System, method, and computer program product for preventing scanning of a copy of a message

• US 8,707,425 B2
• Filed: 09/07/2007
• Issued: 04/22/2014
• Est. Priority Date: 09/07/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Rathor, Hirendra, Hariharasubramanian, Muthu Nivas
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Le, Canh
• Application Number:
  US11/852,148
• Publication Number:
  US 20130247131A1
• Time in Patent Office: 2,419 Days
• Field of Search: 726 22- 24, 709223-225, 709/206
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

A system, method, and computer program product are provided for preventing scanning of a copy of a message. In use, it is determined whether an identifier of a message is stored in a data structure. Further, the scanning of a copy of the message is prevented, based on the determination.

Claims

1. A method, comprising:

determining, using a processor provided in a client device, whether an identifier indicating a scan of a message is stored, wherein the identifier and a scan action associated with the identifier are stored in a same data structure separate from the message and the data structure includes a plurality of identifiers and associated scan actions from other previously sent and previously scanned messages, wherein the identifier includes at least a portion of a header of the message and one or more indices identifying scan actions for associated portions of the message that have already been scanned, wherein each indices is stored as a hash of a portion of the message that has already been scanned, and wherein the message is an electronic mail message sent from a first location over a network to a second location;

preventing scanning of a copy of the message, based on the determination, that at least a portion of the message has already been scanned, wherein the portion of the message that has already been scanned is identified by a corresponding indices stored in the data structure;

determining whether or not the copy of the message is to be deleted based on a parameter contained in the identifier;

deleting the copy of the message in response to the parameter indicating that the copy of the message is to be deleted;

retrieving a scan action from the data structure to identify an appropriate scan action for the portion of the message that has already been scanned, wherein the scan action includes cleaning, deleting, replacing, or quarantining; and

wherein each portion of the message has an associated scan action;

performing the cleaning, deleting, replacing or quarantining operation to the portion of the copy of the message represented by the corresponding indices based on the identified scan action; and

removing the scan action indicating the at least one of the cleaning, the deleting, the replacing and the quarantining of the portion of the message from the data structure, wherein the data structure is a scan action cache.

2. The method of claim 1, wherein the copy of the message is a sent electronic mail message.

3. The method of claim 1, wherein the determination is responsive to a request to access, create, or update the copy of the message.

4. The method of claim 1, wherein the message is an outgoing electronic mail message.

5. The method of claim 1, wherein the identifier of the message is stored in the data structure, in response to a scan of the message.

6. The method of claim 1, wherein the data structure includes a cache.

7. The method of claim 1, further comprising applying a plurality of scan actions to the copy of the message.

8. The method of claim 1, wherein the scan action is a result of a scan of the message.

9. The method of claim 7, wherein the plurality of scan actions comprise one or more of:

cleaning an attachment or body of the message;

deleting the message;

deleting an attachment or body of the message; and

replacing an attachment or body of the message with an alert.

10. The method of claim 1, further comprising scanning the message and storing one or more actions of the scanning in another data structure.

11. The method of claim 1, further comprising scanning the copy of the message and storing one or more actions of the scanning in another data structure, in response to a determination that the identifier of the message is not stored in the data structure.

12. The method of claim 1, further comprising scanning at least one of a body of the message and an attachment of the message.

20. The method of claim 1, wherein the determining includes determining whether a portion of the identifier is stored in the data structure.

13. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:

determining, using a processor provided in a client device, whether an identifier indicating a scan of a message is stored, wherein the identifier and a scan action associated with the identifier are stored in a same data structure separate from the message and the data structure includes a plurality of identifiers and associated scan actions from other previously sent and previously scanned messages, wherein the identifier includes at least a portion of a header of the message and one or more indices identifying scan actions for associated portions of the message that have already been scanned, wherein each indices is stored as a hash of a portion of the message that has already been scanned, and wherein the message is an electronic mail message sent from a first location over a network to a second location;

preventing scanning of a copy of the message, based on the determination, that at least a portion of the message has already been scanned, wherein the portion of the message that has already been scanned is identified by a corresponding indices stored in the data structure;

determining whether or not the copy of the message is to be deleted based on a parameter contained in the identifier;

deleting the copy of the message in response to the parameter indicating that the copy of the message is to be deleted;

retrieving a scan action from the data structure to identify an appropriate scan action for the portion of the message that has already been scanned, wherein the scan action includes cleaning, deleting, replacing, or quarantining; and

wherein each portion of the message has an associated scan action;

performing the cleaning, deleting, replacing or quarantining operation to the portion of the copy of the message represented by the corresponding indices based on the identified scan action; and

removing the scan action indicating the at least one of the cleaning, the deleting, the replacing and the quarantining of the portion of the message from the data structure, wherein the data structure is a scan action cache.

18. The computer program product of claim 13, wherein the determining includes determining whether a portion of the identifier is stored in the data structure.

19. The computer program product of claim 13, wherein the operations further comprise:

scanning at least one of a body of the message and an attachment of the message.

14. A system, comprising:

a processor; and

a memory coupled to the processor such that the system is configured for;

determining, using a processor provided in a client device, whether an identifier indicating a scan of a message is stored, wherein the identifier and a scan action associated with the identifier are stored in a same data structure separate from the message and the data structure includes a plurality of identifiers and associated scan actions from other previously sent and previously scanned messages, wherein the identifier includes at least a portion of a header of the message and one or more indices identifying scan actions for associated portions of the message that have already been scanned, wherein each indices is stored as a hash of a portion of the message that has already been scanned, and wherein the message is an electronic mail message sent from a first location over a network to a second location;

preventing scanning of a copy of the message, based on the determination, that at least a portion of the message has already been scanned, wherein the portion of the message that has already been scanned is identified by a corresponding indices stored in the data structure;

determining whether or not the copy of the message is to be deleted based on a parameter contained in the identifier;

deleting the copy of the message in response to the parameter indicating that the copy of the message is to be deleted;

retrieving a scan action from the data structure to identify an appropriate scan action for the portion of the message that has already been scanned, wherein the scan action includes cleaning, deleting, replacing, or quarantining; and

wherein each portion of the message has an associated scan action;

performing the cleaning, deleting, replacing or quarantining operation to the portion of the copy of the message represented by the corresponding indices based on the identified scan action; and

removing the scan action indicating the at least one of the cleaning, the deleting, the replacing and the quarantining of the portion of the message from the data structure, wherein the data structure is a scan action cache.

15. The system of claim 14, further comprising non-transitory computer readable memory coupled to the processor via a bus.

16. The system of claim 14, wherein the determining includes determining whether a portion of the identifier is stored in the data structure.

17. The system of claim 14, further comprising scanning at least one of a body of the message and an attachment of the message.