Method and apparatus for immunizing data in computer systems from corruption

• US 8,131,804 B2
• Filed: 11/10/2005
• Issued: 03/06/2012
• Est. Priority Date: 11/19/2004
• Status: Expired due to Fees

• Current Assignee: Jerrold M. Deisenroth, J Michael Greata
• Original Assignee: Jerrold M. Deisenroth, J Michael Greata
• Inventors: Greata, J Michael, Deisenroth, Jerrold M
• Primary Examiner(s): Jaroenchonwanit, Bunjob
• Application Number:
  US11/164,122
• Publication Number:
  US 20060168053A1
• Time in Patent Office: 2,308 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system for immunizing a computer network against adverse effects caused by the receipt of a corrupting message. Each message transfers into a protocol-based controlled environment for a specific recipient where message criteria determine whether the incoming message is deemed to be a valid or suspicious message. Transmission criteria determine the final message disposition. If the message is valid, it is delivered to a recipient computer system in the network. If the incoming message is suspicious, the message is isolated in the controlled environment where the transmission criteria may provide remote access to the recipient.

Claims

1. A method for immunizing a recipient'"'"'s computer system in a data processing network from all corrupting contents of all incoming messages received over a communications path through a server wherein each incoming message requires at least one production application for processing the message, said method comprising, for each incoming message, the steps of:

A) identifying each of the at least one production application required for processing the message,

B) generating a controlled environment set for the message as an instance of controlled environment templates stored in the server, said generated controlled environment set being isolated from the data processing network and other portions of the server and including an instance of a controlled environment for processing each identified production application, each production application including at least one predetermined message criterion that defines those characteristics of the message required to prove that the message could not corrupt the recipient'"'"'s computer system and including transmission criteria that define dispositions for the identified message,

C) analyzing the message by processing all of its contents in said generated controlled environment set to determine whether the message meets all of the at least one message criterion that proves that the entire message is free of any corrupting contents, and

D) disposing of the message in response to said analyzing step and the transmission criteria for the message, one said disposing step enabling the message to be transferred to the recipient'"'"'s computer system without modification only when said analyzing step determines that the entire message has been proven to be free of corrupting contents and another disposing step providing a communications path whereby the recipient can view the message remotely and in isolation in the controlled environment set without transferring the message to the recipient'"'"'s computer system.

2. A method as recited in claim 1 wherein a message is received as at least one data packet of a given protocol, said method including the step of identifying the message protocol and recipient for the message, said generation of a controlled environment set for a given message includes generating a master controlled environment that controls the operation of any generated production application controlled environment in response to the identified message protocol and recipient.

3. A method as recited in claim 1 capable of receiving messages in any of a plurality of protocols and as at least one data packet, said method including the step of identifying the message protocol, said generation of a controlled environment set for a given message includes generating a master controlled environment that controls the operation of any generated production application controlled environment in response to the identified message protocol and recipient.

4. A method as recited in claim 1 wherein a message is received as at least one data packet of a given protocol and wherein the server connects to a plurality of recipients, said controlled environment set generating step includes generating an instance of a controlled environment set for each combination of the given message protocol and recipient.

5. A method as recited in claim 4 wherein a recipient receives messages of diverse protocols and wherein said controlled environment generating step includes determining the protocol of and recipient for the incoming message whereupon the message is directed to an instance of the controlled environment set for that message protocol and the recipient.

6. A method as recited in claim 5 wherein the messages are HTTP messages processed by a browser, said generating of a controlled environment set for the browser and recipient including:

i) generating a browser master controlled environment, and

ii) generating at least one browser application controlled environment including a first browser application controlled environment constituting a shadow browser controlled environment that corresponds to the browser in the recipient'"'"'s computer system and that operates under the control of the browser master controlled environment.

7. A method as recited in claim 6 wherein, in response to a recipient'"'"'s initiation of a transmission of an HTTP message, the browser master control causes each of the browser application controlled environments to transmit an outgoing HTTP message with a unique return address whereby a plurality of outgoing messages are sent to a specific site, and wherein each of the responsive incoming messages are processed in the browser application controlled environment that transmitted the corresponding outgoing HTTP message.

8. A method as recited in claim 7 wherein the message contains HTML content and certain message criteria define valid HTML content, said message analysis including analyzing at least one of the incoming messages a browser application controlled environment with respect to the HTML content and message criteria.

