Resisting the spread of unwanted code and data

Resistance to propagation of unwanted code and data

5 This invention relates to computer systems and methods of operation of such systems to resist the propagation of unwanted code and data.

In the past decade, computer systems have been increasingly subject to attacks by unwanted code. The most extreme examples (so far) of unwanted code are computer viruses. A computer virus, like its biological namesake, is capable of infecting a machine and then, from there, infecting others, appropriating the resources of the email system to send email messages containing the virus from a computer to many others, using the address book of each computer it reaches.

fifteen The resulting wasted bandwidth is a nuisance to users. In addition, many viruses perform some unwanted action on each computer they reach, which may include, for example, file deletion.

Viruses usually arrive as an executable code, in a separate attachment, but they can also be hidden in parts of an email, so they can be activated without the need for a user to explicitly separate and execute the code. Many applications, such as word processors, spreadsheets and databases, include powerful instruction sequence languages, which allow a file that appears to be a document to include an instruction sequence capable of performing certain operations. Virus creators have made use of such instructional sequence languages ​​to write instruction sequence viruses, of

25 so email attachments that include files that appear to be documents can harbor a hidden virus.

Viruses are not the only form of unwanted code. It is common for "free" programs to be distributed with hidden "spyware", which can, for example, be covertly installed on a user's computer and, subsequently, they can report visited websites or other transactions to a computer remote. Some spy programs cause the display of unwanted advertising. Some spyware will try to cause a modem to repeatedly dial a high rate number, in which the creator of the spyware receives income from a telecommunications operator. Other types of harmful code include harmful computer programs, worms and backdoors.

35 While viruses spread on their own from one computer to another, other forms of unwanted code are distributed by junk email, by hidden distribution on disk, or, increasingly, by downloading a visited website without realize. All these types of unwanted code have in common the fact that their existence or their real purpose is to hide from the owners and users of the computers to which they are addressed. While some types are relatively harmless, others have the ability to destroy valuable business data and, therefore, an industry has been developed for the provision of antivirus software.

Antivirus software, as it is known today, consists of a program that runs on the computer that must be protected. Such programs normally work in monitor mode, in which the files they must

Four. Five accessed are checked for viruses each time the file is accessed, and in a scanning mode in which all files are scanned at a particular location (for example, a disk drive). Antivirus program providers monitor virus outbreaks and, when a new virus is detected, antivirus program companies analyze the virus and extract the data that can be used to detect the virus. This data will then be made available to the computers running the specific antivirus program interested; normally, providing you with the antivirus company's program website for download.

Viruses are detected in several different ways. A string of characteristic code that is part of the virus can be stored and incoming files scanned for the presence of that string, which therefore

55 It acts as a "signature" or "fingerprint" for the virus. Alternatively, viruses can be detected by their expected behavior; The source code or sequence instruction files can be treated to detect predetermined operations that are characteristic of a virus.

Unfortunately, viruses, like their biological counterparts, can easily "mutate", small changes in the code, equivalent to the substitution of upper and lower case letters, can change the virus signature. Therefore, the data files to detect viruses, by any method, are becoming extremely large, and the time taken by antivirus programs is increasing proportionately as the number of signatures or rules to be checked is growing. While this may be acceptable in virus scanning mode, in monitor mode you are adding more and more latency to the time needed to access the files. In addition, as downloads become larger and are required more frequently, the risk of a user failing to download the necessary updates, and therefore,

running out of protection against the most recent virus (and therefore the most dangerous), is high.

Therefore, the present invention has a totally different approach to protection against unwanted code.

5 Document US2005 / 081057 discloses a method to prevent the exploitation of an email message and its system.

Summary

A computer-implemented method of resistance to propagation of unwanted code and data in an electronics is provided as set forth in claim 1.

In accordance with one aspect of the present invention, a method of receiving an electronic file containing content data in a predetermined data format is provided, the method comprising

fifteen stages of: receiving the electronic file, determining the data format, processing the content data, in order to determine if they conform to the predetermined data format, and if the content data conforms to the predetermined data format, regenerate the data treated to create a regenerated electronic file in the data format.

The corresponding computer systems, programs and the means to carry out such programs are also provided.

An embodiment of the invention works to analyze each received file and then reconstitute from it a replacement file. Because the original file is not stored directly, or accessed, in

25 The computer to be protected is not the same, capable of harming that computer. It can, for example, be stored in an inverted bit form or another form in which it cannot be executed. On the other hand, the replacement file is generated using a routine generator that can generate only "clean" code and data. Therefore, it is unable to generate unwanted code matching any code in a received file.

Part of the present invention may be based on a new application of some long-known truths about computer files. The vast majority of files imported into a computer today are in standardized file formats. Proprietary programs create their own file formats (and the data intended for use by the programs must conform to those formats) but there is sufficient demand for the exchange of data between the different proprietary programs that, first, a program

35 Owner is often supplied with import filters to read data written by others, and, secondly, there are several formats that are not associated with any proprietary program. Examples of such generic formats are ASCII text, rich text format (RTF), hypertext markup language (HTML) and extensible markup language (XML).

