File identification system and method

[0001] This non-provisional application claims priority based upon prior U.S. Provisional Patent Application Serial No. 60/341,372 filed Dec. 20, 2001 in the name of Douglas Monahan, entitled File Identification System and Method.

[0002] 1. Technical Field of the Invention

[0003] The present invention relates to the identification of files and, in particular, the identification of files without examination of the literal contents of the file identified.

[0004] 2. Description of Related Art

[0005] From servers around the world, digitized files are conveyed to distant stand-alone or networked computers with a few keystrokes or the click of a mouse. If not blocked by a firewall or other filter, the conveyed files are stored on media associated with the receiving computer or network. The conveyed files may include information or content that is, for any of several reasons, prohibited, protected, or undesirable in the context of the receiving computer. The structure of the received file is, however, conventional and, therefore, not amenable to interdiction by a typical firewall. Consequently, a file may end up in locations or uses that can precipitate liability for those organizations upon whose servers or computers the conveyed file resides. For example, the unauthorized actions of an individual could place images that are illegal, offensive or protected by copyright law on storage facilities of the network of a corporation that is entirely unaware of the new and unauthorized files now resident in its domain.

[0006] Removal of such unauthorized files is difficult. Confidential or trade secret data often reside in the domains in which offensive files have been stored unbeknownst to the host. Therefore, any searcher must be authorized to view the confidential materials that would inevitably be viewed during a search for offending files. At the same time, the amount of data under storage often increases dramatically over time, complicating the identification and localization of particular offensive files, even if access to the entire repository is authorized.

[0007] What is needed, therefore, is a system and method to efficiently identify unauthorized files in a data repository without compromising the confidentiality of other stored data or files.

[0008] A unique assigned code that corresponds to a prohibited file is compared to unique assigned identifiers that correspond to the individual files stored on a network or system to be scrutinized. The unique assigned identifiers do not disclose the contents of the files of the scrutinized network or system and the examined files are not, therefore, placed on or viewable through the comparison. When there is a match between a unique assigned code and a unique assigned identifier, it is known that the prohibited file is resident on the examined network or system. With optional features, the identified prohibited file can be located and removed.

[0009] The disclosed invention will be described with reference to the accompanying drawings, which show important sample embodiments of the invention and which are incorporated in the specification hereof by reference, wherein:

[0010] FIG. 1 depicts an exemplar system employed in accordance with a preferred embodiment of the present invention.; and

[0011] FIG. 2 illustrates the preferred method for file identification.

[0012] The numerous innovative teachings of the present application will be described with particular reference to the presently preferred exemplary embodiments. However, it should be understood that these embodiments provide only a few examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily delimit any of the various claimed inventions. Moreover, some statements may apply to some inventive features, but not to others.

[0013] FIG. 1 is a graphical depiction of a system 10 employed in accordance with a preferred embodiment of the present invention. A general structure of system 10 is shown in use with a target computer system 12 to be examined for the presence of undesired or prohibited files. In the depiction of FIG. 1, target computer system 12 includes database 14 and disk array 16 and computer terminal 18 connected to database 14 and array 16. Target computer system 12 need not include out-lying storage such as illustrated database 14 and array 16 and may include only local or on-board storage. The present invention may be used to advantage to examine target computer systems of a variety of types with a variety of storage locations and media. Example database 14 and array 16 may be repositories of files of a multiplicity of formats that express data image, text, video, or sound formats, or may be specialized storage vehicles that contain only one or two types of files. When this application uses the term file, it should be understood to include digital representations of any types of information whether alpha-numeric text, visual imagery including motion or still, or auditory. It should also be understood that computer system 12 is merely exemplary and is offered to illustrate only one of the many computer systems that can be examined in accordance with the present invention. Those of skill will recognize that in addition to external storage, computer system 12 may employ on-board storage in association with terminal 18.

[0014] Files from target computer system 12 are evaluated by sum calculator 20 to produce a unique identifier that, in a preferred embodiment, is expressed in digits that correspond to the identified file. A particular preferred embodiment expresses the unique identifiers and unique codes in eight hex digits. Unique identifier listing 22 illustrates five unique identifiers for five different files including images, text, and database files. Sum calculator 20 may be any of the many checksum calculators readily available to those of skill in the art. An example sum calculator that can be employed as sum calculator 20 is WinCrc32. WinCrc32 is just one of many checksum type generators that can produce unique identifiers and unique codes for use with the present invention. Preferably, sum calculator 20 will produce a unique identifier that provides sufficient resolution to detect minute changes made in a file.

