further comprising a system for reassembling the converted email back into its original format if it is determined that the email does not include malicious code.

28. The computer system of claim 27, further comprising a system for forwarding the reassembled email to the end user.

17. A computer system for maintaining computer security comprising:

a system for receiving an incoming email destined for an email server;

a system for determining whether the received incoming email is infected with malicious code; and

a system for blocking the incoming email determined to be infected with malicious code from reaching the email server.

18. The computer sytstem of claim 17, wherein the system for determining whether the received incoming email is infected with malicious code comprises:

a system for parsing the incoming email;

a system for converting the incoming email into an internal format; and

a system for using a virus signature file to determine whether the converted incoming email includes malicious code.

19. The computer system of claim 18, further comprising a system for reassembling the converted incoming email back into its original format if it is determined that the email does not include malicious code.

20. The computer system of claim 19, further comprising a system forwarding the reassembled email to the email server.

21. The computer system of claim 18, wherein the virus signature file contains information about known email viruses.

22. The computer system of claim 21, wherein the virus signature file contains known viruses that may be included in a body of the email itself and in attachments to the email.

23. The computer system of claim 18, further comprising a system for continuously updating the virus signature file.

25. A computer system for maintaining computer security comprising:

a system for receiving an email from an email server destined for an end user;

a system for determining whether the received email is infected with malicious code; and

a system for blocking the received email determined to be infected with malicious code from reaching the end user.

26. The computer system of claim 25, wherein the system for determining whether the received email is infected with malicious code comprises:

a system for parsing the received email;

a system for converting the received email into an internal format; and

a system for using a virus signature file to determine whether the converted email includes malicious code.

29. The computer system of claim 26, wherein the virus signature file contains information about known email viruses.

30. The computer system of claim 29, wherein the virus signature file contains known viruses that may be included in a body of the email itself and in attachments to the email.

31. The computer system of claim 26, further comprising a system for continuously updating the virus signature file.

32. The computer system of claim 26, further comprising a system for periodically downloading an updated virus signature file in order to make its copy current.

33. A computer recording medium including computer executable code for maintaining computer security comprising:

code for receiving an incoming email destined for an email server;

code for determining whether the received incoming email is infected with malicious code; and

code for blocking the incoming email determined to be infected with malicious code from reaching the email server.

34. The computer recording medium of claim 33, wherein the code for determining whether the received incoming email is infected with malicious code comprises:

code for parsing the incoming email;

code for converting the incoming email into an internal format; and

code for using a virus signature file to determine whether the converted incoming email includes malicious code.

35. The computer recording medium of claim 34, further comprising code for reassembling the converted incoming email back into its original format if it is determined that the email does not include malicious code.

36. The computer recording medium of claim 35, further comprising code for forwarding the reassembled email to the email server.

37. The computer recording medium of claim 34, wherein the virus signature file contains information about known email viruses.

38. The computer recording medium of claim 37, wherein the virus signature file contains known viruses that may be included in a body of the email itself and in attachments to the email.

39. The computer recording medium of claim 34, further comprising code for continuously updating the virus signature file.

40. The computer recording medium of claim 34, further comprising code for periodically downloading an updated virus signature file in order to make its copy current.

41. A computer recording medium including computer executable code for maintaining computer security comprising:

code for receiving an email from an email server destined for an end user;

code for determining whether the received email is infected with malicious code; and

code for blocking the received email determined to be infected with malicious code from reaching the end user.

42. The computer recording medium of claim 41, wherein the code for determining whether the received email is infected with malicious code comprises:

code for parsing the received email;

code for converting the received email into an internal format; and

code for using a virus signature file to determine whether the converted email includes malicious code.

43. The computer recording medium of claim 42, further comprising code for reassembling the converted email back into its original format if it is determined that the email does not include malicious code.

44. The computer recording medium of claim 43, further comprising code for forwarding the reassembled email to the end user.

45. The computer recording medium of claim 42, wherein the virus signature file contains information about known email viruses.

46. The computer recording medium of claim 45, wherein the virus signature file contains known viruses that may be included in a body of the email itself and in attachments to the email.

47. The computer recording medium of claim 42, further comprising code for continuously updating the virus signature file.

48. The computer recording medium of claim 42, further comprising code for periodically downloading an updated virus signature file in order to make its copy current.