Method to trickle and repair resources scanned using anti-virus technologies on a security gateway

• US 7,930,750 B1
• Filed: 04/20/2007
• Issued: 04/19/2011
• Est. Priority Date: 04/20/2007
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Taranto, Edward James, Zhou, Steve Y., Gauvin, William Joseph
• Primary Examiner(s): Srivastava; Vivek
• Assistant Examiner(s): SONG, HEE K
• Application Number:
  US11/738,220
• Time in Patent Office: 1,460 Days
• Field of Search: 726/13, 726/14, 726 22- 25, 709/223, 709/227
• US Class Current: 726/24
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

In one embodiment, a trickle and repair application receives data from a sending computer system and trickles the data to a target computer system over an in-band communication channel. The received data is evaluated for the presence of malicious code. When malicious code is detected in the data, trickling of the data is terminated. If the infected data is repairable, the data is repaired and an out-of-band target data notification is generated and sent to the target computer system. In one embodiment, receipt of the out-of-band target data notification causes the target computer system to flush the current buffer and any local files containing the trickled data. The target computer system returns an out-of-band target acknowledgement to the trickle and repair application and the repaired data is sent to the target computer system.

Claims

1. A computer implemented method comprising:

receiving data from a sending computer system, said data for delivery to a target computer system;

trickling at least a portion of said data to said target computer system over an in-band communication channel;

determining whether said data contains malicious code;

upon a determination that said data contains malicious code, terminating said trickling;

determining whether said data is repairable;

upon a determination that said data is repairable, generating repaired data;

generating an out-of-band target data notification said out-of-band target data notification causing said target computer system to remove said at least a portion of said data from said target computer system;

sending said out-of-band target data notification to said target computer system over an out-of-band communication channel;

receiving an out-of-band target acknowledgment from said target computer system; and

sending said repaired data to said target computer system.

2. The computer implemented method of claim 1 wherein said determining whether said data contains malicious code comprises scanning said data for said malicious code.

3. The computer implemented method of claim 1 wherein said sending said repaired data to said target computer system is over said in-band communication channel.

4. The computer implemented method of claim 1 wherein said sending said repaired data to said target computer system is over said out-of-band communication channel.

5. The computer implemented method of claim 1 wherein said out-of-band target data notification causes said target computer system to flush an associated current buffer and an associated local file so as to remove said at least a portion of said data from said target computer system.

6. The computer implemented method of claim 1 wherein said computer implemented method is implemented as a trickle and repair terminating security gateway system.

7. The computer implemented method of claim 1 wherein said computer implemented method is implemented as a trickle and repair non-terminating security gateway system.

8. The computer implemented method of claim 7 wherein said out-of-band target data notification is placed in at least one data packet and inserted into said out-of-band communication channel.

9. The computer implemented method of claim 7 wherein said repaired data is placed in one or more data packets and inserted into said in-band communication channel.

10. The computer implemented method of claim 7 wherein said repaired data is placed in one or more data packets and inserted into said out-of-band communication channel.

11. The computer implemented method of claim 1 wherein said data is at least a portion of a file, and further where said repaired data is sent to said target computer system as part of a repaired file.

12. The computer implemented method of claim 1 wherein said data is at least a portion of a file, and further where said repaired data is sent to said target computer system as part of a repaired file portion.

13. The computer implemented method of claim 1 wherein at least said repaired data is sent to said sending computer system.

14. A computer system comprising:

a memory having stored therein a trickle and repair application; and

a processor coupled to said memory, wherein execution of said trickle and repair application generates a method comprising;

receiving data from a sending computer system, said data for delivery to a target computer system;

trickling at least a portion of said data to said target computer system over an in-band communication channel;

determining whether said data contains malicious code;

upon a determination that said data contains malicious code, terminating said trickling;

determining whether said data is repairable;

upon a determination that said data is repairable, generating repaired data;

generating an out-of-band target data notification, said out-of-band target data notification causing said target computer system to remove said at least a portion of said data from said target computer system;

sending said out-of-band target data notification to said target computer system over an out-of-band communication channel;

receiving an out-of-band target acknowledgment from said target computer system; and

sending said repaired data to said target computer system.

15. A computer program product comprising a tangible computer readable medium containing computer program code comprising:

a trickle and repair application for receiving data from a sending computer system, said data for delivery to a target computer system;

said trickle and repair application further for trickling at least a portion of said data to said target computer system over an in-band communication channel;

said trickle and repair application further for determining whether said data contains malicious code;

upon a determination that said data contains malicious code, said trickle and repair application further for terminating said trickling;

said trickle and repair application further for determining whether said data is repairable;

upon a determination that said data is repairable, said trickle and repair application further for generating repaired data;

said trickle and repair application further for generating an out-of-band target data notification said out-of-band target data notification causing said target computer system to remove said at least a portion of said data from said target computer system;

said trickle and repair application further for sending said out-of-band target data notification to said target computer system over an out-of-band communication channel;

said trickle and repair application further for receiving an out-of-band target acknowledgment from said target computer system; and

said trickle and repair application further for sending said repaired data to said target computer system.

16. The computer program product of claim 15 wherein said sending said repaired data to said target computer system is over said in-band communication channel.

17. The computer program product of claim 15 wherein said sending said repaired data to said target computer system is over said out-of-band communication channel.

18. The computer program product of claim 15 wherein said out-of-band target data notification causes said target computer system to flush an associated current buffer and an associated local file so as to remove said at least a portion of said data from said target computer system.

19. The computer program product of claim 15 wherein said data is at least a portion of a file, and further where said repaired data is sent to said target computer system as part of a repaired file.

20. The computer program product of claim 15 wherein said data is at least a portion of a file, and further where said repaired data is sent to said target computer system as part of a repaired file portion.