|Publication number||USRE42212 E1|
|Application number||US 11/418,553|
|Publication date||Mar 8, 2011|
|Filing date||May 3, 2006|
|Priority date||Mar 14, 2001|
|Also published as||US20020133709|
|Publication number||11418553, 418553, US RE42212 E1, US RE42212E1, US-E1-RE42212, USRE42212 E1, USRE42212E1|
|Inventors||Terry G. Hoffman|
|Original Assignee||Hoffman Terry G|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (32), Non-Patent Citations (5), Classifications (18), Legal Events (6)|
|External Links: USPTO, USPTO Assignment, Espacenet|
This application is a reissue of U.S. Pat. No. 6,732,279, which issued from U.S. application Ser. No. 10/346,025, filed Jan. 16, 2003, which is a continuation-in-part application of pending application Ser. U.S. application Ser. No. 09/804,796 09/804,796, filed Mar. 14, 2001. 2001, now abandoned.
1. Field of the Invention
A anti-virusA protection system for use within a data transmission network to protect against the transfer of viruses from a source(s) or originator(s) to a recipient(s) or subscriber(s) over the data transmission network.
2. Description of the Prior Art
With the advent of data transfer over communication networks, computer viruses, worms and Trojan horses have plagued and compromised the operation of the various computers or nodes. A computer virus is a section of code that is buried or hidden in another program attaching itself to other programs in the system that, in turn, can be copied over to other programs. Such viruses can cause a message to be displayed on the screen or actually destroy programs and data. Worms, on the other hand, are destructive programs that replicate themselves using up computer resources resources, eventually causing the computer system to crash.
The prior art has attempted to reduce the effects of viruses and eliminate the proliferation through virus detection programs. For example, an operator can monitor a computer or system for such basis basic operating functions such as write, erase or format disk. When such operations occur, the user is prompted to confirm whether the operation is expected. If the particular operation or function is not expected, the user aborts the operation as having been prompted by a virus program. Another virus detection method, method scans program code being copied onto the system searching for recognizable patterns of program code used for viruses. Another method employs check summary on host programs known to be free from viruses. If a virus later attaches itself to a host program, the value will be different and the presence of a virus detected.
Unfortunately, despite these efforts of efforts, the prior art suffer suffers from various deficiencies. Therefore, there is a need for a system and method for effectively detecting and eliminating viruses without significantly affecting the performance of the computer. Behavior interception is not successful at detecting all viruses since a virus can be placed at locations where such critical operations are likely to occur for the normal operation of programs. Second, most signature scanning is only performed on new inputs from disk drives. With the advent of the Internet and its increased popularity, there are no prior art methods that have been able to successfully scan connections such as those utilized by a gateway node in communicating with other networks. Third, many of the above methods require a significant amount of computing resources, which in turn degrades the overall performance of the system. Thus, operating the virus detection programs on every computer becomes impractical. Therefore, the operation of many such virus detection programs is disabled for improved performance of individual machines.
U.S. Pat. No. 5,623,600 discloses a system for detecting and eliminating viruses on a computer network that includes a File Transfer Protocol (FTP) proxy server, for controlling the transfer of files files, and a Simple Mail Transfer Protocol (SMTP) proxy server server, for controlling the transfer of mail messages through the system. The FTP proxy server and SMTP proxy server run concurrently with the normal operation of the system and operate in a manner such that viruses transmitted to or from the network in files and messages are detected before transfer into or from the system. The FTP proxy server and SMTP proxy server scan all incoming and outgoing files and messages respectively before transfer messages, respectively, for viruses before transfer, and then transfer the files and messages, only if they do not contain any viruses. The method for processing a file before transmission into or from the network includes the steps of receiving the data transfer command and file name; transferring the file to a system node; performing virus detection on the file; determining whether the file contains any viruses; transferring the file from the system to a recipient node if the file does not contain a virus; and deleting the file if the file contains a virus.
