Method for preventing activation of malicious objects
View Patent ↗A method for preventing activating a malicious object passing through a checkpoint, and decreasing the overall inspection delay thereof, the method comprising the steps of: (a) at the checkpoint, creating an envelope file, being an executable file comprising: the object; code for extracting the object from the envelope file; and an indicator for indicating the integrity of the object; (b) forwarding the envelope file instead of the object toward its destination, while holding at least a part of the envelope file which comprises the indicator; (c) inspecting the object; and (d) setting the indicator on the envelope file to indicate the inspection result thereof, and releasing the rest of the envelope file.
1. A method for preventing activating a malicious object passing through a checkpoint, and decreasing the overall inspection delay thereof, the method comprising the steps of:
a. at said checkpoint, creating an envelope file, being an executable file comprising: said object; code for extracting said object from said envelope file; and an indicator for indicating the integrity of said object;
b. forwarding said envelope file instead of said object toward its destination, while holding at least a part of said envelope file which comprises said indicator;
c. inspecting said object;
d. setting said indicator on said envelope file to indicate the inspection result thereof, and
e. releasing the rest of said envelope file.
2. A method according to claim 1 , wherein said checkpoint is selected from a group comprising: a gateway server, a proxy server.
3. A method according to claim 1 , wherein the name of said envelope file is identical to the name of the inspected object.
4. A method according to claim 1 , wherein the name of said envelope file differs than the name of the inspected object.
5. A method according to claim 1 , wherein said indicator is selected from a group comprising: a CRC of at least one part of said envelope file, a CRC of at least one part of said inspected object, a checksum of at least one part of said envelope file, a checksum of at least one part of said inspected object, a value stored within said envelope file, absence of a part of said envelope file, absence of a part of said object.
6. A method according to claim 1 , wherein at least a part of said object is secured.
7. A method according to claim 1 , wherein at least a part of said envelope file is secured.
8. A method according to claim 1 , wherein said indicator is stored within the last part of said envelope file.
9. A method according to claim 1 , wherein said envelope file further comprises code for displaying an acknowledgment.
10. A method according to claim 9 , wherein said acknowledgment indicates integrity of said object.