Therefore, the data in the files must conform precisely to the rigid standards if they must be read by any application program, and the formats used by the different files are widely known. The present inventors have realized that, although the formats used by the archives allow a wide variation, the vast majority of the archives contain data that meet some relatively reduced pragmatic limitations. For example, most operating systems and applications accept titles of

Four. Five large files, but most users, most of the time, use short and easily recognizable file names.

Accordingly, the analysis performed by an embodiment of the present invention may comprise detecting whether data that otherwise conforms to the specification of the supposed file type violates pragmatic limits. These "real world" restrictions allow the present invention to detect "normal" acceptable files. Any file content that does not correspond to the pragmatic limits of this type is not passed to the generator program and therefore does not reach the users computer in an executable form.

Therefore, it will be seen that an embodiment of the present invention functions in a fundamentally

55 different from known antivirus programs. The known antivirus programs are intended to detect viruses, and pass everything that is not detected as a virus. Therefore, they always fail to protect the user from the greatest danger; namely, that of unknown viruses. Every new virus that has been rushed must have already infected a number of computers before it reaches the attention of antivirus companies.

In addition, even when the antivirus software is installed, and there is a set of updates to the detected data, the viruses will normally be stored on the hard drive or other means of the protected computer before they can be detected by the antivirus software. If, for some reason, antivirus software fails to run, the virus is in place and can be activated.

65 The published US application US 2003/0145213 discloses a system where a sequence of instructions or malicious code is detected in a file. Next, the file is rebuilt into a template and the malicious code is removed from the template to provide a clean version of the file.

By way of complete contrast, the present invention is not intended to detect viruses, or even to reject the general behavior similar to a virus. Instead, you can reject all incoming files completely, and

5 replace, where possible, the generated files that cannot contain unwanted code and data. Therefore, code and unwanted data can be prevented from reaching the hard disk of the computer to be protected in an executable manner, and cannot be propagated from one computer to another.

At this point, it can be mentioned that the published application of the United States 2003/229810 discloses a proposal for an "optical firewall" for protection against viruses. For reasons that will become apparent shortly, it is not believed that this system has been put into practice (or could be implemented). Describes a system in which a firewall computer receives a file such as an image file, and displays the image on the screen of the firewall computer. An optical sensor array scans the image and then the scanned image is supplied to the intended recipient. Any virus that was hidden in the image is not shown, and by

fifteen consequently, it is not transmitted in the scanned image. In a variant, a bitmap of the screen can be used instead of a real screen display.

For various reasons, the "optical coupler" firewall provided in the aforementioned US patent application could not provide effective and safe protection against viruses.

For example, playback using optical character recognition (OCR) software may provide inaccurate information. In addition, the reproduction of images using the video technique can provide images of lower quality than expected. Also, the computer that receives the input file may become infected if the input file contains a virus.

25 On the other hand, by analyzing and then regenerating the files instead of executing, displaying, and exploring them optically, an embodiment of the present invention is capable of providing replacement files that in the vast majority of cases closely emulate the original file ( if free of unwanted code) in order to make the substitution transparent.

File formats vary in complexity. At one extreme, text files have a simple format. Files that may contain scripts or instruction sequences (such as word processor files or spreadsheets) are of intermediate complexity, while files that contain code can only be fully analyzed using a code analyzer. While such code analysis is,

35 In the long run, possible according to the present invention, the embodiments of the invention can function conveniently to eliminate all sequences of instructions and commands from document files, and not pass any of the files consisting solely of programs, code , sequences of instructions or commands.

It will be immediately apparent that there will be frequent occasions when users may wish to receive such files. Accordingly, in a preferred embodiment, the present invention may operate along a part of the filter that is arranged to filter the files by means of a source, so that the files (or files of a certain type) always pass from certain sources. , and reject such files from others.

Four. Five Therefore, while one embodiment of the present invention may block users from receiving code in the files of all sources, the parallel filter allows only such files that come from known sources. Therefore, users can receive, for example, files from certified system administrators or websites that would be rejected by the invention. By identifying only those sources from which a user wishes to receive the code, the present invention can block unwanted code.

Because the present invention can work by detecting compliance with file standards, and normal user behavior, rather than detecting viruses, frequent updates are unnecessary; such updates are only necessary at the time where large changes for a conventional gain of generalized acceptance, or when the user's behavior has basically changed, both are

55 slow processes, compared to the frantic speed with which antivirus updates should be distributed. Similarly, since the number of tests to be performed remains more or less stable over time, there is no increase in latency time for the starting programs.

These and other aspects, embodiments and advantages of the invention will be discussed in the following description and in the claims. Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings in which:

Figure 1A shows a block diagram of an electronic filing system according to an embodiment of the present invention;

65 Figure 1B shows a computer system adapted for use in the embodiments of the present invention;

Figure 1C shows a flow chart of a process according to an embodiment of the present. invention; Figure 2 shows a block diagram of an email system according to a second embodiment of the present invention;

5 Figure 3 shows a flow chart of a process according to a second embodiment of the present invention; Figure 4 shows an example scheme of the different parts that form an email; Figure 5 shows a flow chart of a process according to a third embodiment of the present invention.

