Source: http://www.freepatentsonline.com/y2007/0245031.html
Timestamp: 2020-01-25 13:45:27
Document Index: 76254071

Matched Legal Cases: ['art.\n7', 'art.\n9', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 2', 'art 2', 'art 2', 'art 1', 'art 2', 'art 2', 'art 1', 'art 2', 'art 2', 'art 2', 'art 1', 'art 2', 'art 2', 'art 2', 'arts 1']

ICAP processing of partial content to identify security issues - Liu, Zhiping
ICAP processing of partial content to identify security issues
United States Patent Application 20070245031
Liu, Zhiping (San Jose, CA, US)
11/362022
Download PDF 20070245031 PDF help
1. An Internet Content Adaptation Protocol (ICAP) server, comprising: a memory; and a processor, connected to the memory, to: receive a part of a response that includes a plurality of parts, combine the part of the response with at least one previously received part of the response stored in the memory to obtain combined parts of the response, process the combined parts of the response to determine whether there is a security issue associated with the combined parts of the response, and cause the part of the response to be transmitted toward a destination when there is no security issue associated with the combined parts of the response.
2. The ICAP server of claim 1, wherein the processor is configured to: receive a first part of the response, process the first part of the response to determine whether there is a security issue associated with the first part of the response, and store the first part of the response in the memory when there is no security issue associated with the first part of the response.
3. The ICAP server of claim 2, wherein the processor is further configured to: cause the first part of the response to be transmitted toward the destination when there is no security issue associated with the first part of the response, and cause the first part of the response to be dropped when there is a security issue associated with the first part of the response.
4. The ICAP server of claim 1, wherein the part of the response is a last part of the response and the combined parts of the response comprise all of the parts of the response.
5. The ICAP server of claim 1, wherein the processor is configured to receive the part of the response within an ICAP request.
6. The ICAP server of claim 5, wherein the ICAP request includes: an ICAP header that includes: a request identifier that uniquely corresponds to the response, and a part number that uniquely identifies the part with regard to other ones of the plurality of parts, and an ICAP body that includes data associated with the part.
7. The ICAP server of claim 6, wherein at least one of the ICAP header or the ICAP body includes a last identifier that identifies whether the part is a last part of the response.
8. The ICAP server of claim 5, wherein the ICAP request includes: an ICAP header that includes: a request identifier that uniquely corresponds to the response, and a byte range that identifies a set of bytes of the response associated with the part, and an ICAP body that includes data associated with the part.
9. The ICAP server of claim 8, wherein at least one of the ICAP header or the ICAP body includes a last identifier that identifies whether the part is a last part of the response.
10. The ICAP server of claim 1, wherein the response includes one of an email, an instant message, a file, or a web page.
11. The ICAP server of claim 1, wherein when processing the combined parts of the response, the processor is configured to perform a service on the combined parts of the response, where the service includes at least one of checking for a virus, checking for spyware, performing content filtering, identifying spam, identifying phising, or identifying farming.
12. The ICAP server of claim 1, wherein the processor is configured to: determine whether the part of the response is a last part of the response, and store the part of the response in the memory when the part of the response is not the last part of the response and there is no security issue associated with the combined parts of the response.
13. The ICAP server of claim 12, wherein the processor is further configured to: determine whether a next part of the response or a last part of the response has been received within a predetermined amount of time, and drop the part of the response from the memory when the next part of the response or the last part of the response has not been received within the predetermined amount of time.
14. An Internet Content Adaptation Protocol (ICAP) server, comprising: a memory; and a processor, connected to the memory, to: receive a first part of a response that includes a plurality of parts, process the first part of the response to determine whether there is a security issue associated with the first part of the response, store the first part of the response in the memory when there is no security issue associated with the first part of the response, receive a last part of the response, combine the last part of the response with at least the first part of the response to obtain combined parts of the response, process the combined parts of the response to determine whether there is a security issue associated with the combined parts of the response, and cause the last part of the response to be transmitted toward a destination when there is no security issue associated with the combined parts of the response.
15. The ICAP server of claim 14, wherein the processor is further configured to cause the first part of the response to be transmitted toward the destination before receiving the last part of the response when there is no security issue associated with the first part of the response.
16. The ICAP server of claim 14, wherein the processor is further configured to: determine whether a next part of the response or the last part of the response has been received within a predetermined amount of time of receiving or storing the first part of the response, and drop the first part of the response from the memory when the next part of the response or the last part of the response has not been received within the predetermined amount of time.
