New! View global litigation for patent families

EP1137992A1 - Method and apparatus for isolating a computer system upon detection of viruses and similar data - Google Patents

Method and apparatus for isolating a computer system upon detection of viruses and similar data

Info

Publication number
EP1137992A1
EP1137992A1 EP19980963862 EP98963862A EP1137992A1 EP 1137992 A1 EP1137992 A1 EP 1137992A1 EP 19980963862 EP19980963862 EP 19980963862 EP 98963862 A EP98963862 A EP 98963862A EP 1137992 A1 EP1137992 A1 EP 1137992A1
Authority
EP
Grant status
Application
Patent type
Prior art keywords
data
channel
entity
virus
signal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP19980963862
Other languages
German (de)
French (fr)
Other versions
EP1137992A4 (en )
Inventor
Steven D. Mann
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
RVT Technologies Inc
Original Assignee
RVT TECHNOLOGIES INC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82Protecting input, output or interconnection devices
    • G06F21/85Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/554Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562Static detection
    • G06F21/564Static detection by virus signature recognition
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/567Computer malware detection or handling, e.g. anti-virus arrangements using dedicated hardware
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/81Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations

Abstract

An apparatus (10) for isolating a data receiving entity (30) from a data sending entity (20) includes a first data channel (22), coupled to the data sending entity, and a second data channel (32), coupled to the data receiving entity. A processor (30) is programmed to compare a plurality of data words received from the first data channel to at least one data word characteristic of a data virus and to assert a control signal when a data word received from the first data channel corresponds to a data word characteristic of a data virus. An optical isolator (14) is capable of isolating the first data channel from the second data channel when the processor detects a data virus. A controllable power supply (54) is responsive to the control signal (42) from the processor and coupled to the optical isolator, which provides power to the optical isolator only when the control signal from the processor is not asserted.

Description

METHOD AND APPARATUS FOR ISOLATING A COMPUTER SYSTEM UPON DETECTION OF VIRUSES AND SIMILAR DATA

BACKGROUND OF THE INVENTION

1. Field of the Invention:

This invention relates to computer systems. More particularly, this invention relates to a method and apparatus for isolating a computer system upon detection of a virus and similar data.

2. The Prior Art:

Recently, transmission of data viruses over the Internet has become a serious concern for Internet users. To reduce the concern, several methods are used to isolate computers from the Internet while the users are in local mode. However, when users of such methods are in a connected mode, they become prey to any virus that they may unwittingly download.

Computer virus scanners are common and can be used to detect a virus once it is downloaded. However, such scanners cannot prevent the virus from being downloaded. They can only aid in the identification of a virus once it has already infected the user's computer.

Nowhere does the prior art disclose a method or apparatus for detecting a virus as it is being received from a network and isolating the user's computer from the Internet when an incoming virus is detected. SUMMARY OF THE INVENTION

The above-noted disadvantages of the prior art are overcome by the present invention, which in one aspect is an apparatus for isolating a data receiving entity from a data sending entity. A first data channel is coupled to the data sending entity and a second data channel is coupled to the data receiving entity. A processor is operationally coupled to the first data channel and detects a data virus received from the first data channel. An isolation circuit that is responsive to the processor couples the first data channel to the second data channel when the processor does not detect a data virus and isolates the first data channel from the second data channel when the processor detects a data virus.

In another aspect, the invention includes a first data channel coupled to the data sending entity and a second data channel coupled to the data receiving entity. A processor that is programmed to compare a plurality of data words received from the first data channel to at least one data word characteristic of a data virus asserts a control signal when a data word received from the first data channel corresponds to a data word characteristic of a data virus. A memory, that is operationally coupled to the processor, stores at least one data word characteristic of a data virus. The memory presents to the processor at least one data word characteristic of a data virus and an input buffer stores data received by the processor from the first data channel. An optical isolator, coupled to the first data channel and the second data channel and having an enable signal input, is capable of isolating the first data channel from the second data channel when the enable signal input is not asserted and is also capable of placing the first data channel and the second data channel in optical communication with each other when the enable signal input is asserted. A controllable power supply that is responsive to the control signal from the processor is coupled to the enable signal input of the optical isolator. The power supply asserts the enable signal when the control signal is not asserted and does not assert the enable signal when the control signal is asserted, thereby causing the optical isolator to isolate the first data channel from the second data channel.

In yet another aspect, the invention is a method for isolating data receiving entity from a data sending entity. When a data virus received from the data sending entity is detected, the data sending entity is isolated from the data receiving entity.