First realization

A scheme of the basic system is shown showing a first embodiment of the present invention in Figure 1A. An electronic file 101 is created in a source and transmitted through a transmission means 103. He

fifteen Transmission medium 103 may be any suitable means for transmitting electronic files, including wired systems and wireless systems. The electronic file 101 passes through the transmission means 103 in the normal manner until it reaches its destination. In this embodiment, a 105 AV application (antivirus) is installed on a target system. The 105 AV application operates in such a way that data within the incoming electronic file is not allowed to enter the target operating system 107 until it has been analyzed against a predefined allowed format, and, if it is determined that the data is admissible, They regenerate. Therefore, the AV application 105 determines whether the electronic file 101 should be allowed to pass through the operating system 107.

Figure 1B shows a computer system adapted to implement the embodiments of the present invention. Computer 109 receives the electronic input file 101 on an input interface 111. The 111 interface of

25 input is connected to a microprocessor 113, which is arranged to perform various processes in the received file. The microprocessor 113 includes an analyzer 115. The microprocessor 113 is further connected to a memory device 117, a disk drive 119 and a number of interfaces (121, 123) to enable the connections to be made to the output devices such like a screen 125 and a keyboard 127.

So that incoming executable files are not allowed to run automatically when they enter the AV application, the system ensures that the data that makes up the incoming electronic files is stored in memory in any suitable encoded format.

In this embodiment, the encoded method reverses the order of the bits in one byte. That is, bits 0 to 7 are

35 they are received in order, but stored in an inverse manner of bit such that bit 0 is changed with bit 7, bit 1 is changed with bit 6, bit 2 is changed with bit 5 and bit 3 it is changed with bit 4. Therefore, as an example, a byte comprising 1 0 1 1 0 0 0 0 would be stored in the following order: 0 0 0 0 1 1 0 1. In this way, any executable code is not able to run automatically and therefore, any of the infected electronic files are not capable of infecting the AV application or the target operating system.

As an alternative to the AV application that is located at the intended destination of the file, the AV application can also be located at the source, somewhere in the middle of the transmission or elsewhere, provided that it is able to analyze the electronic file in a point along its transmission path.

Four. Five Figure 1C shows a flow chart of the basic steps performed by the application AV 105 in this first embodiment in order to determine if the electronic file 101 is allowed to pass through the destination operating system 107. In step S109, the electronic file 101 is introduced into the 105 AV application using any suitable means. The input medium may vary depending on the type of electronic file that is received and the medium on which it is being transmitted. In this embodiment, the electronic file 101 is accepted in the AV application.

In step S111, the analysis is performed by a conformity analysis device to determine if the electronic file 101 conforms to a predetermined format. The AV application is designed only to allow electronic files that conform to one of a plurality of known stored, permissible, predefined formats to be passed. Generally, a file is made up of content data encoded and arranged according to a file type specification that includes a specific set of rules, with each type of file associated (text, HTML, XML, spreadsheet, and so on). successively) a set of rules. Common file types are sometimes indicated by the file name suffix (for example, .pdf, .txt, .doc), and also

or as an alternative for the first bytes of data in the file. Many types of files include a heading that indicates something about the structure of the file, followed by content data (for example, text, numbers, audio or image data).

Content data may include parameters (for example, labels to indicate that content data must be presented in bold). The rules that make up the file type specification can specify the

65 values ​​or the range of what such parameters can assume. They can also specify, for example, the allowed values ​​or the range of values ​​that the contained data can assume.

An application program capable of opening a file of a specific type includes an analyzer to apply the rules that make up the specification of the file type to a file, to extract content data for presentation or processing. For example, a word processing application may be able to open files in its proprietary file format (for example, Microsoft Word ™), proprietary file formats

5 of other word processing applications, and generic file formats such as rich text format (RTF), ASCII and HTML. An application program capable of storing content data as a file of a specific type includes a generator to apply to the content data the rules that make up the specification of the file type to generate a file in the required format.

In the present embodiment, the default format is stored for each type of file. The default format generally includes the rules that make up the file specification. However, the default formats only include the rules regarding frequently used parts of the format. In addition, the default formats include additional rules that limit the values ​​and / or intervals that the content and parameters can take, so that they only commonly and frequently include

fifteen values ​​and intervals used. Therefore, only those parts of a file of a given type that exclusively consist of data and parameters that occur frequently or commonly according to the corresponding stored default format of this embodiment can be analyzed.

Examples of data type components that are not allowed to pass through the system (because the default formats do not include the rules relating to them, since they are used infrequently) are sequences of complex instructions in files of text processing and I-frames in HTML pages. Examples of infrequently used data values ​​that are not allowed to pass through the system (because the default formats are limited to the values ​​that exclude them) are control characters in an ASCII file other than the use characters common TAB, CR / LF and LF.

25 The conformity analysis device determines if the electronic file is in the format it says it is, and that all parameters conform to the default format associated with that specific type of electronic file. If the electronic file does not conform to any of the predetermined formats it is not regenerated, and then it is effectively locked, and preferably deleted in step S113. However, if the electronic file conforms to the default format, the content data is extracted from it (and stored temporarily in a data structure), and it is regenerated (from the temporary data structure) by the device Conformity analysis in the default format associated with that type of electronic file, to compose a replacement file, as shown in step S115.

35 Next, the regenerated electronic file is forwarded, for example, to the operating system in step S117 so that it is processed in a normal manner. All content data that can be extracted from the archive using the rules that make up the default format are extracted and regenerated, and therefore, parts that cannot be extracted cannot be regenerated.

