DOCUMENT REGISTRATION

• US 20110219237A1
• Filed: 08/31/2010
• Published: 09/08/2011
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Howard, Matthew, Deninger, William, de la Iglesia, Erik, Ahuja, Ratinder Paul Singh, Lowe, Rick
• Granted Patent: US 8,166,307 B2
• Time in Patent Office: Days
• US Class Current: 713/177
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/18 Legal services

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, cannot be transmitted undetected over and off of the network. In one embodiment, the invention includes maintaining a plurality of stored signatures, each signature being associated with one of a plurality of registered documents, intercepting an object being transmitted over a network, calculating a set of signatures associated with the intercepted object, and comparing the set of signatures with the plurality of stored signatures. In one embodiment, the invention can further include detecting registered content from the registered document being contained in the intercepted object, if the comparison results in a match of at least one of the signatures in the set of signatures with one or more of the plurality of stored signatures.

Claims

1-21. -21. (canceled)

22. A method comprising:

maintaining a plurality of stored signatures in a data storage device, each signature being associated with one of a plurality of registered documents;

intercepting packets being transmitted over a network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow;

calculating a set of signatures associated with the reassembled object; and

comparing the set of signatures associated with the reassembled object with the plurality of stored signatures to determine if at least a portion of the reassembled object contains content associated with a registered document.

23. The method of claim 22, further comprising:

detecting content associated with a registered document in the reassembled object if at least one signature of the set of signatures associated with the reassembled object matches one of the plurality of stored signatures.

24. The method of claim 23, further comprising:

halting delivery of the intercepted complete flow in response to detecting content associated with the registered document in the reassembled object.

25. The method of claim 22, further comprising:

registering the plurality of documents according to one or more registration rules.

26. The method of claim 25, wherein the registration rules include at least one of a first rule to register all documents associated with a specified author and a second rule to register all documents associated with a specified Internet Protocol (IP) address.

27. The method of claim 22, wherein the intercepted complete flow includes a plurality of reassembled objects.

28. The method of claim 22, wherein each registered document is associated with a user that requested registration of the document, the user being alerted if an attempt is made to transmit at least a portion of the registered document over a network.

29. The method of claim 22, wherein the set of signatures associated with the reassembled object are calculated by generating a plurality of hashes over various portions of the reassembled object.

30. An apparatus comprising:

a network interface module to connect the apparatus to a network; and

a processor operable to execute instructions for capturing and evaluating data transmissions over the network, including;

intercepting packets being transmitted over the network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow;

calculating a set of signatures associated with the reassembled object; and

comparing the set of signatures associated with the reassembled object with the plurality of stored signatures to determine if at least a portion of the reassembled object contains content associated with a registered document.

31. The apparatus of claim 30, wherein the processor is operable to execute further instructions including:

detecting content associated with a registered document in the reassembled object if at least one signature of the set of signatures associated with the reassembled object matches one of the plurality of stored signatures.

32. The apparatus of claim 31, wherein the processor is operable to execute further instructions including:

halting delivery of the intercepted complete flow in response to detecting content associated with the registered document in the reassembled object.

33. The apparatus of claim 30, wherein the processor is operable to execute further instructions including:

registering the plurality of documents according to one or more registration rules, wherein the registration rules include at least one of a first rule to register all documents associated with a specified author and a second rule to register all documents associated with a specified Internet Protocol (IP) address.

34. The apparatus of claim 30, wherein the intercepted complete flow includes a plurality of reassembled objects.

35. The apparatus of claim 30, wherein each registered document is associated with a user that requested registration of the document, the user being alerted if an attempt is made to transmit at least a portion of the registered document over a network.

36. Logic encoded in one or more tangible media that includes code for execution and when executed by a processor is operable to perform operations comprising:

maintaining a plurality of stored signatures in a data storage device, each signature being associated with one of a plurality of registered documents;

intercepting packets being transmitted over a network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow;

calculating a set of signatures associated with the reassembled object; and

comparing the set of signatures associated with the reassembled object with the plurality of stored signatures to determine if at least a portion of the reassembled object contains content associated with a registered document.

37. The logic of claim 36, the processor being operable to perform further operations including:

detecting content associated with a registered document in the reassembled object if at least one signature of the set of signatures associated with the reassembled object matches one of the plurality of stored signatures.

38. The logic of claim 37, the processor being operable to perform further operations including:

halting delivery of the intercepted complete flow in response to detecting content associated with the registered document in the reassembled object.

39. The logic of claim 36, the processor being operable to perform further operations including:

registering the plurality of documents according to one or more registration rules, wherein the registration rules include at least one of a first rule to register all documents associated with a specified author and a second rule to register all documents associated with a specified Internet Protocol (IP) address.

40. The logic of claim 36, wherein the intercepted complete flow includes a plurality of reassembled objects.

41. The logic of claim 36, wherein the set of signatures associated with the reassembled object are calculated by generating a plurality of hashes over various portions of the reassembled object.