U.S. Pat. No. 6,157,721 and U.S. Pat. No. 6,292,569 describes a system and method describe systems and methods using cryptography to protect Secure secure computation environments from bogus or rogue load modules, executables executables, and other data elements through use of digital signatures, seals seals, and certificates issued by a verifying authority. The verifying authority tests the load modules or other executables to verify that the corresponding specifications are accurate and complete, and then digitally signs the load module or other executable based on tamper resistance work factor classification. Secure computation environments with different tamper resistance work factors use different verification digital signature authentication techniques allowing one tamper resistance work factor environment to protect against load modules from another, different tamper resistance work factor environment. Several dissimilar digital signature algorithms may be used to reduce vulnerability from algorithm compromise, and subsets of multiple digital signatures may be used to reduce the scope of any specific compromise.
U.S. Pat. No. 5,416,842 teaches a first data processing device (node I) coupled to a first private network and to a firewall server (FWA). Firewall server FWA is in turn coupled to a public network such as the Internet. A second data processing device (node J) is coupled to a second private network that is coupled to the Internet through a firewall server (FWB). Node I provides a data packet packet, including IP data and a destination address for the intended receiving node J J, to the firewall FWA. The firewall FWA is provided with a secret value a, “a,” and a public value. The firewall FWB is provided with a secret value “b,” and a public value. The firewall FWA obtains a Diffie-Hellman (DH) certificate for the firewall FWB and determines the public value from the DH certificate. Firewall FWA then computes the value and derives a key K. ( Kab) from the value .varies.sup.ab mod p. p (∝
U.S. Pat. No. 5,432,850 shows a method for secure transmission of data having a destination address and a source address on a shared communication network. The method comprise the steps of of: transmitting a multiplicity of data frames, each containing at least an encrypted data sequence employing the destination address as at least part of a decryption key therefor, therefor; receiving the multiplicity of data frames at a receiver on the shared communication network network; and attempting to decrypt the encrypted data sequence by employing the local address of the receiver as at least part of a decryption key.
U.S. Pat. No. 5,511,122 relates to an internet authentication method to verify a sending host by a receiving host or an intermediate router or gateway. The method comprises the steps of: obtaining a network address and a public key of a receiving host; utilizing the public key from the receiving host in combination with a private key of the originating host to generate a cryptographic signature; transmitting the signature along with data through a first subnetwork in at least one packet; receiving at least one packet at the receiving host; and the receiving host utilizing a private key of said receiving host site and a public key of said originating host to verify said cryptographic signature.
U.S. Pat. No. 6,065,118 shows a system to reduce the risk of damage to data or programs in an end user computer system programmed to operate in response to an imported data stream containing one or more mobile program components from an external source. The incoming data stream is screened to identify mobile program components of that data stream. Some Prior to being executed, some of the mobile program components are passed to a program execution location isolated from the end user system prior to being executed to operate in a desired manner. The execution location has an interface with the external source of the data stream and an interface with the end user system. The operation of the interface between the execution location and the end user system is programmed so that only data that has been interacted on by the program component within the execution location in a specified and controlled manner can be passed to and from the end user system.
U.S. Pat. No. 6,067,620 describes a secure network interface unit (SNIU) to provide multi-level security on a network having a plurality of secured and unsecured users including including: network interface means for communicating on the network, network; identifying the source and destination of a message intercepted on the network; determining the security levels of each of the plurality of users; a trusted computing base for determining whether the message, if transmitted to the destination user, will violate security parameters; and, cryptographically encrypting messages sent to, and decrypting messages received from from, another SNIU affiliated with the destination user.
U.S. Pat. No. 6,108,583 shows a system and method for data communication with adaptive security in which a send host transmits a data stream to a receive host in packets which contain an authentication data block with an authentication header and a signature block. The authentication header advantageously contains various fields including a verification type, a security algorithm, a minimum security level, a target security level, and an actual security level. The receive host adaptively performs verification of the data packets using varying security levels based in part on the availability of security operations per second (SOPS) in the receive host. Where a data stream in the receive host is delayed by a security processing bottleneck, the receive host may alter the verification type, security algorithm, or the actual security level to speed up the processing of the data stream by reducing the amount of security processing performed. The receive host further allocates the SOPS among the data streams received.