In this way, due to compliance checking and file regeneration, viruses are unable to enter and infect the operating system; In fact, nothing but content data in a format that occurs commonly is extracted and therefore regenerated.

In situations where an electronic message can be broken into sub-parts, some sub-parts of the message

Four. Five electronic can be adjusted to a predetermined format, while other sub-parts can not be adjusted. In situations like this, the AV application determines whether the total number of sub-parts that fit meets a substantiality test (for example, if the majority, or the most important parts, fit), and if so, regenerates the sub-parts of the electronic message that fit.

Sub-parts of the message that do not fit will not be regenerated. Instead, the AV application inserts a relevant warning text in the electronic message informing the recipient that part of the message was not allowed to pass. As an option, this warning text may indicate the reasons for not allowing the subpart to pass.

55 In addition, a part can also be locked within a sub-part of the electronic file, that is, not regenerated and preferably deleted, if it does not conform to the default format allowed for that part. This is, for example, if a character string in an ASCII electronic file includes a control character (for example, the "BEL" character), this character string can be replaced with a text warning inserted by the AV application informing the intended recipient that the string has been left out of this part of the regenerated electronic file because the part does not conform to the default format. The conformity analysis device does not specifically search for control characters that are not allowed (for example, the "BEL" character), but instead pass only those control characters that are allowed, as defined by the default allowed format.

65 Alternatively, the control character that does not fit could be replaced by a space or completely eliminated. The different options chosen depend on, for example, the environment in which the AV application is running and how important it is for at least the minimum compliance information that must be allowed to pass through the AV application to its destination.

An additional alternative to the first embodiment will now be described. Upon determination by the AV application of

5 that an electronic file or a sub-part of it, does not fit and therefore is not allowed to pass through the target operating system, the original electronic file is passed to a threat filter application that determines if there is any threat associated with the electronic file, or the sub-part thereof.

The determination is made based on what the system expects to receive from certain sources. The system makes this determination by reviewing a list of data types against a predetermined list of sources stored in memory, to see if the type of data is accepted from that source; In other words, emails are filtered by the source. Therefore, if files containing data that are not adjusted from the same source are received, where data that is not adjusted is not known as a threat, the original non-adjusted data is allowed to pass to the operating system. In this way, the system comprising the AV application and the

fifteen Threat filter application dynamically allows most secure electronic files to go to their intended destination.

Second embodiment

Next, the second embodiment is described, the electronic files are emails transmitted over the Internet, from a sender to an Internet service provider (ISP). The ISP forwards the emails to an email client server, so upon receipt, the email client server forwards the email to the recipient's inbox.

25 Figure 2 shows a schematic of an email system according to this embodiment in which the AV application of the present invention is incorporated. An email is forwarded via a sender from a source location 201. The email is forwarded via Internet 203 to an Internet service provider 205 (ISP), determined by the domain name incorporated into the email. Receiver email client server 207 connects to ISP 205 through direct open connections. The first connection is an outbound connection 209 of the protocol for simple email transfer (SMTP) to forward the outgoing email from the email client server 207 to the ISP 205. A second connection is an incoming POP connection 211 ( Post Office Protocol), which retrieves email from ISP 205.

35 The 105 AV application is located on ISP 205. The 105 AV application resides in the input / output ports connected to the recipient's email client server 207, in order to analyze all incoming and outgoing emails that are sent and are received by the email client server 207.

In this embodiment, the application 105 AV is a part of computer code, which is implemented using known computer programming techniques. All emails that are sent to the email client server 207 must pass through the 105 AV application before the emails are able to enter the email client server 207. Similarly, all emails forwarded by the email client server to ISP 205 must pass through the 105 AV application before they enter ISP 205.

Four. Five The 105 AV application analyzes the incoming email message by treating the data as it enters the application. As in the first embodiment, the data is stored in an encoded mode in order to stop the execution of any of the executable files. The 105 AV application determines whether the separate parts of the incoming email conform to a predetermined admissible format, and, if the part is adjusted, regenerates each part of the email message. Therefore, any virus within any email is not allowed to pass to infect the recipient's system, or pass from the recipient's system to the ISP.

A conformity analysis device is used in this embodiment to analyze specific types of data to see if they conform to a predefined format for that type of data (as discussed in the first embodiment) and

55 extract that content data that fits. Next, the conformity analysis device regenerates the data using the predefined allowed format for that type of data. Each type of data is analyzed and regenerated by its own specific conformity analysis device.

Each conformity analysis device executes a set of specific rules about the data depending on the type of data received. The rules are defined by the predefined official specification for the type of file, and the examples that usually occur in the real world (and therefore safe) of the known data types. In general, the rules allow only a subset of files that conform to the specification of the file type, but can relax certain rules of the official specification when they are usually broken. For example, email addresses should not contain spaces, but some 65 most popular email applications violate this rule, so emails that violate the specification in this regard are common, and therefore the default format for analyze

Emails in accordance with this embodiment accept email addresses that contain a space, and therefore analyzes of the embodiment and extracts of such email addresses.

Also, the conformity analysis device can check a certain parameter within a data file 5. For example, if the header indicates that the file is an RTF (rich text format) file, then the first bytes of data are read to determine if this is correct.

