Methods and apparatus for blocking unwanted software downloads

• US 9,325,738 B2
• Filed: 01/30/2009
• Issued: 04/26/2016
• Est. Priority Date: 04/22/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Inventors: Campbell, Alexander Wade, Dolsen, Lee Thomas, Ositis, Vilis, Smith, Cameron Charles
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): MEJIA, FELICIANO S
• Application Number:
  US12/363,696
• Publication Number:
  US 20090138573A1
• Time in Patent Office: 2,643 Days
• Field of Search: 726/22, 715/234
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06T 1/0021 Image watermarking
• CPC Class Codes: G06T 1/0071 using multiple or alternating watermarks
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Methods and systems for blocking unwanted software downloads within a network. Such methods may thereby prevent (i) downloads of spyware from one or more identified locations, and/or (ii) certain outbound communications from the network and/or may also permit software downloads only from specified locations. In general, the policies are defined by rules specified by a network administrator or other user.

Claims

1. A method for a network device communicatively coupled to a public network and a private network, the method comprising:

receiving, by the network device, a content delivery mechanism from the public network;

determining, by the network device, a category of a source Uniform Resource Locator (URL) of the content delivery mechanism;

determining, by the network device, at least one of an object tag and a script content delivery mechanism;

determining, by the network device, whether at least one of the object tag and the script tag are permitted for the determined category of the source URL; and

if at least one of the object tag and the script tag are not permitted for the determined category of the source URL, transforming, by the network device, the content delivery mechanism by removing at least one of the object tag and the script tag from the content delivery mechanism.

2. The method of claim 1, wherein transforming the content delivery mechanism comprises removing all object tags from the content delivery mechanism if the determined category of the source URL is a suspicious category.

3. The method of claim 1, wherein the content delivery mechanism comprises a Web page.

4. The method of claim 1, wherein the content delivery mechanism comprises an Extensible Markup Language (XML) document.

13. The method of claim 1, wherein the network device is one or more of a proxy server, a firewall, a router and a bridge.

15. The non-transitory machine-readable storage medium of claim 13, wherein the network device is one or more of a proxy server, a firewall, a router and a bridge.

5. A network device, the network device communicatively coupled to a public network and a private network, the network device comprising:

a receiver configured to receive a content delivery mechanism from the public network;

a processor; and

a data storage device having stored thereon instructions that, when executed by the processor, cause the processor to;

receive a content delivery mechanism from the public network;

determine a category of a source Uniform Resource Locator (URL) of the content delivery mechanism;

determine at least one of an object tag and a script tag of the content delivery mechanism;

determine whether at least one of the object tag and the script tag are permitted for the determined category of the source URL; and

if at least one of the object tag and the script tag are not permitted for the determined category of the source URL, transform the content delivery mechanism by removing at least one of the object tag and the script tag from the content delivery mechanism.

6. The network device of claim 5, wherein the data storage device further stores instructions that, when executed by the processor, cause the processor to further transform the content delivery mechanism by removing all object tags from the content delivery mechanism if the determined category of the source URL is a suspicious category.

7. The network device of claim 5, wherein the content delivery mechanism comprises a Web page.

8. The network device of claim 5, wherein the content delivery mechanism comprises an Extensible Markup Language (XML) document.

14. The network device of claim 5, wherein the network device is one or more of a proxy server, a firewall, a router and a bridge.

9. A non-transitory machine-readable storage medium for a network device communicatively coupled to a public network and a private network, the non-transitory machine-readable storage medium comprising software instructions that, when executed by a processor of the network device, cause the network device to:

receive a content delivery mechanism from the public network;

determine a category of a source Uniform Resource Locator (URL) of the content delivery mechanism;

determine at least one of an object tag and a script tag of the content delivery mechanism;

determine whether at least one of the object tag and the script tag are permitted for the determined category of the source URL; and

if at least one of the object tag and the script tag are not permitted for the determined category of the source URL, transform the content delivery mechanism by removing at least one of the object tag and the script tag from the content delivery mechanism.

10. The non-transitory machine-readable storage medium of claim 9, wherein the non-transitory machine-readable storage medium further comprises software instructions that, when executed by the processor, cause the processor to transform the content delivery mechanism by removing all object tags from the content delivery mechanism if the determined category of the source URL is a suspicious category.

11. The non-transitory machine-readable storage medium of claim 9, wherein the content delivery mechanism comprises a Web page.

12. The non-transitory machine-readable storage medium of claim 9, wherein the content delivery mechanism comprises an Extensible Markup Language (XML) document.