U.S. Pat. No. 6,229,806 describes a communication system in which a user device generates authentication information unique to the user device and provides a data packet including this authentication information to an infrastructure part which is a gateway or a host. The packet also contains a host identifier or time dependent information. This is used at the gateway or the host to authenticate the packet.
U.S. Patent Application Publication No. 2002/0023214 shows how secure computation environments are protected from bogus or rogue load modules, executablesexecutables, and other data elements through use of digital signatures, sealsseals, and certificates issued by a verifying authority. A verifying authority tests the load modules or other executables to verify that their corresponding specifications are accurate and complete, and then digitally signs the load module or other executable based on a tamper resistance work factor classification. Secure computation environments with different tamper resistance work factors use different verification digital signature authentication techniques, e.g. different signature algorithms and/or signature verification keys, allowing one tamper resistance work factor environment to protect itself against load modules from another, different tamper resistance work factor environment. Several dissimilar digital signature algorithms may be used to reduce vulnerability from algorithm compromise, and subsets of multiple digital signatures may be used to reduce the scope of any specific compromise.
U.S. Patent Application Publication No. 2002/0040439 teaches a system and method for providing external data signal isolation, and signal-level information-preserving-data-transformations, to enable safe, operationally efficient, information sharing between protected information systems and networks and external, potentially hostile, information systems and networksnetworks, which neutralizesneutralize any imbedded hostile executable codes such as viruses that may be in data-signals incoming from the external systems and networks. The system and method prevent untransformed external data-signals from entering protected systems and/or networks using an intermediate screen that is a computer hardware device. The intermediate screen, which may be implemented as a network of systems, is deployed between the protected systems and external systems and is used to process all incoming signals from the external systemsystems to obtain transformed data sets from which information is extracted before it is passed to the protected systemsystems. The incoming signals all remain confined in the intermediate screen.
The present invention relates to an anti-virus a protection system and method for use with a data transmission network to protect against the transfer of viruses or other unwanted data. The data transmission network comprises a network of transmission originators and subscribers/recipients coupled through a data transfer control means or router.
The data transfer control means functions as a gate keeper to detect viruses, worms, Trojan horses or spam before handing-off any data to a subscriber/recipient acting as a virtual isolation room to isolate subscribers/recipients from unwanted transmissions.
The anti-virus protection method is implemented through the use of a transmission pack formatted to allow the data transmission control means to scan the transmission pack for preassigned security codes, subscriber/recipient information and other authentication information to control the transfer of data between transmission originators and subscribers/recipients.
The method comprises the steps of assigning a discrete security code to the transmission originator; generating a transmission pack including a discrete subscriber/recipient IP address code element corresponding to the discrete subscriber/recipient IP address code of the subscriber/recipient, a discrete security code element corresponding to the discrete security code assigned to the transmission originator, a file extension element element, and a data packet element; transmitting the transmission pack to the data transfer control means; authenticating the transmission pack with the discrete subscriber/recipient IP address code element, discrete security code element element, and transmission originator; transferring the authenticated transmission pack to the subscriber/recipient subscriber/recipient; and isolating the subscriber/recipient from an unauthenticated transmission pack to prevent the transfer of an unauthenticated transmission pack to the subscriber/recipient.
The invention accordingly comprises the features of construction, combination of elements, and arrangement of parts which will be exemplified in the construction hereinafter set forth, and the scope of the invention will be indicated in the claims.
The invention accordingly comprises the features of construction, combination of elements, and arrangement of parts which will be exemplified in the construction hereinafter set forth, and the scope of the invention will be indicated in the claims.