Figure 3 shows a flow chart of how a system that incorporates an AV application in accordance with this embodiment works. As can be seen in Figure 3, in step S301, the email is received at the ISP at

10 through the incoming SMTP connection.

In step S303, a protocol conformity analysis device performs a process to read the basic format of the incoming email, and regenerates the email in a manner that conforms to the basic email protocols. An email reader that does not fit reads the email. Then,

fifteen The data read is passed to an email writer who adjusts it to the basic email protocols. In this way, common nonconformities become an email that fits. For example, if the recipient's email address is poorly formed, the email writer rewrites it to fit.

twenty An additional example is when you receive an email without a "From:" header. In this case, the email message is encapsulated in a completely new email message with a "From:" header.

Other parameters are also made in the email to adjust. For example, the length of the line,

25 that the correct ASCII character codes be used, that the correct base 64 encoding be used when appropriate, the header information intact ("To:", "Subject:", etc.), a space between the header and the email body, and so on.

If the email is so badly formed part of it can not be rewritten, then it is determined if

30 There is still a reasonable email if the part that does not fit has been lost. If it is determined that the process still results in a reasonable email, the email is rewritten with the missing part that does not fit. A warning text can be inserted instead.

In addition, the protocol conformity analysis device can reject all email.

35 For example, if the protocol conformity analysis device detects that the base coding 64 that does not fit is being used in large part of the data within the email, the email is completely rejected in step S305.

If the protocol conformity analysis device determines that the email conforms to the

40 Email protocols, is regenerated by the protocol conformity analysis device and goes to the next stage in the process.

All emails should conform to the current RFC standard for email (i.e., RFC 822 and its successors). This rule defines how email is formed. After the email

Four. Five Pass through the protocol conformity analysis device, the RFC 822 conformity analysis device checks to see if the email conforms to RFC 822. The RFC 822 conformity analysis device performs this conformity check, first breaking the email into its separate component parts by finding the boundaries within the email (as discussed below), and then treating each email component to See if it conforms to RFC 822.

fifty It will be understood that updates would be required when the RFC standard is updated to ensure that the RFC 822 conformity analysis device is capable of checking the conformity of all known data types.

55 As is well known, an email is composed of a number of separate parts, as shown, for example, in Figure 4. The email begins with a heading 401 RFC 822, which defines a series of fields, such as " From: "," To: "and" Subject: ", etc. The following is heading 403 MIME, which defines a series of fields for use in the extension protocol, such as the "Content Type:" which defines the text used to indicate the boundary between the different parts of the email.

60 After the headings (401 and 403), the first limit 405 is indicated. The next part of the email begins with an additional 407 MIME header, which defines the format used in this part. In this example, this part includes the subject of the text that will be displayed in a text format. Therefore, follow block 409 of text. At the end of block 409 of text is an additional limit 411.

65 An additional 413 MIME header indicates the format that will be in the next part of the email. In this example, the next part of the email is a block 415 mix of text and formatted HTML. An additional 417 limit indicates the end of this part of the email.

5 In the last part of the email, the final 419 MIME header indicates the data type of a file attached to the email, which in this case is a zip file. The 421 ZIP file is encoded in base 64 and is added to the email. Next, a final 423 limit indicates the end of the email.

In step S307 in Figure 3, the RFC 822 conformity analysis device treats the ASCII characters that form the email using an analyzer. Next, the RFC 822 conformity analysis device is able to detect the limits in the email and check to see if certain parameters conform to a known acceptable default format. For example, the RFC 822 conformity analysis device checks the line length to see if it conforms to RFC 822 and thus only the line lengths of 2,000 or less are regenerated.

fifteen Other checks can be made to see if the data processed in the email conforms to RFC 822. For example, it is checked whether the characters within the email are known as acceptable ASCII characters as defined in the standard, if The information in the header is as defined in the standard and if the length of the header conforms to the definition of the standard. These listed checks are simply examples of a large group of different checks performed by the RFC 822 conformity analysis device (the rest of which will be apparent to one skilled in the art), and as such, this invention is not limited to those listed above.

As well as the analysis of the processed data to see if they conform to the basic RFC 822 standard, the analysis device

25 In accordance with RFC 822, it also checks to see if certain parameters conform to real-world examples of emails of RFC 822. That is, the specification of certain parameters can be left open for users to define, while, In the real world, only reasonable values ​​will be used. For example, an email usually only comprises a minimum number of parts. Therefore, if an email is received that includes 1,000 limits, this would not be a real-world example of RFC 822 emails, and should therefore be blocked, that is, it would not be regenerated and preferably deleted, by means of the conformity analysis device of RFC 822.

For each component part of the email that contains data that needs an additional conformance check, the component part is forwarded to step S309, in this embodiment, in parallel to a

35 different conformity analysis device depending on the type of data of the corresponding part. That is, if the part of the email being analyzed is defined as text, the ASCII characters that make up the text are forwarded to a text conformity analysis device. If the part of the email being analyzed is defined as a TIFF file, the characters that make up the TIFF file are sent to a TIFF compliance analysis device.

