RU91206U1 - HARDWARE ANTI-VIRUS - Google Patents

Abstract

1. A hardware antivirus that checks the storage medium for the contents of the malware component, containing at least one interface to which the storage medium is connected, the data verification of the storage medium is carried out by the central processor of the antivirus, which uses random access memory, while the main operation of the antivirus is in checking the data contained on the storage medium, if a malware component is detected in the data, the data is deleted from the storage medium. ! 2. The hardware antivirus according to claim 1 is built into the storage medium controller. ! 3. The hardware antivirus according to claim 1, which is connected to a computer system.

Description

The utility model relates to methods of protection against malicious software, and in particular the identification of components of malicious software. It is based on the creation of a hardware antivirus system for the treatment of infected computer systems.

Currently, there are many different antiviruses, but they are all part of the operating system. Antivirus software (hereinafter referred to as software) usually uses two different methods to perform its tasks: scanning files to find known viruses and detecting suspicious behavior of any of the programs similar to the behavior of an infected program. Since the main stream of malicious components is written to hard drives, the need to scan hard drives is very popular.

Existing antiviruses use the resources of shared RAM and processor on a par with other applications, including malware. Antiviruses installed in the OS have both administrator and user rights, but some components of malware also have the same rights. Therefore, having equal rights with the malware, the antivirus cannot remove one or another of its components. The main example of such malware is rootkits. A rootkit is a set of utilities or a special kernel module that an cracker installs on a hacked computer system immediately after he receives administrator rights. A set of utilities, as a rule, includes a variety of functions for "sweeping the traces" of an invasion of the system. The rootkit allows an attacker to gain a foothold in the hacked system and hide the traces of his stay by hiding files, processes and the presence of the rootkit in the system. Thus, it can hide not only from the user, but also from antiviruses. There is also the possibility that by gaining more privileged rights, the rootkit can somehow damage the antivirus or spoil its performance. There are various methods to combat rootkits, however, there is no way that is guaranteed to be able to remove the rootkit from the system.

Before using a conventional antivirus, you must first install it in the OS. There is also a problem loading system resources while the antivirus is running, since it uses shared resources. Gradually, there is a need to create an antivirus that could remove malware, avoiding access and rights issues, as well as not loading the computer system as a whole.

There are also options for the execution of antiviruses in the form of hardware systems that can avoid many of the disadvantages of software antiviruses, for example, in the form of using computer resources. The Gatekeeper solution offered by Yoggie (Card Pro and Pico) offers protection against network attacks and viruses transmitted through the network (http://www.yoggie.com/Gatekeeper-Card-Pro). At the same time, Gatekeeper does not provide protection against rootkits, since this solution only works as a filter with data received through the network. You need to understand that such firmware and hardware (firmware) are not able to work with all devices that can be used on modern computers. Using Gatekeeper as a filter for data, it is impossible to intercept all malicious programs due to the fact that this solution uses traditional anti-virus products, which do not give a 100% guarantee of detection of malicious programs. Those malicious programs that went through the filter and got to the hard drive can no longer be detected and deleted using this solution.

The method of operation of the Gatekeeper device is described in patent application US 20080276302. This application discusses options for imposing a specific security policy on the computer (host) during data transfer. This application does not consider treatment options for rootkits and other malicious programs that hide their presence in the system.

Thus, a solution is needed that would be free from the disadvantages of software antiviruses, and could bypass the shortcomings of hardware solutions, allowing you to control both the incoming data stream and checking the storage media for malicious programs. Therefore, to solve the above problems, a useful model is presented, implemented in a hardware antivirus system and a method for updating systems for the effective treatment of computer systems. The utility model is based on the creation of hardware antivirus for the treatment of malware.

The system connects directly to the storage medium. It can be made in the form of a separate device with the ability to connect this device to a computer, performing in this case the function of a transparent filter in the gap of the interface cable. Thus, the computer will not suspect that the data that it is trying to write to the storage medium is checked. Accordingly, the components of the malware will also not record the tracking of their actions.

Next, descriptions of the hardware antivirus system and the method for updating it will be considered in detail.

Figure 1 shows a structural block diagram of a hardware antivirus system in the General case in accordance with an example implementation. The system of hardware antivirus 130, when connected to a storage medium, proceeds to scan the data contained on the storage medium by detecting and neutralizing various malicious programs. When connected to the system bus 110 of a personal computer, a hardware antivirus works with the storage medium 120 in the transparent filter mode. The hardware antivirus system has its own central processor 140, random access memory 150 and a power source. Thus, the system will not require the common resources of a personal computer; it will work independently without loading the system, as almost all modern anti-virus solutions do now.

When a storage medium 120 is connected to a hardware antivirus, algorithms are started to check the data recorded in it for the content of malware, during which they eliminate the malware found. This method solves the problem of hidden system files that are on the storage medium, because For data processing, an independent scan of all data of the storage medium is used. In this case, during the scanning of the storage medium when examining the file, it can be understood that the first sector of the scanned file describes the executable file and after that it should be taken under control.

