System and method of protecting a computing system from harmful active content in documents

• US 20050198692A1
• Filed: 03/02/2004
• Published: 09/08/2005
• Est. Priority Date: 03/02/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zurko, Mary Ellen, Congdon, Robert, Morales, Veronica
• Granted Patent: US 7,607,172 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

Described are a system and method for protecting a computing device from potentially harmful code in a document. One or more definitions of potentially harmful active content are provided in an editable text file. The document is compared with each definition of potentially harmful active content in the editable text file to identify potentially harmful active content within the document. The document is modified to render harmless any identified potentially harmful active content before presenting the document to the computing device.

Claims

1. A method for protecting a computing device from potentially harmful code in a document, the method comprising:

providing one or more definitions of potentially harmful active content in an editable text file;

comparing the document with each definition of potentially harmful active content in the editable text file to identify potentially harmful active content within the document; and

modifying the document to render harmless any identified potentially harmful active content before presenting the document to the computing device.

2. The method of claim 1, further comprising syntactically examining the document and placing the document in a valid form before comparing the document with each definition.

3. The method of claim 1, further comprising transmitting the modified document to the computing device over a network after the potentially harmful active content is rendered harmless.

4. The method of claim 3, wherein each definition is listed in the text file in a same language structure and schema as the document.

5. The method of claim 3, further comprising mapping each of the identified elements in the data file into a same language and schema as the document.

6. The method of claim 1, further comprising representing the document as a first document object model (DOM) tree and the configuration file as a second DOM tree.

7. A computing system, comprising:

an editable configuration file listing one or more definitions of active content to be filtered from documents;

a comparator comparing each definition in the modifiable configuration file with content in the document to identify active content to be filtered from the document; and

a code generator modifying the document to render harmless the identified active content.

8. The system of claim 7, further comprising a validating parser placing the document in valid form before the comparator compares the document with each definition in the editable configuration file.

9. The system of claim 7, further comprising a mapper converting each definition in the configuration file into a language and schema of the document.

10. The system of claim 7, wherein the configuration file is an XML file.

11. An apparatus for protecting a computing device from potentially harmful code in a document, the apparatus comprising:

means for providing one or more definitions of potentially harmful active content in an editable text file;

means for comparing the document with each definition of potentially harmful active content in the editable text file to identify potentially harmful active content within the document; and

means for rendering harmless the potentially harmful active content identified within the document before the document is presented at the computing device.

12. The apparatus of claim 11, further comprising means for syntactically examining the document and placing the document in a valid form before comparing means compares the document with each definition.

13. The apparatus of claim 11, further comprising means for transmitting the modified document to the computing device over a network after the potentially harmful active content is rendered harmless.

14. The apparatus of claim 11, further comprising means for representing the document as a first document object model (DOM) tree and the configuration file as a second DOM tree.

15. A computer program product for use with a computer system, the computer program product comprising a computer useable medium having embodied therein program code comprising:

program code for providing one or more definitions of potentially harmful active content in an editable text file;

program code for comparing the document with each definition of potentially harmful active content in the editable text file to identify potentially harmful active content within the document; and

program code for rendering harmless the potentially harmful active content identified within the document before the document is presented to the computing device.

16. The computer program product of claim 15, further comprising program code for syntactically examining the document and placing the document in a valid form before the program code compares the document with each definition.

17. The computer program product of claim 15, further comprising program code for transmitting the modified document to the computing device over a network after the potentially harmful active content is rendered harmless.

18. The computer program product of claim 15, further comprising program code for representing the document as a first document object model (DOM) tree and the configuration file as a second DOM tree.

19. A computer data signal embodied in a carrier wave for use with a computer system having a display and capable of generating a user interface through which a user may interact with the computer system, the computer data signal comprising:

program code for providing one or more definitions of potentially harmful active content in an editable text file;

program code for comparing the document with each definition of potentially harmful active content in the editable text file to identify potentially harmful active content within the document; and

program code for rendering harmless the potentially harmful active content identified within the document before the document is presented to the computing device.

20. The computer data signal of claim 19, further comprising program code for syntactically examining the document and placing the document in a valid form before the program code compares the document with each definition.

21. The computer data signal of claim 19, further comprising program code for transmitting the modified document to the computing device over a network after the potentially harmful active content is rendered harmless.

22. The computer data signal of claim 19, further comprising program code for representing the document as a first document object model (DOM) tree and the configuration file as a second DOM tree.