Method for preventing activation of malicious objects

• US 20050235160A1
• Filed: 04/19/2004
• Published: 10/20/2005
• Est. Priority Date: 04/19/2004
• Status: Active Grant

• Current Assignee: SafeNet Data Security (Israel) Ltd.
• Original Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Inventors: Cohen, Oded, Margalit, Yanki, Margalit, Dany
• Granted Patent: US 7,386,884 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method for preventing activating a malicious object passing through a checkpoint, and decreasing the overall inspection delay thereof, the method comprising the steps of: (a) at the checkpoint, creating an envelope file, being an executable file comprising: the object; code for extracting the object from the envelope file; and an indicator for indicating the integrity of the object; (b) forwarding the envelope file instead of the object toward its destination, while holding at least a part of the envelope file which comprises the indicator; (c) inspecting the object; and (d) setting the indicator on the envelope file to indicate the inspection result thereof, and releasing the rest of the envelope file.

Claims

1. A method for preventing activating a malicious object passing through a checkpoint, and decreasing the overall inspection delay thereof, the method comprising the steps of:

a. at said checkpoint, creating an envelope file, being an executable file comprising;

said object;

code for extracting said object from said envelope file; and

an indicator for indicating the integrity of said object;

b. forwarding said envelope file instead of said object toward its destination, while holding at least a part of said envelope file which comprises said indicator;

c. inspecting said object;

d. setting said indicator on said envelope file to indicate the inspection result thereof, and

e. releasing the rest of said envelope file.

2. A method according to claim 1, wherein said checkpoint is selected from a group comprising:

a gateway server, a proxy server.

3. A method according to claim 1, wherein said code is auto-executable.

4. A method according to claim 1, wherein the name of said envelope file is identical to the name of the inspected object.

5. A method according to claim 1, wherein the name of said envelope file differs than the name of the inspected object.

6. A method according to claim 1, wherein said indicator is selected from a group comprising:

a CRC of at least one part of said envelope file, a CRC of at least one part of said inspected object, a checksum of at least one part of said envelope file, a checksum of at least one part of said inspected object, a value stored within said envelope file, absence of a part of said envelope file, absence of a part of said object.

7. A method according to claim 1, wherein at least a part of said object is secured.

8. A method according to claim 1, wherein at least a part of said envelope file is secured.

9. A method according to claim 1, wherein said indicator is stored within the last part of said envelope file.

10. A method according to claim 1, wherein said envelope file further comprises code for displaying an acknowledgment.

11. A method according to claim 10, wherein said acknowledgment indicates integrity of said object.