System for intercepting multimedia documents

• US 20070110089A1
• Filed: 11/27/2003
• Published: 05/17/2007
• Est. Priority Date: 11/27/2003
• Status: Abandoned Application

• Current Assignee: Advestigo
• Original Assignee: Advestigo
• Inventors: Essafi, Hassane, Pic, Marc, Zaittouni, Fouad, Franzinetti, Jean-Pierre, Oulahoum, Keltoum
• Application Number:
  US10/580,765
• Publication Number:
  US 20070110089A1
• Time in Patent Office: Days
• US Class Current: 370/420
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The system for intercepting multimedia documents disseminated from a network comprises an interception module (110) for intercepting and processing information packets, which module comprises a packet interception module (101), a packet header analyzer module (102), a module (104) for processing packets recognized as forming part of a connection that has already been set up in order to access a storage container where the data present in each received packet is saved, and a module (103) for creating an automaton for processing received packets belonging to a new connection. The system further comprises a module for analyzing the content of the data stored in the containers, for recognizing the protocol used, for analyzing the content transported by said protocol, and for reconstituting the intercepted documents.

Claims

1. A system of intercepting multimedia documents disseminated from a first network, the system being characterized in that it comprises a module for intercepting and processing packets of information each including an identification header and a data body, the packet interception and processing module comprising first means for intercepting packets disseminated from the first network, means for analyzing the headers of packets in order to determine whether a packet under analysis forms part of a connection that has already been set up, means for processing packets recognized as forming part of a connection that has already been set up to determine the identifier of each received packet and to access a storage container where the data present in each received packet is saved, and means for creating an automaton for processing the received packet belonging to a new connection if the packet header analyzer means show that a packet under analysis constitutes a request for a new connection, the means for creating an automaton comprise in particular means for creating a new storage container for containing the resources needed for storing and managing the data produced by the means for processing packets associated with the new connection, a triplet comprising <

identifier, connection state flag, storage container>

being created and being associated with each connection by said means for creating an automaton, and in that it further comprises means for analyzing the content of data stored in the containers, for recognizing the protocol used from a set of standard protocols such as in particular http, SMTP, FTP, POP, IMAP, TELNET, P2P, for analyzing the content transported by the protocol, and for reconstituting the intercepted documents.

2. An interception system according to claim 1, characterized in that the analyzer means and the processor means comprise a first table for setting up a connection and containing for each connection being set up an identifier “

connectionId” and

a flag “

connectionState”

, and a second table for identifying containers and containing, for each connection that has already been set up, an identifier “

connectionId” and

a reference “

containerRef”

identifying the container dedicated to storing the data extracted from the frames of the connection having the identifier “

connectionId”

.

3. An interception system according to claim 2, characterized in that the flag “

connectionState”

of the first table for setting up connections can take three possible values depending on whether the detected packet corresponds to a connection request made by a client, to a response made by a server, or to a confirmation made by the client.

4. An interception system according to claim 1, characterized in that the first packet interception means, the packet header analyzer means, the automaton creator means, the packet processor means, and the means for analyzing the content of data stored in the containers operate in independent and asynchronous manner.

5. An interception system according to claim 1, characterized in that it further comprises a first module for storing the content of documents intercepted by the module for intercepting and processing packets, and a second module for storing information relating to at least the sender and the destination of intercepted documents.

6. An interception system according to claim 5, characterized in that it further comprises a module for storing information relating to the components that result from detecting the content of intercepted documents.

7. An interception system according to claim 1, characterized in that it further comprises a centralized system comprising means for producing fingerprints of sensitive documents under surveillance, means for producing fingerprints of intercepted documents, means for storing fingerprints produced from sensitive documents under surveillance, means for storing fingerprints produced from intercepted documents, means for comparing fingerprints coming from the means for storing fingerprints produced from intercepted documents with fingerprints coming from the means for storing fingerprints produced from sensitive documents under surveillance, and means for processing alerts, containing the references of intercepted documents that correspond to sensitive documents.

8. An interception system according to claim 7, characterized in that it includes selector means responding to the means for processing alerts to block intercepted documents or to forward them towards a second networks, depending on the results delivered by the means for processing alerts.

9. An interception system according to claim 7, characterized in that the centralized system further comprises means for associating rights with each sensitive document under surveillance rights, and means for storing information relating to said rights, which rights define the conditions under which the document can be used.

10. An interception system according to claim 1, characterized in that it is interposed between a first network of the LAN type and a second network of the LAN type.

11. An interception system according to claim 1, characterized in that it is interposed between a first network of the Internet type and a second network of the Internet type.

12. An interception system according to claim 1, characterized in that it is interposed between a first network of the LAN type and a second network of the Internet type.

13. An interception system according to claim 1, characterized in that it is interposed between a first network of the Internet type and a second network of the LAN type.

14. An interception system according to claim 13, characterized in that it further comprises a generator for generating requests from sensitive documents to be protected, in order to inject requests into the first network.

15. An interception system according to claim 14, characterized in that the request generator comprises:

means for producing requests from sensitive documents under surveillance;

means for storing the requests produced;

means for mining the first network with the help of at least one search engine using the previously stored requests;

means for storing the references of suspect files coming from the first network; and

means for sweeping up suspect files referenced in the means for storing references and for sweeping up files from the neighborhood, if any, of the suspect files.

16. An interception system according to claim 7, characterized in that said means for comparing fingerprints deliver a list of retained suspect documents having a degree of pertinence relative to sensitive documents, and the alert processor means deliver the references of an intercepted document when the degree of pertinence of said document is greater than a predetermined threshold.

17. An interception system according to claim 7, characterized in that it further comprises, between said means for comparing fingerprints and said means for processing alerts, a module for calculating the similarity between documents, which module comprises:

a) means for producing an interference wave representing the result of pairing between a concept vector taken in a given order defining the fingerprint of a sensitive document and a concept vector taken in a given order defining the fingerprint of a suspect intercepted document; and

b) means for producing an interference vector from said interference wave enabling a resemblance score to be determined between the sensitive document and the suspect intercepted document under consideration, the means for processing alerts delivering the references of a suspect intercepted document when the value of the resemblance score for said document is greater than a predetermined threshold.

18. An interception system according to claims 7, characterized in that it further comprises, between said means for comparing fingerprints and said means for processing alerts, a module for calculating similarity between documents, which module comprises means for producing a correlation vector representative of the degree of correlation between a concept vector taken in a given order defining the fingerprint of a sensitive document and a concept vector taken in a given order defining the fingerprint of a suspect intercepted document, the correlation vector enabling a resemblance score to be determined between the sensitive document and the suspect intercepted document under consideration, the means for processing alerts delivering the references of a suspect intercepted document when the value of the resemblance score for said document is greater than a predetermined threshold.