DISARMING MALWARE IN DIGITALLY SIGNED CONTENT

• US 20180276390A1
• Filed: 03/20/2018
• Published: 09/27/2018
• Est. Priority Date: 01/05/2017
• Status: Active Grant

• Current Assignee: Votiro Cybersec Ltd
• Original Assignee: Votiro Cybersec Ltd
• Inventors: GRAFI, AVIV
• Granted Patent: US 10,452,853 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H05K 999/99 dummy group

Abstract

Systems and methods for disarming malicious code in digitally-signed content are provided. An example method includes determining that content is associated with a first digital signature, modifying at least a portion of digital values of the content to disable any malicious code included in the content, thereby creating modified content, and signing the modified content with a second digital signature, thereby creating signed modified content, the signed modified content including a data element corresponding to the first digital signature.

Claims

1-24. -24. (canceled)

25. A system for disarming malicious code in digitally-signed content, the system comprising:

means for determining that content is associated with a first digital signature;

means for creating modified content by modifying at least a portion of digital values of the content to disable any malicious code included in the content; and

means for signing the modified content with a second digital signature, thereby creating signed modified content, the signed modified content including a data element corresponding to the first digital signature.

38. A method for disarming malicious code in a computer system having a processor, the method comprising:

determining that input content associated with a recipient in a network is signed with a first digital signature;

verify authenticity of the first digital signature;

generating modified input content by modifying at least a portion of digital values of the input content to disable any malicious code included in the input content; and

signing the modified input content with a second digital signature, the signed modified input content including one or more elements indicative of the authenticity of the first digital signature.

44. A non-transitory computer-readable medium comprising instructions that when executed by a processor cause the processor to:

determine that content is associated with a first digital signature;

create modified content by modifying at least a portion of digital values of the content to disable any malicious code included in the content; and

sign the modified content with a second digital signature, thereby creating signed modified content, the signed modified content including a data element corresponding to the first digital signature.