System for protecting a computing system from harmful active content in documents

#The invention relates generally to computer networks. More particularly, the invention relates to a system and method for protecting computer systems from harmful code embedded in downloaded documents.

#Many Web pages today contain active content for enhancing the experience of a user who downloads and displays a Web page at a client computing device using client software, typically a browser. In general, active content is a program or code transparently embedded in a downloaded document (e.g., hypertext markup language (HTML) defining a Web page). The code automatically executes on the client computing device when the Web page is downloaded, causing a type of action to occur. Most Web pages provide active content by including Java™ scripts, Java™ applets, Visual Basic® scripts, or Active X® controls in the HTML.

#Embedded within application level information, active content poses a security threat to the client computing device. For example, Java™ or JavaScript™ code placed within collaborative application data, such as mail messages, chat messages, and shared documents, can exploit vulnerabilities in the client software executing the code. These vulnerabilities include cross-site scripting (XSS) holes and gaps in the Java™ security model, which may assume that the host delivering the data vouches for it. By exploiting such vulnerabilities, an attacker can perform unauthorized operations, such as causing execution of malicious code, taking control of the user's session, and stealing information from the user's computing device.

#The above and further advantages of this invention may be better understood by referring to the following description in conjunction with the accompanying drawings, in which like numerals indicate like structural elements and features in various figures. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention.

#FIG. 1 is a block diagram of an embodiment of a networking system including an active content filter of the present invention.

#FIG. 2 is a flow diagram of an embodiment of a process for protecting a computing system from potentially harmful active content in a document.

#The present invention features a system and method for protecting a computing device from potentially harmful active content (i.e., programs or code) embedded in downloaded files or documents. Downloading as used herein means transferring a document, a file, or information from a remote computing device to a local computing device. Such downloading can occur over a local area network or over a wide area network, such as the Internet. If unfiltered, active content in a downloaded document may perform unwanted or unauthorized (generally referred to as harmful) actions on the local computing device, with or without the user knowing.

#To protect the local computing device from such actions, the system and method of the present invention parse the contents of a document to syntactically identify items within the document that are considered harmful. These items can vary, not only syntactically (e.g., multiple tags), but also in terms of granularity (e.g., tags, attributes, or specific values within attributes and tags). A record of such items is kept within an editable configuration file. When new, potentially harmful items become known, an administrator or user can edit the configuration file to include these new items. Thus, the protection of the local computing device is able to keep pace with the development of new, potentially harmful active content. Except for those edits to the configuration file, changes to client-side or server-side software are not required to upgrade the filtering capability of the active content filter to respond to new forms of active content.

#To simplify the identification process, the items listed in the configuration file can be expressed in the same language structure and schema of the document being examined for active content. When a document is determined to contain potentially harmful content, the document is altered (or trans-coded) to make the document safe for presentation at the local computing device, leaving as much of the harmless content in the document as possible, while removing the harmful content.