17. A system, comprising: a network device to: receive a plurality of parts of a response associated with a client, the response being divided into the plurality of parts, and individually transmit each of the plurality of parts; and a server, connected to the network device, to: receive one of the plurality of parts from the network device, combine the one of the plurality of parts with another one of the plurality of parts that was previously received from the network device to obtain combined parts, and process the combined parts to determine whether there is a security issue associated with the combined parts.
18. The system of claim 17, wherein the server is further configured to cause the network device to transmit the one of the plurality of parts toward the client or a destination identified by the client when there is no security issue associated with the combined parts.
19. The system of claim 17, wherein at least one of the server or the network device is configured to drop the one of the plurality of parts when there is a security issue associated with the combined parts.
20. The system of claim 17, wherein the network device is configured to send the one of the plurality of parts to the server within an ICAP request.
21. The system of claim 20, wherein the ICAP request includes: an ICAP header that includes: a request identifier that uniquely corresponds to the response, and a part number that uniquely identifies the one of the plurality of parts with regard to other ones of the plurality of parts, and an ICAP body that includes data associated with the one of the plurality of parts.
22. The system of claim 21, wherein at least one of the ICAP header or the ICAP body includes a last identifier that identifies whether the one of the plurality of parts is a last part of the response.
23. The system of claim 20, wherein the ICAP request includes: an ICAP header that includes: a request identifier that uniquely corresponds to the response, and a byte range that identifies a set of bytes of the response associated with the one of the plurality of parts, and an ICAP body that includes data associated with the one of the plurality of parts.
24. The system of claim 23, wherein at least one of the ICAP header or the ICAP body includes a last identifier that identifies whether the one of the plurality of parts is a last part of the response.
25. The system of claim 17, wherein the response includes one of an email, an instant message, a file, or a web page.
26. The system of claim 17, wherein when processing the combined parts, the server is configured to perform a service on the combined parts, where the service includes at least one of checking for a virus, checking for spyware, performing content filtering, identifying spam, identifying phising, or identifying farming.
27. A method performed by an Internet Content Adaptation Protocol (ICAP) server, comprising: receiving a first part of a response that includes a plurality of parts; storing the first part of the response; causing the first part of the response to be transmitted toward a destination; receiving a second part of the response; combining the second part of the response with at least the first part of the response to obtain combined parts of the response; processing the combined parts of the response to determine whether there is a security issue associated with the combined parts of the response; and causing the second part of the response to be transmitted toward the destination when there is no security issue associated with the combined parts of the response.
28. The method of claim 27, wherein the response includes one of an email, an instant message, a file, or a web page.
29. The method of claim 27, wherein processing the combined parts of the response includes performing a service on the combined parts of the response, where the service includes at least one of checking for a virus, checking for spyware, performing content filtering, identifying spam, identifying phising, or identifying farming.
30. An Internet Content Adaptation Protocol (ICAP) request transmitted from a network device to an ICAP server to request a service with regard to a part of a response that has been divided into a plurality of parts, comprising: an ICAP header that includes: a service identifier that identifies the service to be performed by the ICAP server on the part of the response, a request identifier that uniquely corresponds to the response, and a part number that uniquely identifies the part of the response with regard to other ones of the parts of the response or a byte range that identifies a set of bytes of the response associated with the part of the response; and an ICAP body that includes data associated with the part of the response.
31. The ICAP request of claim 30, wherein at least one of the ICAP header or the ICAP body includes a last identifier that identifies whether the part is a last part of the response.
32. The ICAP request of claim 30, wherein the service identifier identifies at least one of checking for a virus, checking for spyware, performing content filtering, identifying spam, identifying phising, or identifying farming.
33. A server, comprising: a memory; and a processor, connected to the memory, to: receive a part of a response that includes a plurality of parts, store the part of the response in the memory, cause the part of the response to be transmitted toward a destination, receive another part of the response after causing the part of the response to be transmitted toward the destination, combine the other part of the response with at least the part of the response to obtain combined parts of the response, process the combined parts of the response to determine whether there is a security issue associated with the combined parts of the response, and cause the other part of the response to be transmitted toward the destination when there is no security issue associated with the combined parts of the response.
34. A system, comprising: means for receiving a first part of a response that includes a plurality of parts; means for determining whether there is a security issue associated with the first part of the response; means for storing the first part of the response when there is no security issue associated with the first part of the response; means for causing the first part of the response to be transmitted toward a destination when there is no security issue associated with the first part of the response; means for receiving a last part of the response; means for combining the last part of the response with at least the first part of the response to obtain combined parts of the response; means for processing the combined parts of the response to determine whether there is a security issue associated with the combined parts of the response; and means for causing the last part of the response to be transmitted toward the destination when there is no security issue associated with the combined parts of the response.
