METHOD AND APPARATUS FOR IMMUNIZING DATA IN COMPUTER SYSTEMS FROM CORRUPTION

• US 20060168053A1
• Filed: 11/10/2005
• Published: 07/27/2006
• Est. Priority Date: 11/19/2004
• Status: Active Grant

• Current Assignee: Jerrold M. Deisenroth, J Michael Greata
• Original Assignee: Jerrold M. Deisenroth, J Michael Greata
• Inventors: Greata, J Michael, Deisenroth, Jerrold M
• Granted Patent: US 8,131,804 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system for immunizing a computer network against adverse effects caused by the receipt of a corrupting message. Each message transfers into a protocol-based controlled environment for a specific recipient where message criteria determine whether the incoming message is deemed to be a valid or suspicious message. Transmission criteria determine the final message disposition. If the message is valid, it is delivered to a recipient computer system in the network. If the incoming message is suspicious, the message is isolated in the controlled environment where the transmission criteria may provide remote access to the recipient.

Claims

1. A method for immunizing a recipient'"'"'s computer system in a data processing network from the corrupting contents of a message of a given protocol received over a communications path through a server with a message buffer, said method comprising the steps of:

A) providing for the recipient an isolated protocol-based controlled environment set for the incoming message including;

i) message criteria by which a message can be determined to be free of corrupting contents, and

ii) message transmission criteria for defining alternate message dispositions,

B) receiving the message in the message buffer, and

C) controlling the destination of the message by;

i) processing the received message from the message buffer in the controlled environment set according to the message criteria,

ii) selecting a transmission criterion in response to said processing of the message, and

iii) disposing of the message in accordance with the selected transmission criterion.

2. A method as recited in claim 1 wherein the controlled environment set is provided in the server.

3. A method as recited in claim 1 wherein said provision of the controlled environment set for a given protocol and recipient includes providing a protocol-dependent master controlled environment that contains at least some of the message and transmission criteria.

4. A method as recited in claim 3 capable of receiving messages in a plurality of protocols, said message receiving including the steps of determining the protocol for each incoming message and directing the message to a controlled environment set for the given protocol and recipient.

5. A method as recited in claim 3 wherein the recipient utilizes a given protocol-based application for generating and receiving messages, said method additionally including providing a protocol-based application controlled environment in the controlled environment set for the recipient'"'"'s application with at least one of the message criteria.

6. A method as recited in claim 5 wherein plural protocol based applications are adapted for processing a message, said method including analyzing information about the message protocol and recipient and selecting protocol-based application controlled environments to be included in the controlled-environment set for the recipient and protocol.

7. A method as recited in claim 5 wherein said selection of a transmission criteria includes analyzing at least one transmission criterion in the protocol-based application controlled environment.

8. A method as recited in claim 5 wherein a message includes a link to another message component corresponding to one of a plurality of production applications, said providing of the controlled environment set including the step of providing a production application controlled environment for processing the linked message component.

9. A method as recited in claim 7 wherein plural production applications are adapted for processing the message component, said method including the steps of analyzing information about the link and recipient and selecting a production application controlled environment for processing the message component.

10. A method as recited in claim 1 wherein one selected transmission criterion cause the message to transfer to the recipient'"'"'s computer system.

11. A method as recited in claim 1 wherein one selected transmission criterion establishes remote access to the message in the controlled environment assigned to the protocol and recipient by the recipient'"'"'s computer system.

12. A method as recited in claim 1 wherein the server connects to a plurality of recipients and wherein said step of providing a controlled environment set includes providing an instance of a controlled environment set for each combination of the given protocol and recipient.

13. A method as recited in claim 12 adapted to receive messages of diverse protocols for a given recipient wherein said message receiving includes the steps of determining the protocol of and recipient for an incoming message and directing the message to an instance of the controlled environment set for that protocol and the given recipient.

14. A method as recited in claim 13 wherein the messages are HTTP protocol messages processed by a browser as a protocol-based application, said provision of a controlled environment set for the browser and recipient including:

i) providing a browser master controlled environment for processing the message, and

ii) providing at least one browser application controlled environment, a first browser application controlled environment constituting a shadow browser CE that corresponds to the browser.

