E-mail virus protection system and method

• US 6,901,519 B1
• Filed: 11/03/2000
• Issued: 05/31/2005
• Est. Priority Date: 06/22/2000
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Infobahn Inc.
• Inventors: Hook, Robert G., Carrera, Marcelo, Stewart, Walter Mason
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): KLIMACH, PAULA W
• Application Number:
  US09/704,790
• Time in Patent Office: 1,670 Days
• Field of Search: 713/200, 713/201, 713/202, 304750-753, 709/206, 709/207, 709/246
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 51/066 Format adaptation, e.g. format conversion or compression
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A network is protected from e-mail viruses through the use of a sacrificial server. Any executable programs or other suspicious parts of incoming e-mail messages are forwarded to a sacrificial server, where they are converted to non-executable format such as Adobe Acrobat PDF and sent to the recipient. The sacrificial server is then checked for virus activity. After the execution is completed, the sacrificial server is rebooted.

Claims

1. A method for protecting a network from a virus contained in an email message as executable code, the method comprising:

(a) receiving the e-mail message in a gatekeeper server;

(b) providing a sacrificial server in communication with the gatekeeper server and forwarding the e-mail from the gatekeeper server to the sacrificial server;

(c) converting the e-mail message from an executable format to a non-executable format by using one of a plurality of application-level conversion processes selected in accordance with a type of the e-mail message, the non-executable format retaining an appearance, human readability and semantic content of the e-mail message; and

(d) forwarding the non-executable format to the recipient of the e-mail message.

2. The method of claim 1, wherein the executable code is contained in a body of the e-mail message.

3. The method of claim 2, wherein the executable code comprises a hypertext link, and wherein step (c) comprises deactivating the hypertext link.

4. The method of claim 1, wherein the executable code is contained in an attachment in the e-mail message.

5. The method of claim 4, wherein:

step (b) comprises providing a plurality of the sacrificial servers in communication with the gatekeeper server;

step (b) further comprises forwarding the attachment from the gatekeeper server to one of the plurality of sacrificial servers; and

step (c) comprises converting the attachment to the non-executable format on said one of the plurality of sacrificial servers by using said one of the plurality of conversion processes selected in accordance with the type of the e-mail message, the non-executable format retaining the appearance, human readability and semantic content of the e-mail message.

6. The method of claim 5, wherein the plurality of sacrificial servers are separate from the gatekeeper server.

7. The method of claim 5, wherein step (c) further comprises examining the sacrificial server for virus activity.

8. The method of claim 7, wherein step (c) further comprises rebooting the sacrificial server from a safe copy of an operating system obtained from a read-only device.

9. The method of claim 5, wherein communications between the gatekeeper server and the sacrificial server are authenticated using a challenge-and-response technique.

10. The method of claim 4, wherein step (c) comprises:

(i) maintaining a list of approved attachment file types and extensions;

(ii) determining whether the attachment is of a type or extension which is in the list of approved attachment file types and extensions; and

(iii) if the attachment is not of a type or extension which is in the list of approved attachment file types and extensions, informing the recipient that a message containing a non-approved attachment has been received.

11. The method of claim 1, wherein step (c) comprises:

(i) maintaining a list of approved executable code;

(ii) determining whether the executable code is in the list of approved executable code; and

(iii) deactivating the executable code if the executable code is not in the list of approved executable code.

12. The method of claim 11, wherein:

the list of approved executable code includes information for determining whether the approved executable code has been altered; and

step (c) further comprises;

(iv) determining whether the executable code has been altered; and

(v) deactivating the executable code if the executable code has been altered.

13. The method of claim 12, wherein step (c)(iv) is performed through an algorithmic technique.

14. The method of claim 13, wherein the algorithmic technique is a check-summing technique.

15. The method of claim 13, wherein the algorithmic technique is a hashing technique.

16. The method of claim 1, wherein step (c) comprises:

(i) forming a first copy and a second copy of at least a portion of the e-mail message containing the executable code;

(ii) executing the executable code in the first copy but not the second copy; and

(iii) after the executable code in the first copy has been executed, comparing the first copy to the second copy to determine an effect of the executable code.

17. A system for protecting a network from a virus contained in an e-mail message as executable code, the system comprising:

a workstation computer on the network used by a recipient of the e-mail message;

a gatekeeper server, in communication with the workstation computer over the network, for receiving the e-mail message; and

a sacrificial server on the network for converting the e-mail message from an executable format to a non-executable format by using one of a plurality of application-level conversion processes selected in accordance with a type of the e-mail message, the non-executable format retaining an appearance, human readability and semantic content of the e-mail message and forwarding the converted e-mail message to the workstation computer.

