Query generation for a capture system

• US 7,689,614 B2
• Filed: 05/22/2006
• Issued: 03/30/2010
• Est. Priority Date: 05/22/2006
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, de la Iglesia, Erik, Ahuja, Ratinder Paul Singh
• Primary Examiner(s): Woo; Isaac M.
• Application Number:
  US11/439,488
• Publication Number:
  US 20070271254A1
• Time in Patent Office: 1,408 Days
• Field of Search: 707 1- 10, 707100-1041, 707200-206, 707600-828
• US Class Current: 707/713
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, is not transmitted undetected over and off of the network. In one embodiment, the invention includes a manager agent to maintain signatures of registered documents and a match agent to detect the unauthorized transmission of the content of registered documents.

Claims

1. A method comprising:

decomposing a capture system query into at least one search term;

determining at least one location to search for the at least one search term;

searching the at least one location for the at least one search term;

generating a list of matches for each location searched; and

intersecting the lists of matches, the capture system being configured to intercept data from data streams, reconstruct the data, and store network transmitted objects according to a capture rule that defines which objects are to be captured by the capture system, wherein the capture system is configured to allow a document to be forwarded from the capture system to its intended destination at a network node unless the capture rule prohibits forwarding the document based on the document including one or more objects.

2. The method of claim 1, further comprising:

receiving the query at the capture system.

3. The method of claim 1, wherein the at least one location is selected from a group consisting of:

a look-aside storage;

a metadata database; and

an object storage.

4. The method of claim 3, wherein the object storage is located outside of the capture system.

5. The method of claim 3, wherein the look-aside list has the highest search priority.

6. The method of claim 3, wherein the searching the at least one location for the at least one search term, generating a list of matches for each location searched, and intersecting the lists of matches are performed in a pipelined fashion.

7. The method of claim 3, wherein the look-aside storage, metadata storage, and object storage are pre-sorted by time.

8. The method of claim 7, wherein the time is partitioned into divisions.

9. An article of manufacture including program code which, when executed by a machine, causes the machine to perform a method, the method comprising:

decomposing a capture system query into at least one search term;

determining at least one location to search for the at least one search term;

searching the at least one location for the at least one search term;

generating a list of matches for each location searched; and

intersecting the lists of matches, the capture system being configured to intercept data from data streams, reconstruct the data, and store network transmitted objects according to a capture rule that defines which objects are to be captured by the capture system, wherein the capture system is configured to allow a document to be forwarded from the capture system to its intended destination at a network node unless the capture rule prohibits forwarding the document based on the document including one or more objects.

10. The article of manufacture of claim 9, further comprising:

receiving the query at the capture system.

11. The article of manufacture of claim 9, wherein the at least one location is selected from a group consisting of:

a look-aside storage;

a metadata database; and

an object storage.

12. The article of manufacture of claim 11, wherein the object storage is located outside of the capture system.

13. The article of manufacture of claim 11, wherein the look-aside list has the highest search priority.

14. The article of manufacture of claim 11, wherein the searching the at least one location for the at least one search term, generating a list of matches for each location searched, and

intersecting the lists of matches are performed in a pipelined fashion.

15. The article of manufacture of claim 11, wherein the look-aside storage, metadata storage, and object storage are pre-sorted by time.

16. The article of manufacture of claim 15, wherein the time is partitioned into divisions.