15. A method as recited in claim 14 wherein, in response to a recipient'"'"'s initiation of a transmission of an HTTP message, the browser master control causes each of the browser application controlled environments to transmit an outgoing HTTP message with a unique return address whereby a plurality of outgoing messages are sent to a specific site, and wherein each of the responsive incoming messages are processed in the browser application controlled environment.

16. A method as recited in claim 15 wherein the message contains HTML content and certain message criteria define valid HTML content, said processing including analyzing at least one of the incoming messages to the browser application controlled environments with respect to the HTML content and message criteria.

17. A method as recited in claim 15 wherein said processing determines whether all the incoming messages are identical in accordance with another message criteria, the selection of a transmission criterion being dependent on said processing.

18. A method as recited in claim 17 wherein said processing fails to determine that messages are identical, said processing including selecting at least one message for analysis and analyzing at least one selected message for message validity.

19. A method as recited in claim 18 wherein one transmission criterion enables the message to be sent to the recipient when the analysis of incoming messages identifies a valid message.

20. A method as recited in claim 18 wherein one transmission criterion limits transmission of the message to browser application controlled environments in the controlled environment set.

21. A method as recited in claim 19 wherein said analysis includes conducting a comparative analysis of all the incoming HTTP messages and selecting one of the browser application controlled environments for processing the message.

22. A method as recited in claim 21 wherein said analysis is dependent upon the information about the recipient.

23. A method as recited in claim 16 wherein the message includes HTML content and said analysis includes:

i) identifying the content of the message that requires analysis by a production application,

ii) providing a production application controlled environment for the controlled environment set, and

iii) analyzing the content in the production application controlled environment.

24. A method as recited in claim 13 wherein the messages are e-mail protocol messages processed by an e-mail application at the recipient'"'"'s computer system, said provision of a controlled environment set for the e-mail protocol and recipient including:

i) providing an e-mail master controlled environment for processing an incoming e-mail message, and

ii) providing an e-mail application controlled environment.

25. A method as recited in claim 24 wherein said e-mail master controlled environment includes message criteria and said processing determines that the message meets all the criteria, the selected transmission criterion enabling a transfer of the e-mail message to the recipient'"'"'s computer system.

26. A method as recited in claim 25 wherein said message criteria include validity rules that establish the validity for different types of e-mail messages.

27. A method as recited in claim 26 wherein said processing of an e-mail message in accordance with the message criteria determines that a text only e-mail message is valid thereby selecting a transmission criterion that enables the transfer of the message to the recipient'"'"'s computer system.

28. A method as recited in claim 26 wherein said processing of an e-mail message without attachments in accordance with the message criteria determines that the e-mail message is valid thereby selecting a transmission criterion that enables the transfer of the message to the recipient'"'"'s computer system.

29. A method as recited in claim 26 wherein the e-mail message includes at least one attachment and wherein said processing of the e-mail message in accordance with the message criteria determines that the e-mail message and each attachment are valid, thereby selecting a transmission criterion that enables the transfer of the message to the recipient'"'"'s computer system.

30. A method as recited in claim 26 wherein the e-mail message is processed in accordance with message criteria that detect the existence of a virus in the e-mail message.

31. A method as recited in claim 24 wherein said processing fails to determine that the e-mail message is valid and one of a plurality of transmission criteria is selected for controlling the disposition of the message.

32. A method as recited in claim 31 wherein the selected transmission criterion enables the recipient to access the e-mail message remotely in the controlled environment set.

33. A method as recited in claim 32 wherein the controlled environment set defines a link between the recipient'"'"'s computer system and the e-mail controlled environment set for the recipient.

34. A method as recited in claim 32 wherein the e-mail message includes at least one attachment for a given production application and wherein said processing of the e-mail message includes providing a production application controlled environment for analyzing the attachment.

35. A method as recited in claim 34 including enabling the recipient to manipulate the attachment over the remote access link.

36. A method as recited in claim 34 including enabling the recipient to request the production of a safe derivative copy of the attachment for transfer to the recipient'"'"'s computer system.