For a fuller understanding of the nature and object of the invention, reference should be had to the following detailed description taken in connection with the accompanying drawings in which:
Similar reference characters refer to similar parts throughout the several views of the drawings.
The present invention relates to an anti-virus a protection system and method for use with a data transmission network to protect against the transfer of viruses or other unwanted data. As shown in
Since the data transfer control means 14 includes circuitry and logic to scan transmissions from the transmission originator 10 as a gate keeper to detect viruses, worms, Trojan horses or spam before handing-off any data to a subscriber/recipient 12, the data transfer control means 14, in effect, acts as a virtual isolation room to isolate subscribers/recipients 12 from unwanted transmissions.
The anti-virus protection method is implemented through the use of a transmission pack formatted to allow the data transmission control means to scan the transmission pack for preassigned pre-assigned security codes, subscriber/recipient information information, and other authentication information to control the transfer of data between transmission originators and subscriber/recipients.
An extended security or key code as described hereinafter is selected and assigned to each transmission originator 10. As shown in
Of course, a transmission originator 10 can be assigned multiple security codes corresponding to each of the plurality of security levels to allow the system to authenticate and transfer data of different levels of security from a single transmission originator 10 to one or more subscribers/recipients 12A/12B/12C.
As shown in
As previously described, the anti-virus protector protection method is implemented through the use of a transmission pack formatted to allow the data transmission control means or router 14 to scan the transmission pack for preassigned pre-assigned security codes, subscriber/recipient information information, and other authentication information and to transfer data from transmission originators 10A/10B/10C to subscribers/recipients 12A/12B/12C when a transmission pack is authenticated as having the appropriate coded information.
As shown in
The method of the present invention is to protect against the transfer of viruses from a transmission originator 10 10, having a discrete transmission originator code code, to a subscriber/recipient 12 12, having a discrete subscriber/recipient IP address code code, over the data transmission network comprising the steps of of: assigning a discrete security code to the transmission originator 10; generating a transmission pack 20 including the discrete subscriber/recipient IP address code element 22 corresponding to the discrete subscriber/recipient IP address code of the subscriber/recipient 12, a discrete security code element 24 corresponding to the discrete security code assigned to the transmission originator 10, a file extension element 26 26, and a data packet element 28; transmitting the transmission pack 20 to a data transfer control means 14; authenticating the transmission pack 20 with the discrete subscriber/recipient IP address code element 22, discrete security code element 24 24, and discrete transmission originator code; transferring the authenticated transmission pack 20 to the subscriber/recipient 12 12; and isolating the subscriber/recipient 12 from an unauthenticated transmission pack to prevent the transfer of an unauthenticated transmission packet packet, scanned and compared with the authenticating information by the data transfer control means 14 14, to the subscriber/recipient 12.
The discrete security codes and corresponding discrete security code elements 24 may represent one of a plurality of predetermined security levels where a single transmission originator 10 can be preassigned pre-assigned multiple level security codes corresponding to more than one of the levels of security for data as varying sensitivity or security dictates.
In addition, the discrete security code elements 24 can include the identity of the transmission originator 10 assigned the specific discrete security code and corresponding discrete security code element.
As previously mentioned, a discrete extended security or key code element 22 24 is selected and assigned to each transmission originator 10A/10B/10C to correspond to one of the three levels of security. In addition, a transmission originator 10 may be assigned several different discrete security code elements to transmit and transfer data to subscribers/recipients having different security requirements.
Specifically as depicted in FIG. 3,
If the IP address code element 22, encrypted “key” code or discrete security code element 24 (first security level) level), and transmission originator 10 are authenticated by comparison with the authentic transmission pack format, the system establishes a secure data port to transfer or download the data to the subscribers/recipients 12.
If the IP address code element 22, secure “key” code or discrete security code element 24 (second security level) level), and transmission originator 10 are authenticated, the system establishes a controlled data port received at an IP controlled data point and the data are routed to a holding mail box or mini-server 18 at the subscriber/recipient 12 for selective review before downloading by the subscriber/recipient 12.
