Apparatus, methods and articles of manufacture for intercepting, examining and controlling code, data and files and their transfer

• US 7,917,585 B2
• Filed: 06/21/2001
• Issued: 03/29/2011
• Est. Priority Date: 06/21/2001
• Status: Expired due to Fees

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Thomas, Mark G.
• Primary Examiner(s): Nguyen, Dustin
• Application Number:
  US09/886,169
• Publication Number:
  US 20020198945A1
• Time in Patent Office: 3,568 Days
• Field of Search: 709/246, 709/206, 709/101, 709/229, 707/10, 707/104.1, 706/47, 726/24, 726/22, 713/151, 713/164, 713/154, 713/200, 370/394, 714/38, 455/412.1, 715/56
• US Class Current: 709/206
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes

Abstract

Apparatus, methods, and articles of manufacture are claimed for processing stored and forwarded code comprising the transferring of the stored and forwarded code from a storage area to a transfer component, wherein the code is passed to a proscribed code scanner. The proscribed code seamier indicates the presence or absence of proscribed code, which may be a virus, confidential material, harassing material, etc. and provides the indication back to the transfer component, wherein the code may be quarantined or otherwise intercepted depending upon the results of the scan. The especially preferred embodiments operate within a UNIX sendmail environment.

Claims

1. A method for processing stored and forwarded code comprising:

providing a computer with a storage component, transferring code, from said storage component, to a transfer component;

transferring said code, from said transfer component, to a proscribed code scanner including exchanging information between said transfer component and said proscribed code scanner whereby said transfer component interrogates said proscribed code scanner to obtain processing status information;

providing an indicator via said proscribed code scanner and indicating, via said proscribed code scanner returning said indicator to said transfer component, whether said code contains proscribed code; and

, without transmitting said code that was transferred to the proscribed code scanner for analysis to said transfer component; and

transferring said code to at least one secondary storage component based on said indication;

wherein said transfer component is configured with instructions to implement transfer of code directly to at least one secondary storage component without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code that the transfer component uses to make a decision, and

wherein the method includes transferring code directly to at least one secondary storage component without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code to correspond with a proscribed code scanner status for that code.

2. A method as in claim 1 further comprising the step of transferring said code from said at least one secondary storage component to a subsequent code transfer component.

3. A method as in claim 1 further comprising the step of sorting said code prior to transfer to said at least one secondary storage component.

4. A method as in claim 3 further comprising the step of transferring code to at least two secondary storage components, with a first of at least two secondary storage components receiving smaller stored and forwarded code and a second of at least two secondary storage components receiving larger stored and forwarded code.

5. A method as in claim 1 wherein said code comprises email.

22. The method of claim 1, wherein at least a plurality of secondary storage components are provided, including at least one secondary storage component comprising a queue for outgoing messages, and wherein at least one other of said queue comprises a queue from which messages are copied by a said transfer component and said copies are transferred to said proscribed code scanner.

23. The method of claim 1, wherein said code contains header information and wherein when said transfer component transfers code directly to at least one secondary storage component without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code to correspond with a proscribed code scanner status for that code, said transfer component recognition is based on said header information.

6. A method for processing stored and forwarded code comprising:

providing a computer with a storage component, transferring code, from said storage component, to a first transfer component;

sorting said code;

transferring said code, based on the results of said sort, to at least one first secondary storage component;

transferring said code from at least one first secondary storage component to at least one secondary transfer component;

transferring said code, from said at least one first secondary transfer component to a proscribed code scanner;

indicating, via said proscribed code scanner to said at least one first transfer component, whether said code contains proscribed code, without transmitting said code to said transfer component; and

, transferring said code from at least one first secondary transfer component to at least one second secondary storage component based on said indication;

wherein said transfer component is configured with instructions to implement transfer of code directly to at least one secondary storage component without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code that the transfer component uses to make a decision, and

wherein the method includes transferring code directly to at least one secondary storage component without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code to correspond with a proscribed code scanner status for that code.

7. A method as in claim 6 further comprising the step of transferring said code from said at least one secondary storage component to a subsequent code transfer component.

8. A method as in claim 6 wherein the step of sorting said code further comprises sorting the code by size.

9. A method as in claim 6 wherein said code comprises email.

20. The method of claim 9, wherein the method comprises a method for sending mail using a mail transport agent, including creating a secondary queue which comprises a new queue prior to processing by said mail transport agent, and retrieving email code from the second queue prior to further processing by said mail transport agent and delivering prior to further processing by said mail transport agent said retrieved email code to a proscribed code scanner.

21. The method of claim 20, wherein where scanning of said email code delivered to said proscribed code scanner results in the identification of the presence of proscribed code the email code may remain in the secondary queue or be transferred to a second secondary queue, and wherein when scanning of said email code delivered to said proscribed code scanner does not result in the identification of the presence of proscribed code, the email code is be moved to one or more third secondary queues.