37. A method as recited in claim 32 wherein one transmission criterion enables the e-mail message to be transferred to the recipient'"'"'s computer system.

38. A method as recited in claim 32 wherein one transmission criterion deletes the e-mail message from the controlled environment set.

39. A method as recited in claim 38 wherein said deletion of the e-mail message generates a notification to the recipient'"'"'s computer system.

40. A method as recited in claim 32 wherein the server includes a blocked message store and one transmission criterion enables the recipient to store the e-mail message in the blocked message store.

41. An immunization system for immunizing a recipient'"'"'s computer system in a data processing network from the corrupting contents of a message of a given protocol received over a communications path through a server with a message buffer that receives a message, said system comprising:

A) an isolated protocol-based controlled environment set for the incoming message including;

i) message criteria by which a message can be determined to be free of corrupting contents, and

ii) message transmission criteria for defining alternate message dispositions,

B) a controlled environment set for processing the received message from the message buffer according to the message criteria,

i) means for selecting a transmission criterion in response to the message processing, and

ii) means for disposing of the message in accordance with the selected transmission criterion.

42. A system as recited in claim 41 the server contains the controlled environment set.

43. A system as recited in claim 41 wherein said controlled environment set for a given protocol and recipient includes a protocol-dependent master controlled environment that contains at least some of said message and transmission criteria.

44. A system as recited in claim 43 wherein messages are received in a plurality of protocols, said message receiving means including means for determining the protocol for each incoming message and means for directing the message to a controlled environment set for the given protocol and recipient.

45. A system as recited in claim 43 wherein the recipient utilizes a given protocol-based application for generating and receiving messages, said controlled environment set including a protocol-based application controlled environment for the recipient'"'"'s application with at least one of the message criteria.

46. A system as recited in claim 45 wherein plural protocol based applications of recipients are adapted for processing a message, said system includes means for analyzing information about the message protocol and recipient and selecting a protocol-based application controlled environment to be included in the controlled-environment set for the recipient and protocol.

47. A system as recited in claim 45 wherein said transmission criterion selection means includes means for analyzing at least one transmission criterion in the protocol-based application controlled environment.

48. A system as recited in claim 45 wherein a message includes a link to another message component corresponding to one of a plurality of production applications, said controlled environment set including a production application controlled environment for processing the linked message component.

49. A system as recited in claim 47 wherein plural production applications are adapted for processing the message component, said system including means for analyzing information about the link and recipient and means for selecting a production application controlled environment for processing the message component.

50. A system as recited in claim 41 including means responsive to one selected transmission criterion for transferring the message to the recipient'"'"'s computer system.

51. A system as recited in claim 41 including means responsive to one transmission criterion for establishing remote access to the message in the controlled environment set assigned to the protocol and recipient from the recipient'"'"'s computer.

52. A system as recited in claim 41 wherein the server connects to a plurality of recipients and wherein said controlled environment set is an instance of a controlled environment set for each given protocol and recipient.

53. A system as recited in claim 52 adapted to receive messages of diverse protocols for a given recipient wherein said message receiving means includes means for determining the protocol of and recipient for an incoming message and means for directing the message to an instance of the controlled environment set for that protocol and the given recipient.

54. A system as recited in claim 53 wherein the messages are HTTP protocol messages processed by a browser as a protocol-based application, said controlled environment set for the browser and recipient including:

i) a browser master controlled environment for processing the message, and

ii) at least one browser application controlled environment, a first browser application controlled environment constituting a shadow browser controlled environment that corresponds to the browser.

55. A system as recited in claim 54 wherein, in response to a recipient'"'"'s initiation of a transmission of an HTTP message, said browser master control causes each of the browser application controlled environments to transmit an outgoing HTTP message with a unique return address whereby a plurality of outgoing messages are sent to a specific site and wherein each of the responsive incoming messages are processed in said browser application controlled environment.

56. A system as recited in claim 55 wherein the message contains HTML content and certain message criteria define valid HTML content, said controlled environment set including means for analyzing at least one of the incoming messages to the browser application controlled environments with respect to the HTML content and message criteria.

57. A system as recited in claim 55 wherein browser master controlled environment determines whether all the incoming messages are identical in accordance with other message criteria, the selection of a transmission criterion being dependent on said processing.

