Systems and methods for securing computers

• US RE45,326 E1
• Filed: 11/09/2012
• Issued: 01/06/2015
• Est. Priority Date: 10/05/2001
• Status: Expired due to Term

• Current Assignee: ServStor Technologies, LLC (IP Investments Group LLC)
• Original Assignee: Resolute Focus LLC (Intellectual Ventures LLC)
• Inventors: Tsai, Hungchou
• Primary Examiner(s): Meky, Moustafa M
• Application Number:
  US13/672,978
• Time in Patent Office: 788 Days
• Field of Search: 709200-206, 709217-227, 709/228
• US Class Current: 709/206
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/12 with filtering and selective blocking capabilities
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods are disclosed for avoiding electronic mail (email) attacks on a computer by downloading one or more emails in virtual-copy format to prevent the one or more emails from executing; determining whether a potentially infected email is in the one or more emails; and displaying the potentially infected email to a user and providing a user interface to allow the user to select and delete the infected email prior to downloading emails to the user'"'"'s computer.

Claims

1. A method for avoiding electronic mail (email) attacks on a computer, comprising:

downloading to a first email application running on the computer one or more emails in virtual-copy format to prevent the one or more emails from executing;

determining by the first email application whether a potentially infected email is in the one or more emails; and

displaying the potentially infected email to a user and providing a user interface to allow the user to select and delete the infected email using the first email application prior to downloading emails to a second email application running on the user'"'"'s computer.

2. The method of claim 1, further comprising allowing non-infected emails to be accessed.

3. The method of claim 1, further comprising downloading non-infected emails to an email software said second email application.

4. The method of claim 3, wherein the email software is Microsoft Outlook.

5. The method of claim 1, further comprising parsing the downloaded virtual-copy format emails to determine whether the emails are secure.

6. The method of claim 1, wherein potentially infected emails are determined based on one or more of the following:

an email from field, an email to field, and an email subject field.

7. The method of claim 1, further comprising determining whether a security policy exists.

8. The method of claim 7, wherein the security policy specifies characteristics of potentially infected emails.

9. The method of claim 7, further comprising removing one or more potentially infected emails based on the security policy.

10. The method of claim 1, further comprising displaying a summary for each email.

11. A system for avoiding electronic mail (email) attacks on a computer, comprising:

a processor;

a memory coupled to the processor, the memory comprising computer program instructions executable by the processor comprising;

meansinstructions for downloading to a first email application running on the computer one or more emails in virtual-copy format prevent the one or more emails from executing;

meansinstructions for determining by the first email application whether a potentially infected email is in the one or more emails; and

meansinstructions for displaying the potentially infected email to a user and providing a user interface to allow the user to select and delete the infected email using the first email application prior to downloading emails to a second email application running on the user'"'"'s computer.

12. The system of claim 11, further comprising means instructions for allowing non-infected emails to be accessed.

13. The system of claim 11, further comprising means instructions for downloading non-infected emails to an email software said second email application.

14. The system of claim 13, wherein the email software is Microsoft Outlook.

15. The system of claim 11, further comprising means instructions for parsing the downloaded virtual-copy format emails to determine whether the emails are secure.

16. The system of claim 11, wherein potentially infected emails are determined based on one or more of the following:

an email from field, an email to field, and an email subject field.

17. The system of claim 11, further comprising means instructions for determining whether a security policy exists.

18. The system of claim 17, wherein the security policy specifies characteristics of potentially infected emails.

19. The system of claim 17, further comprising means instructions for removing one or more potentially infected emails based on the security policy.

20. The system of claim 11, further comprising code instructions to:

retrieve emails in raw format and store emails in the virtual-copy format;

extract e-mail headers including To, From, Subject, Cc, Bcc, Attachment and Body text;

diagnose the headers To, From and Subject data to detect a virus pattern or behavior; and

diagnose an attachment file to detect any potential auto run pattern or behavior.

21. A computer program embodied on a non-transitory computer readable medium, the program including code for avoiding electronic mail (email) attacks on a computer, comprising:

code for downloading to a first email application running on the computer one or more emails in virtual-copy format to prevent the one or more emails from executing;

code for determining by the first email application whether a potentially infected email is in the one or more emails; and

code for displaying the potentially infected email to a user and providing a user interface to allow the user to select and delete the infected email using the first email application prior to downloading emails to a second email application running on the user'"'"'s computer.

22. The computer program of claim 21, further comprising code for allowing non-infected emails to be accessed via the second email application.

23. The computer program of claim 21, wherein the code for determining is configured to parse a downloaded virtual-copy format email to determine whether the corresponding email is secure.

24. The computer program of claim 21, wherein the code for determining determines potentially infected emails based on one or more of the following:

an email from field, an email to field, and an email subject field.

25. A programmed computer, comprising electronic computer hardware operating in combination with software to avoid electronic mail (email) attacks on a computer, the programmed computer being configured to execute a plurality of steps, the steps comprising:

downloading to a first email application running on the computer one or more emails in virtual-copy format to prevent the one or more emails from executing;

determining by the first email application whether a potentially infected email is in the one or more emails; and

displaying the potentially infected email to a user and providing a user interface to allow the user to select and delete the infected email using the first email application prior to downloading emails to a second email application running on the user'"'"'s computer.

26. The programmed computer of claim 25, further comprising the computer being configured to allow non-infected emails to be accessed via the second email application.

27. The programmed computer of claim 25, wherein computer is configured to perform the determining by parsing a downloaded virtual-copy format email to determine whether the corresponding email is secure.

28. The programmed computer of claim 25, wherein computer is configured to determine potentially infected emails based on one or more of the following:

an email from field, an email to field, and an email subject field.

29. A computer program embodied on a non-transitory computer readable medium, the program including code for avoiding electronic mail (email) attacks on a computer, comprising:

code for downloading to, a first email program resident on the computer, one or more emails in non-executable format;

code for determining, by a second email program, whether a potentially infected email is in the one or more emails; and

code for displaying the potentially infected email to a user and providing a user interface to allow the user to select and delete the infected email using a third email program prior to downloading entails to a fourth email program resident on the user'"'"'s computer.

30. The computer program of claim 29, wherein the first and third email programs are part of the same email application.

31. The computer program of claim 29, wherein the second and third email programs are part of the same email application.

32. The computer program of claim 29, wherein non-infected emails in executable format are accessible via the fourth email program.

33. The computer program of claim 29, wherein the code for determining is configured to parse a non-executable format email to determine whether the corresponding email is secure.