Document registration

• US 7,814,327 B2
• Filed: 03/30/2004
• Issued: 10/12/2010
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, de la Iglesia, Erik, Ahuja, Ratinder Paul Singh, Lowe, Rick, Howard, Matthew
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US10/815,239
• Publication Number:
  US 20050127171A1
• Time in Patent Office: 2,387 Days
• Field of Search: 709/224, 709/249, 713/182, 713/162, 713/151, 726/3, 726/11, 726/13
• US Class Current: 713/177
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/18 Legal services

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, cannot be transmitted undetected over and off of the network. In one embodiment, the invention includes maintaining a plurality of stored signatures, each signature being associated with one of a plurality of registered documents, intercepting an object being transmitted over a network, calculating a set of signatures associated with the intercepted object, and comparing the set of signatures with the plurality of stored signatures. In one embodiment, the invention can further include detecting registered content from the registered document being contained in the intercepted object, if the comparison results in a match of at least one of the signatures in the set of signatures with one or more of the plurality of stored signatures.

Claims

1. A computer-implemented method comprising:

maintaining a plurality of stored signatures in a data storage device, each signature being associated with one of a plurality of registered documents;

intercepting packets being transmitted over a network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow to determine a content type of the reassembled object;

calculating a set of signatures associated with the reassembled object; and

comparing the set of signatures associated with the reassembled object with the plurality of stored signatures to determine if the reassembled object contains content associated with a registered document, wherein each registered document is associated with a user that requested registration of the document, the user being alerted if an attempt to transmit the registered document over a network is made.

2. The method of claim 1, further comprising, if the comparison results in a match of at least one of the signatures in the set of signatures with one or more of the plurality of stored signatures, then detecting registered content from the registered document being contained in the reassembled object.

3. The method of claim 2, further comprising halting delivery of the intercepted complete flow.

4. The method of claim 3, further comprising prompting the user that requested registration of the registered document for permission to deliver the intercepted complete flow, receiving permission from the user, and completing delivery of the intercepted complete flow in response to receiving permission.

5. The method of claim 1, wherein calculating the set of signatures of the reassembled object comprises calculating a plurality of hashes over one or more portions of the reassembled object.

6. The computer-implemented method of claim 1, wherein the intercepted complete flow includes a plurality of reassembled objects.

7. An apparatus comprising:

a network interface module to connect the apparatus to a network;

a signature database to store a first set of signatures, the first set of signatures being associated with a registered object, wherein the first set of signatures stored in the signature database is associated with a user who requested registration of the registered object;

an object capture module to intercept packets being transmitted over the network between a source and a destination;

an object assembly module to reassemble the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

an object classification module to extract a reassembled object from the intercepted complete flow to determine a content type of the reassembled object; and

a registration module comprising a registration engine to generate a second set of signatures, the second set of signatures being associated with the reassembled object, and a search engine to compare the second set of signatures with the first set of signatures, the apparatus being configured to alert the user if an attempt to transmit the registered object over a network is made.

8. The apparatus of claim 7, wherein the registration module detects registered content from the registered object being transmitted over the network if the search engine matches one or more signatures in the second set of signatures with one or more signatures in the first set of signatures.

9. The apparatus of claim 8, wherein the registration module further comprises a notification module to generate an alert for the user who requested registration of the registered object in response to detecting registered content from the registered object being transmitted over the network.

10. The apparatus of claim 7, further comprising an object store module to store the reassembled object.

11. The apparatus of claim 10, wherein the registration module halts delivery of the intercepted complete flow from the object store module to the destination in response to detecting registered content from the registered object being transmitted over the network.

12. The apparatus of claim 11, wherein the registration module allows completion of the delivery of the intercepted complete flow from the object store module to the destination in response to receiving permission from the user who requested registration of the registered object.

13. The apparatus of claim 7, wherein the registration engine generates the second set of signatures by calculating a plurality of hashes over various portions of the reassembled object.

14. The apparatus of claim 7, wherein the intercepted complete flow includes a plurality of reassembled objects.

15. A non-transitory machine-readable medium storing a sequence of instructions that, when executed by a processor, cause the processor to perform operations comprising:

maintaining a plurality of stored signatures in a data storage device, each signature being associated with one of a plurality of registered documents, wherein each registered document is associated with a user that requested registration of the document;

intercepting packets being transmitted over a network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow to determine a content type of the reassembled object;

calculating a set of signatures associated with the reassembled object;

comparing the set of signatures associated with the reassembled object with the plurality of stored signatures to determine if the reassembled object contains content associated with a registered document; and

alerting the user if an attempt to transmit the registered document over a network is made.

16. The non-transitory machine-readable medium of claim 15, wherein the instructions further cause the processor to detect registered content from the registered document being contained in the reassembled object, if the comparison results in a match of at least one of the signatures in the set of signatures with one or more of the plurality of stored signatures.

17. The non-transitory machine-readable medium of claim 16, wherein the instructions further cause the processor to halt delivery of the reassembled object.

18. The non-transitory machine-readable medium of claim 17, wherein the instructions further cause the processor to prompt the user that requested registration of the registered document for permission to deliver the reassembled object, and to deliver the intercepted complete flow if permission is given.

19. The non-transitory machine-readable medium of claim 15, wherein the intercepted complete flow includes a plurality of reassembled objects.