In step S309, each of the conformity analysis devices analyzes the data that has been forwarded to it to see if they conform to its assumed format. If the data is adjusted, it is regenerated by the conformity analysis device. If there is any nonconformity within the data, the data is well excluded, or, if possible, regenerated by the conformity analysis device to which they conform. An example of the regeneration of

Four. Five The data to which they fit is to add nested square brackets in an RTF file wherever they are being lost.

If an email comprises a nesting of different types of data, the conformity analysis devices are called recursively, so that several specific devices are executed in sequence and each one is put on hold at each point where a Additional type of data. In this way, an email with a zip file, which includes a text processing document, which includes a JPEG image file could be executed through the sequence of the different conformity analysis devices (zip, word processing, JPEG) in order to deploy through file nesting and analyze each file in sequence. At the end of the analysis, the file is reassembled using the regenerated parts that are

55 adjust.

After a determination in step S311 in which sufficient parts of the email have been regenerated to properly form a coherent, understandable and useful email, the data is reassembled using the RFC 822 conformity analysis device with the regenerated parts , as shown in step S313. This ensures that the regenerated email is forwarded in the correct format.

The AV application then forwards the regenerated email to the intended recipient using the SMTP protocol, as indicated in step S315.

65 However, if the AV application determines in step S311 that sufficient parts of the email have not been regenerated to form a useful email, the email in step S317 is rejected. During step S317, the warning text is sent to the intended recipient of the email informing him that an email destined for him has been rejected by the system. The warning text may include details of why the message has been deleted and additional information intended to help the recipient identify the sender, or the reason why the email was rejected.

5 Next, some examples of conformity analysis devices for use in this embodiment, which could be used during step S309, are described in detail. As shown in step S309, the component part of an email that is intended to be text, both based on the information in the RFC 822 header, the MIME header or the file extension, is passed to an analysis device in accordance with

10 text. The text conformity analysis device processes the text data to determine if they conform to its predetermined admissible format as described below.

Since there are a number of different types of text files, such as, for example, the comma separated variable (CSV) and rich text format (RTF), the text conformity analysis device must first

fifteen differentiate what type of text file the data intended to be. All files attached to the email will have a file extension associated with it that indicates what type of file it should be. The text conformity analysis device analyzes the extension of the treated file within the MIME header to determine if the text file is a pure ASCII file. If so, it is only necessary to use an ASCII compliance analysis device, as described below.

twenty However, if the text conformity analysis device, after analysis, determines that the text file is a type of file that is not a pure ASCII, for example a CSV file, then an analysis device will also be called CSV compliance to analyze and regenerate CSV data. However, firstly the ASCII conformity analysis device analyzes the ASCII characters that make up the text file within

25 of the email to see if the text string conforms to the default ASCII format, and, if there is compliance, regenerates the ASCII file.

The ASCII compliance analysis device processes the data to ensure that the file conforms to the minimum ASCII predefined format. For example, the ASCII conformity analysis device only allows

30 ASCII characters 32 to 127, and four control characters, "line break" (LF = 10), "carriage return" (CR = 13), "tab" (TAB = 9) and "vertical tab" (VT = 11) regenerate and pass through the system.

Other control characters, such as the bell character (BEL = 7), are not in the default allowed format for an ASCII file, as defined by the AV application. Therefore, the device

35 ASCII conformity analysis does not regenerate the "BEL" character in the ASCII code block that is being treated, but will reject that ASCII character.

Other examples of ASCII conformity analysis device analysis performed are:

40 ! Is the natural line length less than 1,024 characters? ! Are the word lengths less than 25 characters? ! Is the percentage of spaces for characters below a predefined limit?

If at any time the ASCII conformity analysis device is not able to regenerate the data of that

Four. Five part of the ASCII code because it does not conform to the default base format, the ASCII compliance analysis device checks the data to see if they conform to some other type of ASCII code. For example, the source code, BinHex, Base 64. If the data conforms to another type of ASCII code, the data is forwarded to the relevant conformity analysis device for that type of ASCII, which would be, for the examples shown above, a source code conformity analysis device, a conformity analysis device

fifty BinHex or a Base 64 conformity analysis device. It will be understood that an ASCII Base 64 code file may also include other types of files within the encoded data. Then, these other types of files would also be referred to the conformity analysis device of the relevant file type, and so on.

55 Conformity analysis devices for additional types of ASCII code would also have limitations on data compliance within this part of the email. For example, the file could be checked to see if it is a properly structured code, has correct line lengths, and so on. Once each conformity analysis device has determined that the content and parameter data are adjusted, and consequently have been extracted, the extracted content data is regenerated in the format

60 predefined permissible using the conformity analysis device.

Once the ASCII conformity analysis device has completed its task, the regenerated ASCII data is forwarded to the relevant text conformity analysis device of which the data is intended to be. In this embodiment, the text file is a CSV file, and therefore the data is forwarded to the analysis device of

65 CSV compliance.

Examples of the checks performed by the CSV compliance analysis device are as follows. The CSV compliance analysis device treats ASCII data to ensure that there are no long text paragraphs, such as paragraphs that are not part of the predefined format for CSV files. Any data that cannot be treated because it is not adjusted is rejected by the CSV compliance analysis device. He

5 CSV compliance analysis device also checks, for example, to see if the number of delimiters fits the normal default number of delimiters in a CSV file. When the CSV compliance analysis device determines that the data is adjusted, the data is regenerated in the same format.