If the IP address code element 22 and no without a “key” code extention extension 24 (third level of security) are is not authenticated, no data port is opened or established and data is returned to the transmission originator 10.
It will thus be seen that the objects set forth above, among those made apparent from the preceding description description, are efficiently attained and and, since certain changes may be made in the above construction without departing from the scope of the invention, it is intended that all matter contained in the above description or shown in the accompanying drawings shall be interpreted as illustrative and not in a limiting sense.
It is also to be understood that the following claims are intended to cover all of the generic and specific features of the invention herein described, and all statements of the scope of the invention which, as a matter of language, might be said to fall therebetween.
Now that the invention has been described,
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US5416842||Jun 10, 1994||May 16, 1995||Sun Microsystems, Inc.||Method and apparatus for key-management scheme for use with internet protocols at site firewalls|
|US5432850||Jun 30, 1993||Jul 11, 1995||Lannet Data Communications Ltd.||Method and apparatus for secure data transmission|
|US5511122||Jun 3, 1994||Apr 23, 1996||The United States Of America As Represented By The Secretary Of The Navy||Intermediate network authentication|
|US5623600||Sep 26, 1995||Apr 22, 1997||Trend Micro, Incorporated||Virus detection and removal apparatus for computer networks|
|US5898830||Oct 17, 1996||Apr 27, 1999||Network Engineering Software||Firewall providing enhanced network security and user transparency|
|US5930479 *||Oct 21, 1996||Jul 27, 1999||At&T Corp||Communications addressing system|
|US5958051||Jan 9, 1997||Sep 28, 1999||Sun Microsystems, Inc.||Implementing digital signatures for data streams and data archives|
|US5968126 *||Apr 2, 1997||Oct 19, 1999||Switchsoft Systems, Inc.||User-based binding of network stations to broadcast domains|
|US5978567||Jul 27, 1994||Nov 2, 1999||Instant Video Technologies Inc.||System for distribution of interactive multimedia and linear programs by enabling program webs which include control scripts to define presentation by client transceiver|
|US5983350||Sep 18, 1996||Nov 9, 1999||Secure Computing Corporation||Secure firewall supporting different levels of authentication based on address or encryption status|
|US5991810 *||Aug 1, 1997||Nov 23, 1999||Novell, Inc.||User name authentication for gateway clients accessing a proxy cache server|
|US6049877||Jul 16, 1997||Apr 11, 2000||International Business Machines Corporation||Systems, methods and computer program products for authorizing common gateway interface application requests|
|US6065118||Sep 24, 1996||May 16, 2000||Citrix Systems, Inc.||Mobile code isolation cage|
|US6067620||May 28, 1998||May 23, 2000||Holden; James M.||Stand alone security device for computer networks|
|US6092194||Nov 6, 1997||Jul 18, 2000||Finjan Software, Ltd.||System and method for protecting a computer and a network from hostile downloadables|
|US6098172||Sep 12, 1997||Aug 1, 2000||Lucent Technologies Inc.||Methods and apparatus for a computer network firewall with proxy reflection|
|US6105027||Mar 4, 1998||Aug 15, 2000||Internet Dynamics, Inc.||Techniques for eliminating redundant access checking by access filters|
|US6108583||Oct 28, 1998||Aug 22, 2000||Georgia Tech Research Corporation||Adaptive data security system and method|
|US6157721||Aug 12, 1996||Dec 5, 2000||Intertrust Technologies Corp.||Systems and methods using cryptography to protect secure computing environments|
