Content-checking of embedded content in digitally encoded documents
Methods and apparatus for network security content-checking, in particular simplifying the critical element of a content-checker so that it can be trusted and implemented in hardware logic. A method comprises determining whether a digitally encoded document contains any embedded documents; content-checking, by means of at least one hard-ware-implemented content-checker, at least one of the embedded documents separately from those parts of the digitally encoded document within which it was embedded; and releasing a version of the digitally encoded document responsive to the content-checking.
1. A method of mitigating the effect of a security threats potentially contained in a digitally encoded document, the method comprising:
determining whether the digitally encoded document contains any embedded documents;
extracting embedded content into a separate document, such that a single input digital encoded document is translated into parts which contain references to one another;
content-checking, by means of at least one hardware-implement content-checker, at least one of the embedded documents separately from those parts of the digitally encoded document within which it was embedded;
recombining at least some of the parts of the extracted embedded content into the digitally encoded document using the references contained therein; and
releasing a version of the digitally encoded document responsive to the content-checking
2. A method according to claim 1 in which embedded documents are nested.
3. A method according to claim 1 in which the step of determining whether the digitally encoded document contains any embedded documents is performed recursively.
4. A method according to claim 1 in which the content-checking of the at least one embedded document is performed on all embedded documents.
5. A method according to claim 1 in which content-checking of multiple embedded documents is arranged to be performed in parallel.
6. A method according to claim 1 in which content-checking of a document is performed responsive to an assessment as to whether the document was an embedded document or the un-embedded portion of the digitally encoded document.
7. A method according to claim 1 in which documents are content-checked responsive to an indication whether all their embedded documents have already been content-checked.
8. A method according to claim 1 in which the documents are content-checked bottom-up.
9. A method according to claim 1 in which content-checking of a document is performed responsive to information representative of the type of one or more embedded documents originally embedded within it.
10. A method according to claim 1 in which the version of the original digitally encoded document released is a version modified with respect to the original digitally encoded document responsive to the content-checking.
11. Apparatus comprising a computer arranged to perform the steps of:
determining whether the digitally encoded document contains any embedded documents;
extracting embedded content into a separate document, such that a single input digital encoded document is translated into parts which contain references to one another;
content-checking, by means of at least one hardware-implement content-checker, at least one of the embedded documents separately from those parts of the digitally encoded document within which it was embedded;
recombining at least some of the parts of the extracted embedded content into the digitally encoded document using the references contained therein; and
releasing a version of the digitally encoded document responsive to the content-checking.
12. A non-transitory computer readable medium including code portions arranged to perform a method comprising the steps of:
determining whether the digitally encoded document contains any embedded documents;
extracting embedded content into a separate document, such that a single input digital encoded document is translated into parts which contain references to one another;
content-checking, by means of at least one hardware-implement content-checker, at least one of the embedded documents separately from those parts of the digitally encoded document within which it was embedded;
recombining at least some of the parts of the extracted embedded content into the digitally encoded document using the references contained therein; and
releasing a version of the digitally encoded document responsive to the content-checking.