In this way, only parts of a text file that conform to a predetermined format are allowed

10 move on to the next phase of the AV application. Only the parts that fit in the text file are regenerated with the other parts of regenerated data types before being reassembled and forwarded to their destination. Therefore, any part of the email that contains a virus does not fit and then should be blocked, that is, it is not regenerated and preferably deleted. Any part that does not fit is not allowed to pass through the AV application and infect the operating system.

fifteen A further example of a conformity analysis device is a TIFF (Tag Image File Format) conformity analysis device, used to analyze and regenerate TIFF files.

A TIFF file has a structured format with a set of directories and tags arranged in a format

twenty predefined It is not possible to determine if the image data itself represents a significant image. However, the TIFF compliance analysis device processes and analyzes the image data to ensure that it falls within the predefined limits.

The header information in the TIFF file is processed and analyzed to see if the correct information is

25 Complete and intact. For example, the TIFF compliance analysis device checks to see if the header information includes the resolution, size, and depth fields that are within reasonable limits for a TIFF image. In addition, the TIFF conformity analysis device determines whether the number of bands indicated in the header matches the image data.

30 TIFF files are usually compressed, usually using LZW (Lempel-Ziv-Welch) compression techniques. Each TIFF band is decompressed by the conformity analysis device to see if the band length is within reasonable predefined limits. For example, if the length of the band is not equal to or less than a maximum limit of the image size (for example, greater than a standard A0 paper size), the band is rejected. As soon as the TIFF compliance analysis device rejects a band, it

35 rejects the entire TIFF file.

The TIFF compliance analysis device also performs an analysis of the tags (i.e., parameter data) within the TIFF file. The tags are checked against a predefined allowed format to see if, for example, the tags are in the specified order (according to the tag information directory

40 in the header) and the tags interrelate with each other in the right way.

When the TIFF compliance analysis device determines that the data conforms to the predefined allowable format, the data is regenerated to create a regenerated TIFF file that has the name of the original file (where the file name conforms to the default format). The regenerated TIFF file is forwarded to the server

Four. Five email to reassemble an email message.

It is also possible to have other types of images within the TIFF file itself. For example, JPEG images can be encapsulated within the TIFF file. If a different type of image is detected by the TIFF compliance analysis device, it forwards the data associated with that image to an image analysis device.

fifty additional conformance, in this example, a JPEG conformity analysis device. The JPEG conformity analysis device then processes and analyzes the data to see if they conform to an expected JPEG format, and if so, regenerates the data in the JPEG format. Then, the regenerated data is reassembled in the regenerated TIFF file, which is then used to reassemble a regenerated email. This email is then passed to the email server.

55 An additional option available in this embodiment is the AV application to insert a warning text instead of the unadjusted parts of the email. That is, if a conformity analysis device processes the data of the part that does not fit and determines that a portion of the part does not conform to the predetermined admissible format, after the regeneration of the email, the conformity analysis device inserts the text

60 warning instead of the part that does not fit, informing the intended recipient of the email that a portion of the email has been rejected by the AV application. Alternatively, if a compliance analysis device rejects a whole part of an email because it does not fit, the AV application inserts the warning text into the email informing the intended recipient that a portion of the email has been blocked. , that is, not regenerated and preferably eliminated, by the AV application.

Third embodiment

Referring to Figure 5, a third embodiment of the present invention will now be described.

5 This third embodiment incorporates all the features of the second embodiment, including any of the options discussed in relation to the second embodiment.

Figure 5 shows a flow chart of a process according to this third embodiment.

This embodiment refers to the situation after the AV application has blocked a portion, part or all of an email (called "part that does not fit" in this embodiment.) In step S501, the AV application performs the determination of whether the part does not fit and, if so, should be blocked. If it is blocked by the AV application, the unadjusted part is forwarded to a threat filter application to determine if the unadjusted part is a threat, as shown in step S503.

fifteen The threat filter application determines whether the part that does not fit is considered a real threat based on the user's preferences of the system. The system has stored in its memory a list of file types and sources associated with these types of files that are not considered a threat. Therefore, the system can determine, based on the sender of the file and the type of file, whether the file should be allowed to pass.

If the determination in step S503 determines that the file type is not one of those indicated as being admissible by the associated source, it is blocked in step S505.

If the file type is considered to be admissible, the part that does not fit avoids the AV application in the stage

25 S507 The AV application regenerates the rest of the file received in step S509, and reassembles the parts that are adjusted regenerated and the parts that do not fit avoided from the file in step S511.

For example, if a banking system receives from a known sender a large number of emails including spreadsheets that incorporate complicated instruction sequences, these may be outside the default format allowed for a sequence of instructions within an attached file sheet calculation, and therefore, the conformity analysis device of the sequence of instructions would block this part of the email.

However, as the banking system is able to determine who is sending the emails, and the

35 Sender is registered as a trusted partner of the banking system in a database for these types of files, the spreadsheet in the email is not considered to be a threat. Therefore, the user of the system can configure the threat filter application to allow these non-compliant instructions sequence parts to avoid the AV application and can be reassembled in the email with the regenerated parts of the email.