|US6158011||Feb 26, 1999||Dec 5, 2000||V-One Corporation||Multi-access virtual private network|
|US6202081 *||Jul 21, 1998||Mar 13, 2001||3Com Corporation||Method and protocol for synchronized transfer-window based firewall traversal|
|US6229806||Dec 30, 1997||May 8, 2001||Motorola, Inc.||Authentication in a packet data system|
|US6292569||Oct 4, 2000||Sep 18, 2001||Intertrust Technologies Corp.||Systems and methods using cryptography to protect secure computing environments|
|US6324648 *||Dec 23, 1999||Nov 27, 2001||Gte Service Corporation||Secure gateway having user identification and password authentication|
|US6480963||Jan 4, 1999||Nov 12, 2002||Fujitsu Limited||Network system for transporting security-protected data|
|US6510464 *||Dec 23, 1999||Jan 21, 2003||Verizon Corporate Services Group Inc.||Secure gateway having routing feature|
|US6523068 *||Aug 27, 1999||Feb 18, 2003||3Com Corporation||Method for encapsulating and transmitting a message includes private and forwarding network addresses with payload to an end of a tunneling association|
|US6732279||Jan 16, 2003||May 4, 2004||Terry George Hoffman||Anti-virus protection system and method|
|US7028335 *||Aug 27, 1999||Apr 11, 2006||3Com Corporation||Method and system for controlling attacks on distributed network address translation enabled networks|
|US7120802||Aug 6, 2001||Oct 10, 2006||Intertrust Technologies Corp.||Systems and methods for using cryptography to protect secure computing environments|
|US20020040439||Jul 31, 2001||Apr 4, 2002||Kellum Charles W.||Processes systems and networks for secure exchange of information and quality of service maintenance using computer hardware|
|US20020069356||Feb 14, 2001||Jun 6, 2002||Kwang Tae Kim||Integrated security gateway apparatus|
|1||Hoffman, Terry George, U.S. Appl. No. 09/804,796, filed Mar. 14, 2001, entitled "Optical data transfer system-ODTS; Optically based anti-virus protection system-OBAPS."|
|2||Hoffman, Terry George, U.S. Appl. No. 09/804,796, filed Mar. 14, 2001, entitled "Optical data transfer system—ODTS; Optically based anti-virus protection system—OBAPS."|
|3||John Williamson., "Safe at Last?", Global Telephony. Overland Park: Apr. 2001. vol. 9, Iss. 4; p. 35 (5 pages).|
|4||Mendes, Gerald H. , "Next Generation IP takes shape", Business Communications Review. Hinsdale: Mar. 1996. vol. 26, Iss. 3; p. 49 (5 pages).|
|5||*||Zenel, B.,et al, "A general purpose proxy filtering mechanism applied to the mobile environment", Proceedings of the 3rd annual ACM/IEEE international conference on Mobile computing and networking table of contents, 1997, entire document http://portal.acm.org/citation.cfm?doid=262116.262153.|
|U.S. Classification||709/240, 726/21, 713/168, 726/30, 709/238, 726/22, 709/232, 709/239|
|International Classification||H04L9/00, H04L29/06|
|Cooperative Classification||G06F21/566, H04L63/145, H04L63/0428, G06F21/564|
|European Classification||G06F21/56C, G06F21/56B4, H04L63/04B, H04L63/14D1|
|Sep 27, 2007||AS||Assignment|
Owner name: TERMAN SOFTWARE APPLICATIONS L.L.C., DELAWARE
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HOFFMAN, TERRY GEORGE;REEL/FRAME:019881/0519
Effective date: 20070814
|Jul 26, 2011||CC||Certificate of correction|
|Sep 23, 2011||FPAY||Fee payment|
Year of fee payment: 8
|Apr 2, 2013||CC||Certificate of correction|
|Oct 27, 2015||FPAY||Fee payment|
Year of fee payment: 12
|Dec 18, 2015||AS||Assignment|
Owner name: CHARTOLEAUX KG LIMITED LIABILITY COMPANY, DELAWARE
Free format text: MERGER;ASSIGNOR:TERMAN SOFTWARE APPLICATIONS L.L.C.;REEL/FRAME:037333/0536
Effective date: 20150812