SYSTEMS AND METHODS FOR PROCESSING ELECTRONIC DATA

• US 20100153507A1
• Filed: 12/17/2009
• Published: 06/17/2010
• Est. Priority Date: 05/27/2005
• Status: Abandoned Application

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: James, Anthony, Nelson, Todd A., Wei, Shaohong
• Application Number:
  US12/640,583
• Publication Number:
  US 20100153507A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of processing electronic data includes receiving electronic data, and scanning at least a portion of the electronic data against a first signature, wherein the first signature is not data-type dependent. A method of processing electronic data includes receiving electronic data to be scanned, identifying a portion of the electronic data, wherein the portion is represented as an object, and assigning one or more procedures to scan the portion based at least in part on the object. A system for processing electronic data includes an input for receiving electronic data, a processor configured for identifying one or more portions of the electronic data, each of the one or more portions represented as a typed object, and a buffer configured to store data associated with no more than one object at a time.

Claims

1. A method of processing encapsulation data, comprising:

receiving encapsulation data;

identifying a first portion of the encapsulation data;

sending the first portion to a buffer for processing; and

sending a second portion to the buffer for processing after the first portion has been processed.

2. The method of claim 1, further comprising:

identifying a header in the encapsulation data; and

passing the header without processing the header.

3. The method of claim 1, wherein the first portion is selected from the group consisting of an email header, an email body, and an attachment.

4. The method of claim 1, further comprising assigning a first procedure to scan the first portion for content desired to be detected, wherein the first procedure is assigned based on an object representing the first portion.

5. The method of claim 4, wherein the object is selected from the group consisting of a header object, a body object, and a data object.

6. The method of claim 1, further comprising scanning the first portion against a signature that is not data-type dependent.

7. A computer-program product having a medium, the medium having a set of instructions executable by a processor, wherein execution of the instructions by the processor causes a method to be performed, the method comprising:

receiving encapsulation data;

identifying a first portion of the encapsulation data;

sending the first portion to a buffer for processing; and

sending a second portion to the buffer for processing after the first portion has been processed.

8. The computer-program product of claim 7, the method further comprising:

identifying a header in the encapsulation data; and

passing the header without processing the header.

9. The computer-program product of claim 7, wherein the first portion is selected from the group consisting of an email header, an email body, and an attachment.

10. The computer-program product of claim 7, further comprising assigning a first procedure to scan the first portion for content desired to be detected, wherein the first procedure is assigned based on an object representing the first portion.

11. The computer-program product of claim 10, wherein the object is selected from the group consisting of a header object, a body object, and a data object.

12. The computer-program product of claim 7, further comprising scanning the first portion against a signature that is not data-type dependent.

13. A method of processing electronic data, comprising:

receiving electronic data to be scanned;

identifying a portion of the electronic data, wherein the portion is represented as an object; and

assigning one or more procedures to scan the portion based at least in part on the object.

14. The method of claim 13, wherein the one or more procedures is assigned based on an attribute of the object.

15. The method of claim 13, wherein the electronic data comprises email data.

16. The method of claim 13, wherein the typed object is selected from the group consisting of a header object, a body object, and a data object.

17. The method of claim 13, wherein the portion is selected from the group consisting of an email header, an email body, and an attachment.

18. The method of claim 13, further comprising identifying a sub-portion of the portion, wherein the sub-portion is represented as an object.

19. The method of claim 18, wherein the object representing the sub-portion comprises an attachment header or attachment body data, and the object representing the portion comprises an attachment.

20. The method of claim 13, wherein the portion is identified by identifying a delimiter.