Method and system for detecting restricted content associated with retrieved content

• US 8,220,050 B2
• Filed: 03/31/2008
• Issued: 07/10/2012
• Est. Priority Date: 03/31/2008
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Plc (Sophos Group Ltd.)
• Inventors: Sarathy, Gurusamy
• Primary Examiner(s): LOUIE, OSCAR A
• Application Number:
  US12/059,892
• Publication Number:
  US 20090249482A1
• Time in Patent Office: 1,562 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

In embodiments of the present invention improved capabilities are described for contextual information caused to be attached to data as it passes through a series of computing devices, the contextual information relating to the series of computing devices. The data and the contextual information may then be scanned to determine if the data is a target data. In response to the identification of a target data, the contextual information may be communicated to a central repository. The contextual information may then be analyzed in relation to other information stored in the central repository to determine a target source.

Claims

1. A method, comprising:

causing contextual information to be attached to data as it passes through a series of computing devices, the contextual information relating to the series of computing devices, wherein the data includes a plurality of sub-deliverables, wherein the contextual information includes a source address for each one of the plurality of sub-deliverables, and wherein the contextual information includes a pattern of changing source addresses for each one of the plurality of sub-deliverables;

authorizing delivery of the data and the contextual information to a client device;

scanning the data and the contextual information on the client device that receives the data and the contextual data to determine whether a target data is present;

in response to the identification of the target data, communicating the contextual information from the client device to a central repository; and

analyzing the contextual information at the central repository in relation to other information stored in the central repository to determine a remedial action for the target data.

2. The method of claim 1, wherein the contextual information is extracted from each one of the series of computing devices as the data passes through each one of the computing devices.

3. The method of claim 1, wherein the remedial action includes quarantining the data.

4. The method of claim 1, further comprising performing the remedial action.

5. The method of claim 1 wherein the target data includes a source having a restriction specified by a policy management facility.

6. The method of claim 1 wherein the target data includes restricted content.

7. The method of claim 1 wherein the target data includes malware.

8. The method of claim 1 wherein the target data includes confidential materials.

9. The method of claim 1 wherein the contextual information includes locale information for a source of the data.

10. The method of claim 1 wherein the data includes one or more of an electronic mail, a text file, and an image.

11. A computer program product embodied on a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:

causing contextual information to be attached to data as it passes through a series of computing devices, the contextual information relating to the series of computing devices, wherein the data includes a plurality of sub-deliverables, wherein the contextual information includes a source address for each one of the plurality of sub-deliverables, and wherein the contextual information includes a pattern of changing source addresses for each one of the plurality of sub-deliverables;

authorizing delivery of the data and the contextual information to a client device;

scanning the data and the contextual information on the client device that receives the data and the contextual data to determine whether a target data is present;

in response to the identification of the target data, communicating the contextual information from the client device to a central repository; and

analyzing the contextual information at the central repository in relation to other information stored in the central repository to determine a remedial action for the target data.

12. The computer program product of claim 11, wherein the contextual information is extracted from each one of the series of computing devices as the data passes through each one of the computing devices.

13. The computer program product of claim 11, wherein the remedial action includes quarantining the data.

14. The computer program product of claim 11, further comprising performing the remedial action.

15. The computer program product of claim 11 wherein the target data includes a source having a restriction specified by a policy management facility.

16. The computer program product of claim 11 wherein the target data includes restricted content.

17. The computer program product of claim 11 wherein the target data includes malware.

18. The computer program product of claim 11 wherein the target data includes confidential materials.

19. The computer program product of claim 11 wherein the contextual information includes locale information for a source of the data.

20. The computer program product of claim 11 wherein the data includes one or more of an electronic mail, a text file, and an image.