RESISTING THE SPREAD OF UNWANTED CODE AND DATA

• US 20190158518A1
• Filed: 01/29/2019
• Published: 05/23/2019
• Est. Priority Date: 06/09/2005
• Status: Active Grant

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Scales, Nicholas John
• Granted Patent: US 10,462,163 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method or system of receiving an incoming electronic file containing content data in a predetermined data format, the method including receiving an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type, determining a purported predetermined file type of the incoming electronic file and an associated set of rules specifying allowable content data, determining at least an allowable portion of the content data that conforms with the set of rules corresponding to the determined purported predetermined file type, extracting, from the incoming electronic file, the at least an allowable portion of content data, creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted allowable content data, forwarding the substitute regenerated electronic file, and forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, only when the intended recipient approves the electronic file at the time of receipt.

Claims

1. A method of processing an electronic file to create a substitute electronic file containing only allowable content data, the method comprising:

receiving an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the incoming electronic file based upon the encoded and arranged content data, and an associated set of rules specifying allowable content data for the purported predetermined file type;

determining at least an allowable portion of the content data that conforms with the set of rules corresponding to the determined purported predetermined file type;

extracting, from the incoming electronic file, the at least an allowable portion of content data;

creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted allowable content data;

forwarding the substitute regenerated electronic file; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the incoming electronic file has not pre-approved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.

2. The method according to claim 1 in which the associated set of rules corresponds to a subset of the predetermined set of rules for each file type.

3. The method according to claim 1, further comprising determining whether the content data conforms to prior known examples of acceptable data.

4. The method according to claim 3 in which the associated set of rules specifies values or range of values that includes only allowable control characters.

5. The method according to claim 3 in which the associated set of rules specifies values or range of values that define predetermined size limits.

6. The method according to claim 5 wherein the predetermined size limit is the size of a line in an image file.

7. The method according to claim 1, further comprising storing the incoming electronic file in a scrambled format in memory.

8. The method according to claim 7, wherein storing the electronic file in the scrambled format comprises storing each byte of data in a bit reversed order.

9. The method according to claim 7, wherein storing the electronic file in the scrambled format comprises storing each pair of data bytes received is placed in a reversed memory order.

10. The method according to claim 1, further comprising replacing any content data that does not conform with warning text.

11. The method according to claim 1, wherein the incoming electronic file is an e-mail and the method further comprises forwarding the regenerated e-mail to an intended recipient if the content data conforms to the set of rules.

12. The method according to claim 11, wherein the substitute regenerated e-mail is forwarded from an e-mail client to a hard disk drive.

13. The method according to claim 1, wherein the substitute regenerated e mail is forwarded from an Internet server provider server to an e-mail client server.

14. The method according to claim 1, further comprising receiving the incoming electronic file from a removable memory device, and forwarding the substitute regenerated electronic file to a computing device.

15. A semiconductor device comprising:

a memory for storing computer instructions executable by a computer to perform;

receiving an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the incoming electronic file based upon the arranged and encoded content data and an associated set of rules specifying allowable content data for the purported predetermined file type;

determining at least an allowable portion of the content data that conforms with the set of rules corresponding to the determined purported predetermined file type;

extracting, from the incoming electronic file, the at least an allowable portion of content data;

creating a substitute electronic file of the purported predetermined file type, said substitute electronic file containing the extracted allowable content data;

forwarding the substitute regenerated electronic file; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not pre-approved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.

16. A device for processing an electronic file to create a substitute electronic file containing only allowable content data comprising:

a memory; and

a computer processor in communication with the memory, the processor executing a program stored on said memory to perform;

receiving an incoming electronic file, said incoming electronic file containing content data in a predetermined data file type;

determining a purported predetermined data file type of the incoming electronic file and an associated set of rules specifying allowable content data for the purported predetermined data file type;

determining at least an allowable portion of the content data that conforms with the set of rules corresponding to the determined purported predetermined file type;

extracting, from the incoming electronic file, the determined at least one portion of allowable content data;

creating a substitute electronic file in the purported predetermined data file type, said substitute electronic file containing the extracted allowable content data;

forwarding the substitute regenerated electronic file; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not preapproved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.

17. A non-transitory computer-readable storage medium comprising a computer program executable by a computer to perform:

receiving an incoming electronic file containing content data encoded and arranged in accordance with a predetermined file type;

determining a purported predetermined file type of the incoming electronic file and an associated set of rules specifying allowable content data for the purported predetermined file type;

determining at least an allowable portion of the content data that conforms with the set of rules corresponding to the determined purported predetermined file type;

extracting, from the incoming electronic file, the at least an allowable portion of content data;

creating a substitute electronic file in the purported predetermined file type, said substitute electronic file containing the extracted allowable content data;

forwarding the substitute regenerated electronic file; and

forwarding the incoming electronic file if a portion, part or whole of the content data does not conform, and the intended recipient of the electronic file has not pre-approved the predetermined data format and sender of the electronic file, only when the intended recipient approves the electronic file at the time of receipt.