RESISTING THE SPREAD OF UNWANTED CODE AND DATA

• US 20090138972A1
• Filed: 06/09/2006
• Published: 05/28/2009
• Est. Priority Date: 06/09/2005
• Status: Active Grant

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Scales, Nicholas John
• Granted Patent: US 8,185,954 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method or system of receiving an electronic file containing content data in a predetermined data format, the method comprising the steps of: receiving the electronic file, determining the data format, parsing the content data, to determine whether it conforms to the predetermined data format, and if the content data does conform to the predetermined data format, regenerating the parsed data to create a regenerated electronic file in the data format.

Claims

1. A method of receiving an incoming electronic file containing content data in a predetermined file type corresponding to a set of rules, the method comprising:

receiving the incoming electronic file,

determining a purported predetermined file type,

parsing the content data in accordance with a predetermined data format comprising a set of rules corresponding to the determined purported predetermined file type, and

if the content data does conform to the predetermined data format, regenerating the conforming parsed content data to create a substitute regenerated electronic file in the purported file type, said substitute regenerated electronic file containing the regenerated content data.

2. A method according to claim 1 in which the data format corresponds to a subset of the predetermined set of rules for each file type.

3. A method according to claim 1 comprising determining whether the content data conforms to prior known examples of acceptable data.

4. A method according to claim 3 in which the data format only includes allowable control characters.

5. A method according to claim 3 in which the data format contains a plurality of data items, each with an associated predetermined size limit.

6. A method according to claim 5 wherein the predetermined size limit is the size of a line in an image file.

7. A method according to claim 1 further comprising storing the incoming electronic file in a scrambled format in memory.

8. A method according to claim 7, wherein each byte of data is stored in a bit reversed order.

9. A method according to claim 7, wherein the data is stored such that each pair of data bytes received is placed in a reversed memory order.

10. A method according to claim 1, further comprising forwarding the substitute regenerated electronic file only if all of the content data from within the electronic file conforms to the predetermined data format.

11. A method according to claim 10 further comprising forwarding the incoming electronic file if a portion, part or whole of the content data does not conform only when the intended recipient of the electronic file has pre-approved the predetermined file type when associated with the sender of the electronic file.

12. A method according to claim 10 further comprising forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not pre-approved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.

13. A method according to claim 1, further comprising replacing any content data that does not conform to the predetermined format with warning text.

14. A method according to claim 1, wherein the incoming electronic file is an e-mail and the method further comprises forwarding the regenerated e-mail to the intended recipient if the content data conforms to the predetermined data format.

15. A method according to claim 14, wherein the substitute regenerated e-mail is forwarded from an e-mail client to a hard disk drive.

16. A method according to claim 14, wherein the substitute regenerated e-mail is forwarded from an Internet server provider server to an e-mail client server.

17. A method according to claim 1, further comprising receiving the incoming electronic file from a removable memory device, and forwarding the substitute regenerated electronic file to a computing device.

18. A computer readable medium comprising a computer program adapted to perform the method of claim 1.

19. A semiconductor device comprising a memory means including instructions for performing the method of claim 1.

20. A semiconductor device according to claim 19, wherein the semiconductor device is a semi-permanent or permanent memory device.

21. A network card comprising the semiconductor device of claim 19.

22. A computer system adapted to reject non-conforming files, the system comprising:

receiving means adapted to receive an incoming electronic file, said file containing content data in a pre-determined data file type;

determination means adapted to determine a purported predetermined data file type;

parsing means adapted to parse the content data in accordance with a predetermined data format associated with the file type;

determination means adapted to determine if the content data does conform to the purported predetermined data format;

regeneration means adapted to regenerate the conforming parsed content data, upon a positive determination from the determination means, to create a substitute regenerated electronic file in the purported predetermined data file type, said substitute regenerated electronic file containing the regenerated content data.

23. A computer system adapted to reject nonconforming files, the system comprising:

a computer adapted to receive an incoming electronic file, said file containing content data in a pre-determined file type;

a processor adapted to determine a purported predetermined data file type;

the processor comprising a parser adapted to parse the content data in accordance with a predetermined data format associated with the file type;

the processor further adapted to determine if the content data does conform to the purported predetermined data format; and

, upon a positive determination,

the processor further adapted to regenerate the conforming parsed content data, upon a positive determination from the determination means, to create a substitute regenerated electronic file in the purported predetermined file type, said substitute regenerated electronic file containing the regenerated content data.

24. A method of receiving an electronic file containing content data in a predetermined data format, the method comprising the steps of:

receiving the electronic file,

determining the data format,

parsing the content data, to determine whether it conforms to the predetermined data format, and if the content data does conform to the predetermined data format, regenerating the parsed data to create a regenerated electronic file in the data format.

25. A method according to claim 24 including, if any content data does not conform to the predetermined data format, blocking the content data that does not conform to the predetermined data format from inclusion in the regenerated electronic file.