Unauthorized content detection for information transfer

• US 20070124816A1
• Filed: 11/29/2005
• Published: 05/31/2007
• Est. Priority Date: 11/29/2005
• Status: Abandoned Application

• Current Assignee: Alcatel SA (Nokia Corporation)
• Original Assignee: Alcatel SA (Nokia Corporation)
• Inventors: Abigail, Shawn
• Application Number:
  US11/288,227
• Publication Number:
  US 20070124816A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method is provided for detecting offending or illegal download activity. An agency, such as a law enforcement agency, generates a list of checksums over a designated area of each of a set of computer files. The agency provides the list of checksums and an identification of the designated area to an administrator of a packet switch. The checksum of the designated area of packets passing through the switch are calculated. If a calculated checksum is found in the list of offending checksums, then the packet is flagged. In order to keep processing overhead manageable, a checksum for only some packets may be calculated. Although only known offending computer files can be detected in this manner, the use of known checksums of known offending computer files greatly reduces the likelihood of false positive detection of packets.

Claims

1. A method of detecting offending computer file segments, comprising:

defining a designated area;

for each of at least one computer file, calculating an offending checksum of bytes of the designated area of the computer file;

calculating a calculated checksum of bytes in the designated area of a computer file segment;

determining whether the calculated checksum matches any of the at least one offending checksum; and

if the calculated checksum matches at least one offending checksum, determining that the computer file segment is an offending computer file segment.

2. The method of claim 1 wherein at least one computer file is an image file.

3. The method of claim 1 wherein at least one computer file is a music file.

4. The method of claim 1 wherein at least one computer file is a movie file.

5. The method of claim 1 wherein each computer file segment is a packet, the method further comprising:

receiving a plurality of packets; and

for each packet, determining whether the packet is to checked,

and wherein calculating a calculated checksum, determining whether the calculated checksum matches any offending checksum, and determining that the packet is an offending packet are only carried out with respect to packets that are to be checked.

6. The method of claim 5 wherein at least one computer file is an image file.

7. The method of claim 5 wherein at least one computer file is a music file.

8. The method of claim 5 wherein determining whether the packet is to be checked comprises determining a percentage of packets are to be checked.

9. The method of claim 5 wherein determining whether the packet is to be checked comprises determining that a packet is to be checked if a source address of the packet matches a stored source address.

10. The method of claim 5 wherein determining whether the packet is to be checked comprises determining that a packet is to be checked if a destination address of the packet matches a stored destination address.

11. The method of claim 5 wherein determining whether the packet is to be checked comprises determining that a packet is to be checked if the packet is a first packet of a particular file type.

12. The method of claim 5 wherein determining whether the packet is to be checked comprises determining that a packet is to be checked if the packet exceeds a size limit.

13. The method of claim 5 further comprising modifying parameters by which it is determined whether a packet is to be checked, in the event that a packet is determined to be an offending packet.

14. The method of claim 13 wherein the parameters are modified so that all packets having a source address matching the source address of the offending packet are determined to be checked.

15. The method of claim 13 wherein the parameters are modified so that all packets having a destination address matching the destination address of the offending packet are determined to be checked.

16. The method of claim 5 wherein receiving a plurality of packets and determining whether each packet is to checked are carried out by a packet switch, and wherein calculating a calculated checksum, determining whether the calculated checksum matches any of the at least one offending checksum, and determining that the packet is an offending packet are carried out by a separately from the packet switch.

17. The method of claim 1 wherein each computer file segment is a computer file stored on a network.

18. A system for detecting offending packets, comprising:

a database for storing a definition of a designated area and at least one offending checksum;

a packet switch for receiving a plurality of packets and for determining whether each packet is to be checked; and

an offending packet detector for calculating a calculated checksum of bytes in the designated area of each packet to be checked, for determining whether any calculated checksum matches any of the at least one offending checksum, and for determining that a packet is an offending packet if the calculated checksum of the packet matches at least one offending checksum.

19. A computer-readable medium storing instructions which can be processed by a processor, the instructions comprising:

instructions for retrieving a definition of a designated area from a database;

instructions for receiving a packet;

instructions for calculating a calculated checksum of bytes in the designated area of the packet to be checked;

instructions for determining whether the calculated checksum matches any of at least one offending checksum stored in the database; and

instructions for determining that the packet is an offending packet if the calculated checksum matches at least one offending checksum.