9. A method as recited in claim 7 wherein said analyzing step determines whether all the incoming messages are identical in accordance with at least one other message criterion and wherein the disposition of the is dependent on the results of said analyzing step and at least one transmission criterion.

10. A method as recited in claim 9 wherein said analyzing step fails to determine that messages are identical, said analyzing step including selecting at least one message for further analysis and analyzing the at least one selected message for the required characteristics.

11. A method as recited in claim 10 wherein one transmission criterion limits transmission of the message to browser application controlled environments in the controlled environment set.

12. A method as recited in claim 9 wherein said analyzing step includes conducting a comparative analysis of all the incoming HTTP messages and selecting one of the browser application controlled environments for processing the message.

13. A method as recited in claim 12 wherein said analyzing step is dependent upon the information about the recipient.

14. A method as recited in claim 5 wherein the messages are e-mail messages to be processed by an e-mail production application at the recipient'"'"'s computer system, said generation of a controlled environment set for the e-mail message and recipient including:

i) generating an e-mail master controlled environment for identifying the recipient and e-mail message, and

ii) generating an e-mail production application controlled environment for processing the email message under the control of the e-mail master controlled environment.

15. A method as recited in claim 14 wherein said message criteria include validity rules that establish the validity for different types of e-mail messages.

16. A method as recited in claim 15 wherein said analysis of an e-mail message in accordance with the message criteria determines that a text only e-mail message is valid whereupon said disposing step transfers the message to the recipient'"'"'s computer system.

17. A method as recited in claim 15 wherein said analysis of an e-mail message without attachments in accordance with the message criteria determines that the e-mail message is valid whereupon said disposing step transfers the message to the recipient'"'"'s computer system.

18. A method as recited in claim 15 wherein the e-mail message includes at least one attachment and wherein said analysis of the e-mail message in accordance with the message criteria determines that the e-mail message and each of the at least one attachment meets the required characteristics whereupon said disposing step transfers the message and the attachments to the recipient'"'"'s computer system.

19. A method as recited in claim 15 wherein the e-mail message is analyzed in accordance with message criteria that detect the existence of a virus in the e-mail message.

20. A method as recited in claim 14 wherein the controlled environment set defines a link between the recipient'"'"'s computer system and an e-mail controlled environment set for the recipient thereby to enable said disposing step provide the recipient with limited access to the controlled environment set to view the message.

21. A method as recited in claim 14 wherein one disposing step deletes the e-mail message from the controlled environment set.

22. A method as recited in claim 21 wherein said deletion of the e-mail message generates a notification to the recipient'"'"'s computer system.

23. A method as recited in claim 14 wherein the server includes a blocked message store and one disposing step enables the recipient to store the e-mail message in the blocked message store.

24. An immunization system for immunizing a recipient'"'"'s computer system in a data processing network from all corrupting contents of all incoming messages received over a communications path through a server with a controlled environment template store wherein each incoming message requires at least one production application for processing the message, said system comprising a processor executing software configured to implement, for each incoming message:

A) means for identifying each of the at least one production application required to process the message,

B) a controlled environment set that is isolated from the data processing network and other portions of the server and that includes a controlled environment for processing each identified production application, each controlled environment in said controlled environment set being an instance of a controlled environment template in the controlled environment template store and including;

i) at least one predetermined message criterion that defines those characteristics required to prove that the message could not corrupt the recipient'"'"'s computer system, and

ii) transmission criteria that define dispositions for the identified message,

C) means for analyzing all of the contents of the message by processing the message contents in a corresponding controlled environment set to determine whether the message meets all of the at least one message criterion that proves that the entire message is free of any corrupting contents, and

D) disposition means responsive to analyzing mean for controlling the disposition of the message, one disposition enabling the message to be transferred to the recipient'"'"'s computer system without modification only when said analyzing step determines that the entire message has been proven to be free of corrupting contents and another disposition providing a communications path whereby the recipient can view the message remotely and in isolation in the controlled environment set without transferring the message to the recipient'"'"'s computer system.

25. A system as recited in claim 24 wherein a message is received as at least one data packet of a given protocol and wherein said identification means identifies the message protocol and recipient for the message and said controlled environment set for a given protocol and recipient includes a master controlled environment that controls the operation of any generated production application controlled environment in response to the identified message protocol and recipient.

26. A system as recited in claim 24 wherein messages are received in a plurality of protocols and as at least one data packet, said identification means for each application including means for determining the protocol for each incoming message and means for directing the message to a controlled environment set for the given protocol and recipient.