Figure 2 shows a block diagram of the algorithm of the hardware antivirus system in the transparent filter mode. After creating the record that needs to be recorded on the storage medium, at step 210, the personal computer transmits it to the controller of the storage medium through the computer bus at step 220 (in a private embodiment). The hardware antivirus system, when the computer interacts with the storage medium controller, starts scanning the transmitted data for malware in step 225. If the transmitted data does not contain viruses in step 230, then the data is written to the storage medium in step 240. Otherwise, there are several reaction approaches to detect malicious components. The system can simulate recording on a storage medium, but in fact it does not. The malicious component will assume that the operation will be successful, but in fact no changes will be made. Another option for responding to viruses is to send a write error message to the computer system. Thus, the computer system will receive information that there was a failure during recording at step 235.

There are several different options for implementing the operation of a hardware antivirus system in the transparent filter mode with low-level data that goes through it. One of them is the study of the contents of sectors during their transmission. But this method alone contains some disadvantages associated with the limited capabilities of the system. It turns out that the system scans data only during its reading / writing. But there are many hidden files that are masked in the system. These files will not be recognized by the hardware antivirus system, as they will not perform read / write actions. Accordingly, they will not be recognized as malicious.

There is also another way of processing data with hardware antivirus in transparent filter mode - this is working with a conventional antivirus. The job is that the antivirus 310, shown in Figure 3, has a set of encrypted commands with which it can give certain instructions to the hardware antivirus system 320. This will give antivirus 310 access to the storage medium 330 bypassing the user rights hierarchy. In this situation, antivirus 310 can find a rootkit or other component of malware on the data medium 330, which it cannot bypass or delete due to the fact that in many operating systems there is a restriction of rights for applications. Even having administrator rights, antivirus 310 cannot delete a rootkit that has the same rights. But in conjunction with the system of hardware antivirus 320, which works outside the operating system of a personal computer, and accordingly, the rights policy of the operating system does not apply to it, this way the maximum efficiency of conventional antivirus 310 is achieved due to the function of removing rootkits and other components of malware.

One of the main aspects of the anti-virus operation is the availability of anti-virus database updates. Anti-virus databases should always be up to date to deal with the latest malware. The update situation can be addressed in several ways. In one particular embodiment, when a hardware antivirus system is running along with a regular antivirus, updates will be downloaded by a regular antivirus, but they will not be required by a hardware antivirus system. In this case, the hardware antivirus system plays a secondary role and is designed to remove rootkits found by a conventional antivirus. In another particular embodiment depicted in FIG. 4, a special utility 410 is used to download updates, which is installed on a user computer system. In this case, the hardware antivirus system is logically divided into two parts: the main part 420, which consists of working anti-virus databases and code, and the update part 430. The hardware antivirus system and the personal computer are connected using the utility 410, which starts to install when new updates are downloaded connection to the hardware antivirus system, sending it some secret code (or an encrypted key) that identifies it as a trusted application. In turn, the hardware antivirus system sends a response about successful authentication to utility 410, and then utility 410 starts sending updates to update area 430. At the same time, the working databases and code in area 420 are not affected. After loading the databases, utility 410 reports that the updates have been downloaded and are ready for further use. The next step is to verify the databases inside the hardware antivirus system itself, which may include in a particular version methods for comparing electronic digital signatures, checksums, signatures, etc. The system does this internally, so no malware components can interfere with the verification process, as well as understand the verification algorithm. In case of successful verification, updates are downloaded from area 430 to the area of working databases and code 420. This two-stage method protects the hardware antivirus system from downloading malicious code or outdated databases. Even if malware tries to download malicious code instead of databases, then verification within the hardware antivirus system will not accept them as working. Thus, the system will not be damaged. Old databases will also not be loaded, because the verification also checks the relevance of the databases.

Figure 5 shows a block diagram of the update algorithm for a hardware antivirus system in accordance with an example implementation from a utility installed on a personal computer. Utility 410 starts downloading updates at a certain frequency in step 510. After downloading the updates, in step 520 the utility creates a secret code (key) that identifies it as a trusted application and sends it to the hardware antivirus system. At step 525, the utility receives a response about the authentication result. In case of successful authentication, the utility starts transmitting the downloaded updates to the hardware antivirus system in step 535. After completing the data transfer, in step 540 the utility transmits a message about the successful data transfer to the hardware antivirus system. Next, the second part of the processing and loading of anti-virus databases begins, which is described in Fig.6.

6 also shows a block diagram of an update algorithm for a hardware antivirus system in accordance with an example implementation. The hardware antivirus system receives the secret code (key) from the personal computer application in step 610. After receiving the code and identifying the application as a trusted utility, the hardware antivirus system sends a response to it about successful authentication in step 620. Then, the utility transfers the new anti-virus databases to the hardware system updates area antivirus 430. At the end of the database transfer, the utility informs the system about the readiness of the databases for further download at step 625. After that, the system verifies the received anti-virus databases at step 630. If the verification was successful at step 635, that is, the transmitted data is anti-virus databases and they are current, then they are overwritten from the update area 430 to the area of working databases 420 at step 640. If the verification of the databases failed, then they they are removed from the update area 430 in step 650. On this, the download of anti-virus databases is considered complete.

Claims (3)

1. A hardware antivirus that checks the storage medium for the contents of the malware component, containing at least one interface to which the storage medium is connected, the data verification of the storage medium is carried out by the central processor of the antivirus, which uses random access memory, while the main operation of the antivirus is in checking the data contained on the storage medium, if a malware component is detected in the data, the data is deleted from the storage medium. 2. The hardware antivirus according to claim 1 is built into the storage medium controller. 3. The hardware antivirus according to claim 1, which is connected to a computer system.