Document registration

• US 8,166,307 B2
• Filed: 08/31/2010
• Issued: 04/24/2012
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Ahuja, Ratinder Paul Singh, Howard, Matthew, Lowe, Rick, de la Iglesia, Erik, Deninger, William
• Primary Examiner(s): Chen, Shin-Hon
• Application Number:
  US12/873,061
• Publication Number:
  US 20110219237A1
• Time in Patent Office: 602 Days
• Field of Search: None
• US Class Current: 713/177
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/18 Legal services

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, cannot be transmitted undetected over and off of the network. In one embodiment, the invention includes maintaining a plurality of stored signatures, each signature being associated with one of a plurality of registered documents, intercepting an object being transmitted over a network, calculating a set of signatures associated with the intercepted object, and comparing the set of signatures with the plurality of stored signatures. In one embodiment, the invention can further include detecting registered content from the registered document being contained in the intercepted object, if the comparison results in a match of at least one of the signatures in the set of signatures with one or more of the plurality of stored signatures.

Claims

1. A method comprising:

maintaining a plurality of stored signatures in a data storage device, each signature being associated with one of a plurality of registered documents;

intercepting packets being transmitted over a network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow, wherein the reassembled object represents a content type;

calculating a set of signatures associated with the reassembled object;

determining the reassembled object contains content associated with a registered document when at least one match is found between the set of signatures and the plurality of stored signatures; and

identifying the registered document.

2. The method of claim 1, further comprising:

halting delivery of the intercepted complete flow in response to determining the reassembled object contains content associated with the registered document.

3. The method of claim 1, further comprising:

registering the plurality of documents according to one or more registration rules.

4. The method of claim 3, wherein the registration rules include at least one of a first rule to register all documents associated with a specified author and a second rule to register all documents associated with a specified Internet Protocol (IP) address.

5. The method of claim 1, wherein the intercepted complete flow includes a plurality of reassembled objects.

6. The method of claim 1, wherein each registered document is associated with a user that requested registration of the document, the user being alerted if an attempt is made to transmit at least a portion of the registered document over a network.

7. The method of claim 1, wherein the set of signatures associated with the reassembled object are calculated by generating a plurality of hashes over various portions of the reassembled object.

8. The method of claim 1, wherein the content associated with the registered document represents a different content type than the content type of the reassembled object.

9. An apparatus comprising:

a network interface module to connect the apparatus to a network; and

a processor operable to execute instructions for capturing and evaluating data transmissions over the network, including;

intercepting packets being transmitted over the network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow, wherein the reassembled object represents a content type;

calculating a set of signatures associated with the reassembled object; and

determining the reassembled object contains content associated with a registered document when at least one match is found between the set of signatures and the plurality of stored signatures; and

identifying the registered document.

10. The apparatus of claim 9, wherein the processor is operable to execute further instructions including:

halting delivery of the intercepted complete flow in response to determining the reassembled object contains content associated with the registered document.

11. The apparatus of claim 9, wherein the processor is operable to execute further instructions including:

registering the plurality of documents according to one or more registration rules, wherein the registration rules include at least one of a first rule to register all documents associated with a specified author and a second rule to register all documents associated with a specified Internet Protocol (IP) address.

12. The apparatus of claim 9, wherein the intercepted complete flow includes a plurality of reassembled objects.

13. The apparatus of claim 9, wherein each registered document is associated with a user that requested registration of the document, the user being alerted if an attempt is made to transmit at least a portion of the registered document over a network.

14. The apparatus of claim 9, wherein the content associated with the registered document represents a different content type than the content type of the reassembled object.

15. One or more non-transitory computer readable storage media that store instructions for execution and when executed by a processor are operable to perform operations comprising:

maintaining a plurality of stored signatures in a data storage device, each signature being associated with one of a plurality of registered documents;

intercepting packets being transmitted over a network between a source and a destination;

reassembling the packets into an intercepted complete flow, wherein the intercepted complete flow represents an ordered data stream of a communication between the source and the destination;

extracting a reassembled object from the intercepted complete flow, wherein the reassembled object represents a content type;

calculating a set of signatures associated with the reassembled object; and

determining the reassembled object contains content associated with a registered document when at least one match is found between the set of signatures and the plurality of stored signatures; and

identifying the registered document.

16. The non-transitory computer readable storage media of claim 15, the processor being operable to perform further operations including:

halting delivery of the intercepted complete flow in response to determining the reassembled object contains content associated with the registered document.

17. The non-transitory computer readable storage media of claim 15, the processor being operable to perform further operations including:

registering the plurality of documents according to one or more registration rules, wherein the registration rules include at least one of a first rule to register all documents associated with a specified author and a second rule to register all documents associated with a specified Internet Protocol (IP) address.

18. The non-transitory computer readable storage media of claim 15, wherein the intercepted complete flow includes a plurality of reassembled objects.

19. The non-transitory computer readable storage media of claim 15, wherein the set of signatures associated with the reassembled object are calculated by generating a plurality of hashes over various portions of the reassembled object.

20. The non-transitory computer readable storage media of claim 15, wherein the content associated with the registered document represents a different content type than the content type of the reassembled object.