An advantage of the invention is that it prevents a data receiving entity, such as a computer, from receiving a virus from a data sending entity, such as a computer network.

A further advantage of the invention is that it isolates the data sending entity from the data receiving entity without disrupting normal operation of either entity.

These and other advantages will become apparent from the following description of the preferred embodiment taken in conjunction with the following drawings, although variations and modifications may be effected without departing from the spirit and scope of the novel concepts of the disclosure.

BRIEF DESCRIPTION OF THE FIGURES OF THE DRAWINGS

FIG. 1 is a simplified schematic diagram of the invention.

FIG. 2 is a detailed schematic diagram of the invention.

DETAILED DESCRIPTION OF THE INVENTION

A preferred embodiment of the invention is now described in detail. Referring to the drawings, like numbers indicate like parts throughout the views. As used in the description herein and throughout the claims that follow, "a," "an," and "the" includes plural reference unless the context clearly dictates otherwise. Also, as used in the description herein and throughout the claims that follow, the meaning of "in" includes "in" and "on" unless the context clearly dictates otherwise.

As shown in FIG. 1, the apparatus 10 of the invention evaluates data received from a data sending entity 20, such as the Internet, by a data receiving entity 30, such as a personal computer or even a local area network. The data is received via a first data channel 22 coupled to the data sending entity 20 and a second data channel 32 coupled to the data receiving entity. A data comparitor 40 is operationally coupled to the first data channel 22 and is used to detect data viruses received from the first data channel 22. When a virus is detected, a data isolator 60, that is responsive to a control signal 42 from the data comparator 40, isolates the first data channel 22 from the second data channel 32. Thus, viruses are detected and prevented from being received by the data receiving entity 30.

As shown in FIG. 2, the apparatus 10 of one preferred embodiment of the invention interfaces with a peripheral control interface (PCI) 12 of a data receiving entity 30, such as a personal computer, to provide isolation from a data sending entity 20, such as the Internet. The data sending entity 20 is connected to an input interface 24, such as a standard PBX interface, via a first data channel 22. The data stream received by the input interface 24 is demodulated using a demodulator circuit 26 so as to conform to the data format of the data receiving entity 30.

The data stream is then fed into the data comparator 40. In the comparitor circuit 40, a UART chip 46 formats the incoming serial data into parallel data words and a processor 44, such as a PCI host controller, using an asynchronous transfer mode segmentation and reassembly, compares the parallel data with known virus signatures stored in a memory 48, such as an EEPROM. The processor 44, which is controlled by a control memory 50, buffers data from the UART chip 46 in a memory chip 52 as it awaits virus scanning analysis.

After the processor 44 has analyzed an incoming word, it is then sent to the data isolator 60 for eventual transfer to the data receiving entity 30. The data isolator 60 comprises an optical isolator 62 that is driven by a power enable signal 66 received from a power supply conditioning ISO drive 64. The power supply conditioning ISO drive 64 receives power from a power up control logic circuit 54 which receives power from a power line 74 in the PCI bus 12.

If no virus is found, the data stream is transferred through the optical isolator 62 to a modulation level shifting circuit 68, that conditions the data for receipt by the data receiving entity 30, to a modem interface 34. The modem interface 34 provides protocol matching to the input interface 24 and sends the data to the data receiving entity 30.

When a virus is detected in the incoming data stream, a control line 42 from the processor 44 causes the power up control logic circuit 54 to cause the power supply conditioning ISO drive 64 to cut off power to the optical isolator 62, thereby causing the optical isolator 62 to prevent passage of data therethrough. A modem standby circuit 36 then takes over and simulates protocol exchanges with the input interface 24, thereby preventing an abnormal disconnect.

During power-up, the processor 40 runs the system through a self checking routine. If any system abnormalities are detected, an interrupt line 70 is asserted. The interrupt line 70 passes through an optical isolator 14 to ensure unidirectional data transmission to the PCI bus 12. The power up control logic circuit 54 also performs a self check, a battery reference 56 is compared to the value on the incoming power line 74 from the PCI bus 12, and if the system is improperly powered, an interrupt line 72 is asserted. The interrupt line 72 is also passed through an optical isolator 16 that ensures that the interrupt line 72 is unidirectional to the PCI bus 12.

The above described embodiment is given as an illustrative example only. It will be readily appreciated that many deviations may be made from the specific embodiment disclosed in this specification without departing from the invention. Accordingly, the scope of the invention is to be determined by the claims below rather than being limited to the specifically described embodiment above.