27. A system as recited in claim 24 wherein a message is received as at least one data packet of a given protocol and wherein the server connects to a plurality of recipients, said controlled environment set for a given message being an instance of a controlled environment set adapted for the message protocol and recipient.

28. A system as recited in claim 27 wherein a recipient receives messages of diverse protocols and wherein said identifying means includes means for determining the production applications for and recipient for an incoming message, said system including means for directing the message to an instance of the controlled environment set for one of the identified production applications and the given recipient.

29. A system as recited in claim 28 wherein the messages are HTTP messages processed by a browser, said controlled environment set for the browser and recipient including:

i) a browser master controlled environment for controlling the processing of the message, and

ii) at least one browser application controlled environment including a first browser application controlled environment constituting a shadow browser controlled environment that corresponds to the browser in the recipient'"'"'s computer system and that operates under the control of said browser master controlled environment.

30. A system as recited in claim 29 wherein, in response to a recipient'"'"'s initiation of a transmission of an HTTP message, said browser master control causes each of the browser application controlled environments to transmit an outgoing HTTP message with a unique return address whereby a plurality of outgoing messages are sent to a specific site and wherein each of said browser application controlled environments processes an incoming message responsive to the outgoing message therefrom.

31. A system as recited in claim 30 wherein the message contains HTML content and certain message criteria define valid HTML content wherein said means for implementing an analysis in said controlled environment set includes means for analyzing at least one of the incoming messages to the browser application controlled environment with respect to the HTML content and message criteria.

32. A system as recited in claim 30 wherein said browser master controlled environment determines whether all the incoming messages are identical in accordance with other message criteria and wherein said disposition means operation is dependent on said analysis.

33. A system as recited in claim 32 wherein said browser controlled environment set fails to determine that messages are identical, said browser master controlled environment including means for selecting at least one message for analysis, said means for implementing the analysis including means for analyzing the at least one selected message for the required characteristics.

34. A system as recited in claim 33 including means responsive to one transmission criterion for limiting transmission of the message to browser application controlled environments in the controlled environment set.

35. A system as recited in claim 32 wherein said browser master controlled environment includes means for comparatively analyzing all the incoming HTTP messages and selecting one of the browser application controlled environments for processing the message.

36. A system as recited in claim 35 including means for providing information about the recipient for said analyzing means.

37. A system as recited in claim 28 wherein the messages are e-mail messages to be processed by an e-mail production application at the recipient'"'"'s computer system, said controlled environment set for the e-mail message and recipient including:

i) an e-mail master controlled environment for controlling the processing of an incoming e-mail message and identifying the recipient and e-mail message, and

ii) an e-mail production application controlled environment for processing the e-mail message under control of the e-mail master controlled environment.

38. A system as recited in claim 37 wherein said message criteria include validity rules that establish the validity for different types of e-mail messages.

39. A system as recited in claim 38 wherein said means for analyzing an e-mail message in accordance with the message criteria includes means for determining that the e-mail message is text only whereupon said disposition means enables the transfer of the message to the recipient'"'"'s computer system.

40. A system as recited in claim 38 wherein said means for analyzing an e-mail message without attachments in accordance with the message criteria includes means for determining that the e-mail message meets the required characteristics whereupon said disposition means enables the transfer of the message to the recipient'"'"'s computer system.

41. A system as recited in claim 38 wherein the e-mail message includes at least one attachment and wherein said means for analyzing the e-mail message in accordance with the message criteria includes means for determining that the e-mail message and each attachment meet the required characteristics said disposition means enables the transfer of the e-mail message and attachments to the recipient'"'"'s computer system.

42. A system as recited in claim 38 wherein the e-mail controlled environment set includes means for detecting the existence of a virus in the e-mail message.

43. A system as recited in claim 37 wherein said controlled environment set includes means for establishing a link between the recipient'"'"'s computer system and the e-mail controlled environment set for the recipient thereby to enable said disposition means to provide the recipient limited access to the controlled environment set to view the message.

44. A system as recited in claim 37 wherein said disposition means includes means for deleting the e-mail message from the e-mail controlled environment set.

45. A system as recited in claim 44 including means for generating a notification for transfer to the recipient'"'"'s computer system in response to the deletion of the e-mail message.

46. A system as recited in claim 37 wherein the server includes a blocked message store and wherein said disposition means includes means for enabling the recipient to store the e-mail message in the blocked message store.