System and method of preventing the transmission of known and unknown electronic content to and from servers or workstations connected to a common network

• US 8,799,644 B2
• Filed: 01/13/2004
• Issued: 08/05/2014
• Est. Priority Date: 01/13/2003
• Status: Active Grant

• Current Assignee: Sureshwara Incorporated
• Original Assignee: Karsof Systems, LLC
• Inventors: Kaleedhass, Kartik
• Primary Examiner(s): Yalew, Fikremariam A
• Application Number:
  US10/755,321
• Publication Number:
  US 20040143764A1
• Time in Patent Office: 3,857 Days
• Field of Search: None
• US Class Current: 713/154
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

A system for preventing the transmission of known and unknown electronic contents to and from servers or workstations connected to a common network. The system includes devices for means for interpreting the contents of a messaging protocol or application network protocol, for checking compliance of the electronic contents with the messaging protocol specification or application network protocol specification and for filtering the electronic content based on its functions.

Claims

1. A system for preventing the transmission of known and unknown electronic contents to and from servers or workstations connected to a common network comprising:

means for interpreting contents of a messaging protocol or application network protocol, including at least HyperText Transfer Protocol, File Transfer Protocol, and Secure Shell;

means for checking compliance of the electronic contents with the messaging protocol specification and Internet Engineering Task Force application network protocol specification by an intermediate verifier including protocol specification therein;

means for filtering known or unknown electronic content based upon a function of the electronic content identified by a call to an operating system for actions of at least one of file sharing, file modification, file deletion and file creation; and

wherein the means for checking compliance of the electronic contents with the messaging protocol specification or application network protocol specification comprises at least one server, at least one workstation or combinations thereof and an intermediate verifier with protocol specification maintained therein and wherein the at least one server, the at least one workstation and the combinations thereof and the intermediate verifier are the same as the at least one server, at least one workstation or combinations thereof and an intermediate verifier in said means for interpreting contents of a messaging protocol or application network protocol, or are separately independent,

wherein the known and unknown electronic content is identified by one or more of the following pattern of binary codes within the electronic contents;

name of the electronic content;

orientation and format of the electronic content including plain text file, image file or data files, and function of the electronic content.

2. A system as claimed in claim 1, further comprising means for preventing attacks on the servers and workstations without knowing details of the attack.

3. A system as claimed in claim 1, wherein the means for interpreting contents of the messaging protocol or application network protocol comprises at least one server, at least one work station or combinations thereof and an intermediate verifier with protocol specification maintained therein.

4. A system as claimed in claim 1, wherein the means for interpreting contents of a messaging protocol or application network protocol comprises at least one workstation and intermediate verifier with protocol specification maintained therein.

5. A system as claimed in claim 1, wherein the means for interpreting contents of a messaging protocol or application network protocol comprises at least one server and an intermediate verifier with protocol specification maintain therein.

6. A system as claimed in claim 1, wherein the intermediate verifier checks compliance of the electronic contents between at least one server or at least one workstation or combinations thereof.

7. A system as claimed in claim 1, wherein the means for filtering the electronic content based on its function comprises a network of at least one server and at least one workstation or combinations thereof and at least one intermediate verifier functioning as a filter.

8. A system as claimed in claim 1, wherein the workstation is selected from at least one of the following:

Personal digital assistant (PDA);

Personal computers;

Mobile cellular telephone;

or

any apparatus with computing capability connected to a network.

9. A system as claimed in claim 1, wherein the patterns, names and orientation and format are used for filtering known content and the functions are used for filtering the unknown content.

10. A system as claimed in claim 1, wherein the unknown content once identified to have a damaging function within its name, pattern and orientation and format will be identified and stored in the database for further or future filtering.

11. A system as claimed in claim 10, wherein the identification and storage is done automatically.