Method and apparatus for handling messages containing pre-selected data

• US 20060224589A1
• Filed: 02/14/2005
• Published: 10/05/2006
• Est. Priority Date: 02/14/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Rowney, Kevin T., Bothwell, Eric, Fridman, Vitali
• Granted Patent: US 8,011,003 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

A method and apparatus for blocking messages containing pre-selected data is described. In one embodiment, the method includes determining that a message transmitted to a recipient via a network includes pre-selected data. The pre-selected data contains information from at least one random row within the tabular structure of source data. The method further includes preventing an unauthorized transmission of the pre-selected data to the recipient.

Claims

1. A method comprising:

determining that a message for transmission to a recipient via a network includes pre-selected data from at least one random row within a tabular structure of source data; and

preventing an unauthorized transmission of the pre-selected data to the recipient.

2. The method of claim 1 wherein preventing the unauthorized transmission of the pre-selected data to the recipient comprises:

blocking a transmission of the message to the recipient.

3. The method of claim 2 further comprising:

notifying at least one of a sender and the recipient of the blocking.

4. The method of claim 1 wherein preventing the unauthorized transmission of the pre-selected data to the recipient comprises:

rerouting the message to at least one of a quarantine server and an archiving server.

5. The method of claim 4 further comprising:

receiving from the quarantine server an indication that the message is part of an authorized business process; and

transmitting the message to the recipient.

6. The method of claim 4 further comprising:

receiving from the quarantine server an indication that the message is not part of an authorized business process; and

blocking a transmission of the message to the recipient.

7. The method of claim 4 wherein the quarantine server keeps the message for a specific period of time or until a specified time.

8. The method of claim 1 further comprising:

sending a copy of the message to an alternate site.

9. The method of claim 1 wherein preventing the unauthorized transmission of the pre-selected data to the recipient comprises:

injecting into the a communication stream additional network packets that terminate a transmission of the message.

10. The method of claim 1 wherein preventing the unauthorized transmission of the pre-selected data to the recipient comprises:

re-routing the message through a network segment with at least one higher level of channel security.

11. The method of claim 1 further comprising:

determining that a header of the message indicates that the message needs to be searched for the pre-selected data.

12. The method of claim 1 wherein preventing the unauthorized transmission of the pre-selected data to the recipient comprises:

applying at least one action to the message according to a message action policy that specifies the at least one action to be applied to the message if one or more rules of the message action policy are satisfied.

13. The method of claim 12 wherein the one or more rules of the message action policy are selected from the group consisting of

one or more rules pertaining to the pre-selected data,

one or more rules pertaining to characteristics of the at least one action,

a rule specifying an expression pattern,

a rule specifying a message attachment type,

a rule specifying a message attachment size,

a rule specifying a sender identifier pattern,

a rule specifying a recipient identifier pattern,

a rule specifying keywords,

a rule specifying a file attachment name pattern,

a rule specifying a protocol to carry the message, and

a rule specifying a newsgroup name.

14. The method of claim 12 wherein the message action policy comprises an exception clause identifying an exception to the one or more rules.

15. The method of claim 14 wherein the exception clause declares at least one of a sender and a recipient authorized to have access to the pre-selected data.

16. The method of claim 14 wherein the exception clause requires that a message containing a header identifying the message as marketing material to be sent to the recipient without being searched for the pre-selected data.

17. The method of claim 12 wherein the message action policy specifies additional conditions for triggering at least one action, the additional conditions pertaining to historical data associated with at least one of a sender and the recipient.

18. The method of claim 1 wherein the message is any one of an outbound message, an inbound message and an internal message.

19. The method of claim 1 wherein the message is any one of an email message, an instant messaging (IM) message, a message exchange during a telnet session, a message exchanged during a file transfer protocol (FTP) session, a message exchanged during a hypertext transfer protocol (HTTP) session, a message exchanged during a simple object access protocol (SOAP) session, a message exchanged during a transmission control protocol/Internet protocol (TCP/IP) session, a message exchanged during a user datagram protocol (UDP) session, a message exchanged during an Ethernet session, and a message exchanged during a 801.11 session.

20. An apparatus comprising:

means for determining that a message transmitted to a recipient via a network includes pre-selected data, the pre-selected data being from at least one random row within a tabular structure of source data; and

means for preventing an unauthorized transmission of the pre-selected data to the recipient.

21. A system comprising:

a violation detector to determine that a message transmitted to a recipient via a network includes pre-selected data, the pre-selected data being from at least one random row within a tabular structure of source data; and

a message interceptor to intercept the message for preventing an unauthorized transmission of the pre-selected data to the recipient.

22. A computer readable medium that provides instructions, which when executed on a processing system cause the processing system to perform a method comprising:

determining that a message transmitted to a recipient via a network includes pre-selected data, the pre-selected data being from at least one random row within a tabular structure of source data; and

preventing an unauthorized transmission of the pre-selected data to the recipient.