[0015] System 10 is shown with a database repository 24 of prohibited files. The system may be employed in instances where only one particular prohibited file is sought in a computer system 12 to be examined, but the availability of multiple prohibited files in a database or other storage can provide convenience for the user of the system. For clarity of depiction, FIG. 1 depicts an examination of computer system 12 for the presence of one prohibited file 26 but those of skill will recognize that the target system 12 may be examined by the disclosed process for is the presence of multiple prohibited files.

[0016] For purposes of illustration, prohibited file 26 may be deemed to be an executable file offered only to users authorized under license terms to which the owner of target computer system 12 has not subscribed. Even so, in the continuing illustration, a user of target computer system 12 has found a copy of prohibited file 26 on the Internet and loaded it onto target computer system 12 unbeknownst to the owner of target computer system 12.

[0017] Sum calculator 20 generates a unique assigned code that corresponds to prohibited file 26 and is depicted as unique assigned code 2bee33c6 in process box 28. Comparison process 30 compares the unique assigned code that corresponds to prohibited file 26 (i.e., 2bee33c6) to the unique identifier listing 22 that includes unique identifiers that correspond to files taken from media of target computer system 12.

[0018] Those of skill will recognize that unique identifier listing 22 may include not only the unique identifiers that correspond to files in target computer system 12 but may also include location data that can be employed to locate in storage, prohibited files found in target computer system 12 by system 10. After comparing the unique assigned code that corresponds to the prohibited file 26 to the unique identifier listing 22, comparison process 30 provides an output signal 32 that includes, in a preferred embodiment, an indication of the presence of the prohibited file 26 by virtue of the detection of a unique identifier from target computer system 12 that exactly matches the unique assigned code that corresponds to the prohibited file.

[0019] FIG. 2 is a workflow diagram showing a method employed in the preferred embodiment of the present invention. The first step is to acquire a file to be examined 201. The file to be examined 201 can be located on, for example, a target computer system. The target computer system can include, for example, a database, disk array, and computer terminal connected to the database and disk array. The target computer system need not include outlying storage such as a remote database or disk array but may include, for example, only local or onboard storage. The files to be examined 201 may include digital representations such as alpha numeric text, moving visual imagery, still visual imagery and auditory representations. The format of the files to be examined 201 may be in data image, text, video or audio format.

[0020] Next, a unique identifier is calculated 202. The method of calculating the unique identifier 202 may be performed by a sum calculator to produce a unique identifier that, in the preferred embodiment, is expressed in digits that correspond to the identified file. A particular preferred embodiment expresses the unique identifiers in 8-hex digits. The sum calculator may be any check sum calculator readily available to those of skill in the art. Preferably, the check sum calculator will produce a unique identifier that provides sufficient resolution to detect minute changes made in a file.

[0021] Next, a particular prohibited file is identified 203. There may be instances where only one particular prohibited file is sought to be identified, but it may also be possible to identify multiple files. The preferred embodiment also provides that a repository of prohibited files may be retained for comparison purposes. The prohibited file may be, for example, an executable file offered only to users authorized under licensed terms to which the file to be examined is not bound.

[0022] Next, the check sum calculator generates a unique assigned code that corresponds to the particular prohibited file 204. Thereafter, the unique code is compared to the unique identifier 205. The unique identifier is configured so as not to disclose the contents of the file to be examined. In addition, during the comparison process, the file to be examined is not viewable.

[0023] Once the unique identifier has been compared to the unique code 205, those with skill in the art will recognize that a signal can be generated to indicate the presence of a particular file on the target computer system. Alternatively, a signal could be generated upon the occurrence of a match between the unique identifier and the unique code. Once a match occurs, an additional step may be included in which the location of the particular file on the target computer system is recorded and vocation is indicated to the user. Thereafter, an additional step may be incorporated in which the particular prohibited file is removed from the system.