ICAP server 140 may include a server, or a set of servers, operating based on ICAP to perform one or more operations on behalf of network device 130. Network device 130 may operate an ICAP client process that may interact with an ICAP server process operating on ICAP server 140. Generally, network device 130 may send a request to ICAP server 140 to perform a service, such as check for a virus and/or spyware, perform content filtering, or identify spam, phising, or farming, with regard to data received by network device 130. ICAP server 140 may perform the service and provide the results to network device 130. Network device 130 may use the results in determining, for example, whether to drop the data or send the data to client 110 (or elsewhere).
The service identifier might indicate the type of service that ICAP server 140 is being requested to perform. For example, ICAP server 140 may be capable of performing a number of services, such as virus and/or spyware checking, content filtering, and/or spam, phising, and/or farming identification. The ICAP version might identify the version of ICAP that is used by network device 130 and ICAP server 140. The host might identify the domain or host associated with server 120. The encapsulation might identify an offset at which various sections of the ICAP request occur relative to the start of ICAP body 420.
When the part is not the last part of the response (block 335—NO), ICAP server 140 may process the part to determine whether there are any security issues associated with the part (block 340). The security issues may involve, for example, virus and/or spyware checking, content filtering, and/or spam, phising, and/or farming identification.
ICAP server 140 may then process the entire response to determine whether there are any security issues associated with the response (block 380). For example, ICAP server 140 may perform the service on the entire response that it has been requested to perform by network device 130. In one implementation, the service relates to the identification of security issues, such as virus and/or spyware checking, content filtering, and/or spam, phising, and/or farming identification. If ICAP server 140 has been requested to perform a virus check, for example, ICAP server 140 may perform a virus check on the entire response to determine whether the response includes a virus.
Identification of Spam, Phising or Farming
The ICAP server may be configured to perform spam, phising, or farming identification with regard to responses. FIG. 7 is a diagram of an exemplary implementation for performing spam, phising, or farming identification. As shown in FIG. 7, assume that a server is sending an email to a client and has divided the email into N parts (where N>1). For the description to follow, assume that N=3. The server may send each email part (e.g., email part 1, . . . , email part N) separately to the network device. Assume that the email contains spam, phising, or farming that cannot be detected in any one of the email parts alone.
The network device may receive email part 1 and forward it to the ICAP server within a request for the ICAP server to perform spam, phising, or farming identification. The ICAP server may receive the request and determine whether email part 1 is the last part of the email. In this case, the ICAP server determines that email part 1 is not the last part of the email. The ICAP server may then perform spam, phising, or farming identification on email part 1. The ICAP server may inform the network device of the result of the spam, phising, or farming identification. If email part 1 has been determined to be associated with spam, phising, or farming, then the network device may drop email part 1 and may inform the client. If email part 1 has not been determined to be associated with spam/phising/farming, the ICAP server may store email part 1 and the network device may forward email part 1 to the client.
The network device may receive email part 2 and forward it to the ICAP server within a request for the ICAP server to perform spam, phising, or farming identification. The ICAP server may receive the request and determine whether email part 2 is the last part of the email. In this case, the ICAP server determines that email part 2 is not the last part of the email. The ICAP server may then perform spam, phising, or farming identification on email part 2 and/or the combination of email part 1 and email part 2. The ICAP server may inform the network device of the result of the spam, phising, or farming identification. If email part 2 or the combination of email part 1 and email part 2 has been determined to be associated with spam/phising/farming, then the network device may drop email part 2 and may inform the client. If email part 2 or the combination of email part 1 and email part 2 has not been determined to be associated with spam/phising/farming, the ICAP server may store email part 2 and the network device may forward email part 2 to the client.
The network device may receive email part N and forward it to the ICAP server within a request for the ICAP server to perform spam, phising, or farming identification. The ICAP server may receive the request and determine whether email part N is the last part of the email. In this case, the ICAP server determines that email part N is the last part of the email. The ICAP server may combine email part N with the other parts of the email that it has previously received and stored (i.e., email parts 1 and 2) to form the entire email. The ICAP server may then perform spam, phising, or farming identification on the entire email. The ICAP server may inform the network device of the result of the spam, phising, or farming identification. If the email has been determined to be associated with spam/phising/farming, then the network device may drop email part N and may inform the client. If the email has not been determined to be associated with spam/phising/farming, the network device may forward email part N to the client.
Previous Patent: Secure windowing for labeled containers
Next Patent: System and method of a data blocker based on local monitoring of a soliciting website