10. A method for processing stored and forwarded email, using sendmail, comprising:

providing a computer with a storage component, transferring email, from a sendmail queue, to a transfer component;

transferring email, from said transfer component, to a proscribed code scanner;

indicating, via said proscribed code scanner to said transfer component, whether said email contains proscribed code, without transmitting said code to said transfer component; and

, transferring said email to at least one secondary sendmail queue based on said indication;

wherein said transfer component is configured with instructions to implement transfer of code directly to at least one secondary sendmail queue without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code that the transfer component uses to make a decision, and

wherein the method includes transferring code directly to at least one secondary sendmail queue without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code to correspond with a proscribed code scanner status for that code.

11. A method as in claim 10 further comprising the step of transferring said email from said at least one secondary sendmail queue to a subsequent sendmail process.

12. A method as in claim 10 further comprising the step of sorting said email prior to transfer to said at least one secondary sendmail queue.

13. A method as in claim 10, further comprising the step of sorting said code prior to transfer to said at least one secondary storage component, wherein the step of sorting said email prior to transfer to said at least one secondary sendmail queue component further comprises sorting the email by size.

14. An computerized apparatus for processing stored and forwarded code comprising:

a storage component;

a transfer component;

a proscribed code scanner; and

, a first and a second secondary storage component;

wherein code, stored in said storage component, is transferred to said transfer component, and therefrom transferred to said proscribed code scanner, which, after scanning said code, indicates to said transfer component as to the presence of proscribed code, without transmitting said code to said transfer component; and

said transfer component transfers said code to either said first or second secondary storage component based upon the presence or absence of proscribed code as indicated by said proscribed code scanner;

wherein the apparatus is configured with instructions to implement the transfer of code from the transfer component directly to at least one of said first and second secondary storage components without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code that the transfer component uses to make a decision.

15. An apparatus as in claim 14 wherein said code comprises email.

16. An apparatus as in claim 14 wherein said storage component is a sendmail queue.

17. A computerized apparatus for processing stored and forwarded email, using sendmail, comprising:

storage means for storing code;

a sendmail queue;

a transfer component;

a proscribed code scanner; and

, a first and a second secondary storage component;

wherein said storage means is configured with instructions stored therein to implement a transfer of email, stored in said sendmail queue, to said transfer component, and from said transfer component to said proscribed code scanner, said proscribed code scanner being configured to scan said email and after scanning said email, to indicate to said transfer component as to the presence of proscribed code, without transmitting said code to said transfer component, and wherein said transfer component is configured with instructions to implement transfer of said code to either said first or second secondary sendmail queue based upon the presence or absence of proscribed code as indicated by said proscribed code scanner;

wherein the apparatus is configured with instructions to implement the transfer of code from the transfer component directly to at least one of said first or second secondary sendmail queue without transferring code to the proscribed code scanner when said transfer component recognizes information contained to said code that the transfer component uses to make a decision.

18. An article of manufacture comprising:

a computer-readable storage medium;

storage means in the medium for storing code;

said computer readable storage medium being configured with instructions stored therein that when processed with a processor transfers with transfer component said stored code stored in said storage means;

to a proscribed code scanner;

scans with said proscribed code scanner means for scanning said code for proscribed code and indicates with said proscribed code scanner means to said transfer component whether said code contains proscribed code, without transmitting said code to said transfer component; and

, a first and second secondary storage means in the medium for storing said code based upon the presence or absence of proscribed code as indicated by said proscribed code scanner means;

said computer readable storage medium being configured with instructions to implement exchanging information between said transfer component and said proscribed code scanner means whereby said transfer component interrogates said proscribed code scanner means to obtain processing status information;

said computer readable storage media being configured with instructions for providing an indicator via said proscribed code scanner means and indicating, via said proscribed code scanner means returning said indicator to said transfer component, whether said code contains proscribed code; and

, without transmitting said code that was transferred to the proscribed code scanner for analysis to said transfer component;

said computer readable storage medium being configured with instructions to transfer said code to at least one secondary storage component based on said indication;

wherein said transfer component is configured with instructions to implement transfer of code directly to at least one secondary storage component without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code that the transfer component uses to make a decision; and

wherein said computer readable storage medium being configured with instructions that implement the transfer of code directly to at least one secondary storage component without transferring code to the proscribed code scanner when said transfer component recognizes information contained in said code to correspond with a proscribed code scanner status for that code.

19. A method for processing stored and forwarded code comprising:

providing a computer with a storage component;

transferring code, from a storage component, to a first transfer component;

sorting said code;

transferring said code, based on the results of said sort, to at least one first secondary storage component;

transferring said code from at least one first secondary storage component to at least one first secondary transfer component;

transferring said code, from said at least one first secondary transfer component to a proscribed code scanner;

indicating, via said proscribed code scanner to said at least one first transfer component, whether said code contains proscribed code, without transmitting said code to said at least one first transfer component, including exchanging information between said transfer component and said proscribed code scanner whereby said transfer component interrogates said proscribed code scanner to obtain processing status information; and

,

transferring said code from at least one first secondary transfer component to at least one second secondary storage component based on said indication,

wherein at least a plurality of secondary storage components are provided, including at least one secondary storage component comprising a queue for outgoing messages, and wherein at least one other of said queue comprises a queue from which messages are copied by a said transfer component and said copies are transferred to said proscribed code scanner,

wherein said code comprises email, and

wherein the method includes the step of creating a secondary queue.