As an alternative, the threat filter application can operate in a mode where it is determined whether a regenerated file received from the AV application should be allowed to continue through the destination system. If the AV application receives a file that includes parts that do not fit, which in themselves are not sufficiently unadjusted so that the AV application rejects the entire file on the spot, but results in

Four. Five A file that fits regenerated that is basically different from the original file, the regenerated file is forwarded to the threat filter application. For example, the original file size may be considerably larger than a file size that is adjusted regenerated due to a large number of individual words rewritten within a sequence of instructions that is not regenerated by the AV application.

The threat filter application makes a determination of whether the file type is being sent from an authorized source for that type of file, and if so, will allow the file type to pass through the system.

Additional Achievements

55 It will be understood that the embodiments of the present invention are described herein by way of example only, and that various changes and modifications can be made without departing from the scope of the invention.

It will be understood that the present invention can be implemented in any system where electronic files are moved from an origin to a destination. The method of sending electronic files for the purposes of the present invention is not limited to any specific method. That is, for example, electronic files can be transferred from one component to another hardware component of a computer system. Alternatively, for example, electronic files can be transferred through an air interface from a base station to a mobile phone device. Also, for example, electronic files can be transmitted through a

65 local area network (LAN), a wide area network (WAN) or over the Internet.

In addition, it will be understood that, as an additional option for any embodiment described above, an override function may be provided for users to manually override any of the determinations made by, or the AV application or the threat filter application when Receive the electronic file. That is, when a conformity analysis device within the AV application blocks a

5 portion, part or all of the email, due to its nonconformity, the user is still given an option to allow the nonconformity to regenerate and reassemble in the email.

An example of the realization of this option is to provide the intended recipient with a warning text that asks if the nonconformity of the analyzed email should be allowed to pass through the system as if it conforms to the predefined allowed format. A response to this warning provides the conformity analysis device with an instruction to regenerate, if possible, and reassemble the email. Or, as an alternative, the original message is allowed to avoid both the AV application and the threat filter application and pass through the system without regeneration.

fifteen In addition, it will be understood that the AV application as described in the second embodiment may be located elsewhere than on the ISP email server. For example, the AV application can be located in and installed on the recipient's email client server. In this way, any of the emails forwarded by the email client server to the recipient's inbox on a hard disk drive are the regenerated emails as described above.

In addition, it will be understood that the AV application may be wired in a semiconductor device, such as, but not limited to silicon, gallium arsenide (GaAs), indium phosphide (InP). That is, the AV application has a quantifiable task, which does not require the need for updates in the process of defining a format that is predefined. The instructions necessary to perform the AV application task, including treatment, analysis, regeneration and reassembly can be performed on any suitable semiconductor device. In addition, the instructions necessary to implement the AV application can be stored in a semi-permanent or permanent memory device. Then, the memory device would be able to function to run the AV application in association with a connected processor. Then, in these cases, the invention can be provided independently of the computer to be protected, as a stand-alone device (for example, in a card such as a modem card, a network adapter card or the disk drive controller) including processor hardware and memory independent from those of the computer to be protected. This has the advantage of isolating the incoming electronic file completely from the file system and other resources of the computer that must be protected, and its storage in a location that normally cannot be written or updated, in order to avoid "gate" attacks. from behind "in the own

35 AV application; In other words, a level of physical security. The semiconductor device may consist of a processor and a memory device where the processor executes the AV application from the memory device and stores the incoming files in the memory device to isolate them.

In addition, it will be understood that the semiconductor device described above may be provided as a part of any suitable network card using conventional methods. In this way, the network card can be used in a communications network as a means to ensure that the network is protected from unwanted code and data by regenerating the received electronic files using the methods described.

In addition, it will be understood that electronic files as described in the first embodiment can be received

Four. Five through a computer device, where electronic files are stored in a removable memory device. For example, electronic files can be stored on a USB disk device, a smart card, a secure digital memory device (SD), a multimedia card memory device (MMC), a compact flash (CF) type 1 card or 2, an intelligent media card (SM), an XD card, a floppy disk, a ZIP drive, a portable hard disk or any other suitable memory device that can be connected, directly or through a wireless medium, to a computing device.

In addition, it will be understood that an operating system as described in this application can be any system that uses files. For example, an embedded system, a router, a network card or the like.

55 In addition, it will be understood that other coding methods may be used to ensure that any of the executable files received cannot be executed automatically. For example, the encoding method stores each pair of input bytes using a byte exchange method. In this example, if 6 bytes are being received, ABCDEF, by the AV application with byte A that is received first and byte F that is received last, are stored in memory in the following order: BADCF E. The First byte (A) is stored in a second memory position, and the second byte (B) is stored in a first memory position. This inversion occurs in subsequent memory locations for each pair of bytes received. In this way, any executable code is not able to run automatically and therefore any of the infected electronic files is not capable of infecting the AV application or the target operating system.

65 For the avoidance of doubt, protection is hereby requested for each and every one of the new embodiments described above, separately and in combinations.

Having described the various aspects and embodiments of the invention and the modifications thereof, those skilled in the art will appreciate that the invention can be modified in arrangement and detail without departing from the principles thereof. We claim all the embodiments, variations and modifications that fall within the scope of the following claims.