DOCUMENT DE-REGISTRATION

• US 20140032919A1
• Filed: 09/30/2013
• Published: 01/30/2014
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Ahuja, Ratinder Paul Singh, Howard, Matthew, de la Iglesia, Erik, Deninger, William J., Lowe, Rick
• Granted Patent: US 9,374,225 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, cannot be transmitted undetected over and off of the network. In one embodiment, the invention includes maintaining a plurality of stored signatures in a signature database, each signature being associated with one of a plurality of registered documents. In one embodiment, the invention further includes maintaining the signature database by de-registering documents by removing the signatures associated with de-registered documents. In one embodiment, the invention further includes maintaining the database by removing redundant and high detection rate signatures. In one embodiment, the invention also includes maintaining the signature database by removing signatures based on the source text used to generate the signature.

Claims

1-54. -54. (canceled)

55. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

monitor security of a plurality of registered digital documents in a system, the monitoring including determining whether signatures associated with the registered digital documents are included in data propagating in network traffic of the system;

detect a particular signature of a particular document in the plurality of registered digital documents from the data propagating in the network;

determine, based at least in part on the detecting, that detection of the particular signature exceeds a threshold detection rate for registered digital documents in the system; and

remove the particular signature from a signature database including the signatures of the plurality of registered digital documents.

56. The storage medium of claim 55, wherein data in the network traffic detected to include a signature of a registered document is to be intercepted and data in the network traffic detected to not include a signature of a registered document is to be allowed to propagate unintercepted to its intended destination.

57. The storage medium of claim 55, wherein detecting the particular signature includes receiving the particular document, calculating the particular signature associated with the particular document, and determining whether the particular signature is included in the signature database.

58. The storage medium of claim 55, wherein removing the particular signature from the signature database de-registers the particular document.

59. The storage medium of claim 58, wherein another document in the plurality of registered digital documents is to be deregistered based on an expiration of a time interval associated with an initial registration of the other document.

60. The storage medium of claim 58, wherein de-registering the particular document includes removing all of a plurality of signatures associated with the particular document from the signature database.

61. The storage medium of claim 55, wherein the threshold detection rate comprises a threshold percentage of all data objects detected in the network traffic.

62. The storage medium of claim 55, wherein the instructions, when executed by on a machine, are further to determine that the particular signature is redundant with signatures associated with at least one other document in the plurality of registered digital documents.

63. The storage medium of claim 62, further comprising removing the particular signature from records of the signature database associated with each of the registered digital documents associated with the particular signature.

64. The storage medium of claim 62, wherein determining that the particular signature is a redundant signature includes identifying that a signature of the other document is substantially identical to the particular signature.

65. The storage medium of claim 55, wherein the threshold detection rate comprises a threshold number of detections of signatures substantially identical to the particular signature.

66. The storage medium of claim 55, wherein the threshold detection rate of the particular signature includes a number of times the particular signature is detected from data objects detected in the network traffic during a time window.

67. A method comprising:

monitoring security of a plurality of registered digital documents in a system, the monitoring including determining whether signatures associated with the registered digital documents are included in data propagating in network traffic of the system;

detecting a particular signature of a particular document in the plurality of registered digital documents from the data propagating in the network;

determining, based at least in part on the detecting, that detection of the particular signature exceeds a threshold detection rate for registered digital documents in the system; and

removing the particular signature from a signature database including the signatures of the plurality of registered digital documents.

68. The method of claim 67, further comprising automatically de-registering the particular document based on determining that detection of the particular signature exceeds the threshold detection rate.

69. The method of claim 67, wherein the threshold detection rate comprises a threshold percentage of all data objects detected in the network traffic.

70. The method of claim 67, wherein the threshold detection rate includes a rate of signature appearance per day.

71. The method of claim 67, further comprising intercepting registered documents included in the data propagating in the network based on detection of a corresponding signature for the registered documents.

72. The method of claim 71, wherein data objects that do not have a corresponding signature stored in the signature database are allowed to propagate unintercepted to their respective intended destinations.

73. A system comprising:

at least one processor device;

at least one memory element; and

a registration module to;

monitor security of a plurality of registered digital documents in a system, the monitoring including determining whether signatures associated with the registered digital documents are included in data propagating in network traffic of the system;

detect a particular signature of a particular document in the plurality of registered digital documents from the data propagating in the network;

determine, based at least in part on the detecting, that detection of the particular signature exceeds a threshold detection rate for registered digital documents in the system; and

remove the particular signature from a signature database including the signatures of the plurality of registered digital documents.

74. The system of claim 73, wherein the registration module is further to designate an additional digital document as a registered digital document, wherein designating the additional digital document as a registered digital document comprises generating one or more signatures for the additional digital document and storing the signatures for the additional digital document in the signature database.

75. The system of claim 73, further comprising the signature database.

76. The system of claim 73, wherein the registration module is further to de-register documents in the plurality of registered digital document based on determining that a time interval associated with initial registration of the registered documents has expired.