18. The system of claim 17, wherein the executable code is contained in a body of the e-mail message.

19. The system of claim 18, wherein the executable code comprises a hypertext link, and wherein the computer for converting deactivates the hypertext link.

20. The system of claim 17, wherein the executable code is contained in an attachment in the e-mail message.

21. The system of claim 17, wherein the sacrificial server is one of a plurality of sacrificial servers which are in communication with the gatekeeper server.

22. The system of claim 21, wherein the plurality of sacrificial servers are separate from the gatekeeper server.

23. The system of claim 21, wherein the plurality of sacrificial servers are examined for virus activity.

24. The system of claim 23, wherein the network further comprises a read-only device, and wherein the sacrificial servers are rebooted from a safe copy of an operating system obtained from the read-only device.

25. The system of claim 21, wherein communications between the gatekeeper server and the sacrificial servers are authenticated using a challenge-and-response technique.

26. The system of claim 17, wherein the network maintains a list of approved attachment file types and extensions, determines whether the attachment is of a file type or extension which is in the list of approved attachment file types and extensions, and, if the attachment is not of a file type or extension which is in the list of approved attachment file types and extensions, informs the recipient that a message containing a non-approved attachment has been received.

27. The system of claim 17, wherein the network maintains a list of approved executable code, determines whether the executable code is in the list of approved executable code, and deactivates the executable code if the executable code is not in the list of approved executable code.

28. The system of claim 27, wherein:

the list of approved executable code includes information for determining whether the approved executable code has been altered;

the network determines whether the executable code has been altered; and

the executable code is deactivated if the executable code has been altered.

29. The system of claim 28, wherein the system determines whether the executable code has been altered through an algorithmic technique.

30. The system of claim 29, wherein the algorithmic technique is a check-summing technique.

31. The system of claim 29, wherein the algorithmic technique is a hashing technique.

32. The system of claim 17, wherein the sacrificial server converts the executable code by:

(i) forming a first copy and a second copy of at least a portion of the e-mail message containing the executable code;

(ii) executing the executable code in the first copy but not the second copy; and

(iii) after the executable code in the first copy has been executed, comparing the first copy to the second copy to determine and effect of the executable code.

34. The sacrificial server of claim 32, wherein the processing means converts the executable code by:

(i) forming a first copy and a second copy of at least a portion of the e-mail message containing the executable code;

(ii) executing the executable code in the first copy but not the second copy; and

(iii) after the executable code in the first copy has been executed, comparing the first copy to the second copy to determine an effect of the executable code.

33. A sacrificial server for use on a network, the sacrificial server comprising:

communication means for receiving an e-mail attachment from the network; and

processing means for converting the e-mail attachment from an executable format to a non-executable format by using one of a plurality of application-level conversion processes selected in accordance with a type of the e-mail message, the non-executable format retaining an appearance, human readability and semantic content of the e-mail message and for returning the e-mail attachment to the network.

35. The sacrificial server of claim 33, wherein the sacrificial server is examined for virus activity.

36. The sacrificial server of claim 35, wherein the sacrificial server determines whether the executable code has been altered through the use of an algorithmic technique.

37. The sacrificial server of claim 35, wherein the sacrificial server further comprises a read-only device and is rebooted from a safe copy of an operating system obtained from the read-only device.

38. The sacrificial server of claim 36, wherein the algorithmic technique is a check-summing technique.

39. The sacrificial server of claim 36, wherein the algorithmic technique is a hashing technique.

40. The sacrificial server of claim 33, wherein communications between the network and the sacrificial server are authenticated using a challenge-and-response technique.

41. The sacrificial server of claim 33, wherein the sacrificial server stores a list of approved attachment file types and extensions, determines whether the attachment is of a file type or extension which is in the list of approved attachment file types and extensions, and, if the attachment is not of a file type or extension which is in the list of approved attachment file types and extensions, and informs the network that a message containing a non-approved attachment has been received.

42. The sacrificial server of claim 33, wherein the sacrificial server maintains a list of approved executable code, determines whether the attachment contains executable code and whether the executable code is in the list of approved executable code, and deactivates the executable code if the executable code is not in the list of approved executable code.

43. The sacrificial server of claim 42, wherein:

the list of approved executable code includes information for determining whether the approved executable code has been altered;

if the executable code is in the list of approved executable code, the sacrificial server determines whether the executable code has been altered; and

the executable code is deactivated if the executable code has been altered.