58. A system as recited in claim 57 wherein said browser controlled environment set fails to determine that messages are identical, said browser master controlled environment including means for selecting at least one message for analysis and analyzing means for at least one selected message for validity.

59. A system as recited in claim 58 including means responsive to one transmission criterion for transferring the message to be sent to the recipient when the analysis of incoming messages identifies a valid message.

60. A system as recited in claim 58 including means responsive to one transmission criterion for limiting transmission of the message to browser application controlled environments in the controlled environment set.

61. A system as recited in claim 59 wherein said browser master controlled environment includes means for comparatively analyzing all the incoming HTTP messages and selecting one of the browser application controlled environments for processing the message.

62. A system as recited in claim 61 including means for providing information about the recipient for said analyzing means.

63. A system as recited in claim 56 wherein the message includes HTML content and said browser master controlled environment includes:

i) means for identifying the content of the message that requires analysis by a production application,

ii) means for providing a production application controlled environment for the controlled environment set, and

iii) means for analyzing the content in the production application controlled environment.

64. A system as recited in claim 53 wherein the messages are e-mail protocol messages processed by an e-mail application at the recipient'"'"'s computer system and said controlled environment set for the e-mail protocol and recipient including:

i) an e-mail master controlled environment for processing an incoming e-mail message, and

ii) an e-mail application controlled environment.

65. A system as recited in claim 64 wherein said e-mail master controlled environment includes message criteria and means for determining whether the message meets all the criteria, the selected transmission criterion enabling a transfer of the e-mail message to the recipient'"'"'s computer system if the e-mail message is determined to be valid.

66. A system as recited in claim 65 wherein said message criteria include validity rules that establish the validity for different types of e-mail messages.

67. A system as recited in claim 66 wherein said means for processing an e-mail message in accordance with the message criteria includes means for determining that the e-mail message is text only thereby to select a transmission criterion that enables the transfer of the message to the recipient'"'"'s computer system.

68. A system as recited in claim 66 wherein said means for processing an e-mail message without attachments in accordance with the message criteria includes means for determining that the e-mail message is valid thereby to select a transmission criterion that enables the transfer of the message to the recipient'"'"'s computer system.

69. A system as recited in claim 66 wherein the e-mail message includes at least one attachment and wherein said means for processing of the e-mail message in accordance with the message criteria includes means for determining that the e-mail message and each attachment are valid thereby to select a transmission criterion that enables the transfer of the message to the recipient'"'"'s computer system.

70. A system as recited in claim 66 wherein the e-mail controlled environment set includes means for detecting the existence of a virus in the e-mail message.

71. A system as recited in claim 64 wherein the e-mail master controlled environment fails to determine that the e-mail message is valid thereby to select one of a plurality of transmission criteria for controlling the disposition of the message.

72. A system as recited in claim 71 including means responsive to the selected transmission criterion for enabling the recipient to access the e-mail message remotely in the controlled environment set.

73. A system as recited in claim 72 wherein said controlled environment set includes means for establishing a link between the recipient'"'"'s computer system and the e-mail controlled environment set for the recipient.

74. A system as recited in claim 72 wherein the e-mail message includes at least one attachment of a given production application and wherein said e-mail application controlled environment set includes a production application controlled environment for analyzing the attachment.

75. A system as recited in claim 74 including means for enabling the recipient to manipulate the attachment over the remote access link.

76. A system as recited in claim 74 including means for enabling the recipient to request the production of a safe derivative copy of the attachment for transfer to the recipient'"'"'s computer system.

77. A system as recited in claim 72 wherein one transmission criterion enables means for transferring the e-mail message to the recipient'"'"'s computer system.

78. A system as recited in claim 72 wherein one transmission criterion includes means for deleting the e-mail message from the e-mail controlled environment set.

79. A system as recited in claim 78 including means for generating a notification for transfer to the recipient'"'"'s computer system in response to the deletion of the e-mail message.

80. A system as recited in claim 72 wherein the server includes a blocked message store and wherein one transmission criterion includes means for enabling the recipient to store the e-mail message in the blocked message store.