Signature distribution in a document registration system

• US 8,504,537 B2
• Filed: 03/24/2006
• Issued: 08/06/2013
• Est. Priority Date: 03/24/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: de la Iglesia, Erik, Ahuja, Ratinder Paul Singh, Deninger, William, King, Sam
• Primary Examiner(s): NGUYEN, KIM T
• Application Number:
  US11/388,734
• Publication Number:
  US 20070226510A1
• Time in Patent Office: 2,692 Days
• Field of Search: 707/699, 707/706
• US Class Current: 707/699
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, is not transmitted undetected over and off of the network. In one embodiment, the invention includes a manager agent to maintain signatures of registered documents and a match agent to detect the unauthorized transmission of the content of registered documents.

Claims

1. A computer-implemented method comprising:

intercepting packets being transmitted over a network at a distributed match agent of a document registration system;

reassembling the packets into an intercepted document;

generating a set of signatures associated with the intercepted document;

comparing the set of signatures associated with the intercepted document with signatures associated with registered documents, wherein the signatures associated with the registered documents are stored in a local signature database of the distributed match agent; and

determining whether to notify a manager agent of the registration system based on the result of the comparison.

2. The method of claim 1, further comprising:

sending a notification to the manager agent, the notification indicating the presence of registered content in the intercepted document.

3. The method of claim 1, wherein the set of signatures generated for the intercepted document and the registered documents are generated using the same signature generation procedure.

4. The method of claim 1, wherein comparing the set of signatures comprises:

determining if at least one signature is common to both a registered document and the intercepted document.

5. The method of claim 1, wherein determining whether to notify the manager agent comprises:

comparing the number of signatures from the set of signatures that were matched to a threshold number.

6. The method of claim 1, wherein determining whether to notify the manager agent comprises:

comparing the number of different documents the matched signatures originated from with a threshold number.

7. The method of claim 1, further comprising:

receiving, at the match agent, an update patch from the manager agent; and

updating the local signature database of the match agent with the update patch.

8. A document registration system comprising:

a manager agent including;

a registration module to register documents, and

a master signature database to maintain signatures of registered documents;

a match agent including;

at least one object capture module to intercept packets being transmitted over a network and reassemble the packets into an intercepted document,

a signature generator to generate a set of signatures associated with the intercepted document,

a search engine to compare the set of signatures associated with the intercepted document with signatures stored in a local signature database of the distributed match agent that are associated with registered documents, and

a notification module to determine whether to send a notification to the manager agent of registration system based on the result of the comparison.

9. The document registration system of claim 8, wherein the local signature database is periodically updated by the manager agent.

10. The document registration system of claim 8, wherein the notification indicates content of a registered document in the intercepted document.

11. The document registration system of claim 8, wherein the set of signatures generated for the intercepted document and the registered documents are generated using the same signature generation procedure.

12. An article of manufacture including program code which, when executed by a machine, causes the machine to perform a method, the method comprising:

intercepting packets being transmitted over a network at a distributed match agent of a document registration system;

reassembling the packets into an intercepted document;

generating a set of signatures associated with the intercepted document;

comparing the set of signatures associated with the intercepted document with signatures associated with registered documents, wherein the signatures associated with the registered documents are stored in a local signature database of the distributed match agent; and

determining whether to notify a manager agent of the registration system based on the result of the comparison.

13. The article of manufacture of claim 12, wherein the method further comprises:

sending a notification to the manager agent, the notification indicating the presence of registered content in the intercepted document.

14. The article of manufacture of claim 12, wherein the set of signatures generated for the intercepted document and the registered documents are generated using the same signature generation procedure.

15. The article of manufacture of claim 12, wherein comparing the set of signatures comprises:

determining if at least one signature is common to both a registered document and the intercepted document.

16. The article of manufacture of claim 12, wherein the method further comprises:

receiving, at the match agent, an update patch from the manager agent; and

updating the local signature database of the match agent with the update patch.

17. A distributed match agent comprising:

a signature database to store signatures of registered documents;

a signature generator to generate signatures for intercepted documents received by the distributed match agent;

a search engine to compare the signatures generated by the signature generator to the signatures stored in the signature database; and

a notification module to communicate results from the search engine to a manager agent.