Claims

CLAIMSWhat is claimed is:
1. An apparatus for isolating data receiving entity from a data sending entity, comprising: a. a first data channel, coupled to the data sending entity; b. a second data channel, coupled to the data receiving entity; c. means, operationally coupled to the first data channel, for detecting a data virus received from the first data channel; and d. means, responsive to the detecting means, for coupling the first data channel to the second data channel when the detecting means does not detect a data virus and for isolating the first data channel from the second data channel when the detecting means detects a data virus.
2. An apparatus for isolating data receiving entity from a data sending entity, comprising: a. a first data channel, coupled to the data sending entity; b. a second data channel, coupled to the data receiving entity; c. means for comparing a plurality of data words received from the first data channel to at least one data word characteristic of a data virus and for asserting a control signal when a data word received from the first data channel corresponds to a data word characteristic of a data virus; and d. means, coupled to the first data channel and the second data channel and operationally coupled to the control signal, for isolating the first data channel from the second data channel when the control signal is asserted and for placing the first data channel and the second data channel in optical communication when the control signal is not asserted.
3. The apparatus of Claim 2, wherein the comparing means comprises: a. a processor; and b. means for presenting to the processor at least one data word characteristic of a data virus.
4. The apparatus of Claim 3, wherein the processor comprises a PCI host controller.
5. The apparatus of Claim 3, wherein the presenting means comprises a memory, operationally coupled to the processor, that stores at least one data word characteristic of a data virus.
6. The apparatus of Claim 3, further comprising an input buffer that stores data received by the processor
7. The apparatus of Claim 2, wherein data on the first data channel is transmitted in a serial format and wherein the apparatus further comprises means for converting segments of serial data received from the first data channel to data in a parallel format.
8. The apparatus of Claim 2, wherein the isolating means comprises an optical isolator.
9. The apparatus of Claim 8, further comprising a controllable power supply responsive to the control signal from the comparing means, the power supply generating an enable signal when the control signal is not asserted, wherein the optical isolator is powered by the enable signal so that when the optical isolator receives power from the enable signal, the first data channel and the second data channel are in optical communication with each other.
0. An apparatus for isolating data receiving entity from a data sending entity, comprising: a. a first data channel, coupled to the data sending entity; b. a second data channel, coupled to the data receiving entity; c. a processor that is programmed to compare a plurality of data words received from the first data channel to at least one data word characteristic of a data virus and to assert a control signal when a data word received from the first data channel corresponds to a data word characteristic of a data virus; d. a memory, operationally coupled to the processor, that stores at least one data word characteristic of a data virus that presents to the processor at least one data word characteristic of a data virus; e. an input buffer that stores data received by the processor from the first data channel; f. an optical isolator, coupled to the first data channel and the second data channel and having an enable signal input, that is capable of isolating the first data channel from the second data channel when the enable signal input is not asserted and is capable of placing the first data channel and the second data channel in optical communication with each other when the enable signal input is asserted; and g. a controllable power supply responsive to the control signal from the processor and coupled to the enable signal input of the optical isolator, the power supply asserting the enable signal when the control signal is not asserted and the power supply not asserting the enable signal when the control signal is asserted, thereby causing the optical isolator to isolate the first data channel from the second data channel.
11. The apparatus of Claim 10, wherein the processor comprises a PCI host controller.
12. The apparatus of Claim 10, wherein data on the first data channel is transmitted in a serial format and wherein the apparatus further comprises means for converting segments of serial data received from the first data channel to data in a parallel format.
13. A method for isolating data receiving entity from a data sending entity, comprising: a detecting a data virus received from the data sending entity; and b. isolating the data sending entity from the data receiving entity upon detecting a data virus received from the data sending entity.
EP19980963862 1998-12-11 1998-12-11 Method and apparatus for isolating a computer system upon detection of viruses and similar data Withdrawn EP1137992A4 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/US1998/026377 WO2000036515A1 (en) 1998-12-11 1998-12-11 Method and apparatus for isolating a computer system upon detection of viruses and similar data

Publications (2)

Publication Number Publication Date
EP1137992A1 true true EP1137992A1 (en) 2001-10-04
EP1137992A4 true EP1137992A4 (en) 2003-02-05

Family

ID=22268464

Family Applications (1)

Application Number Title Priority Date Filing Date
EP19980963862 Withdrawn EP1137992A4 (en) 1998-12-11 1998-12-11 Method and apparatus for isolating a computer system upon detection of viruses and similar data

Country Status (3)

Country Link
EP (1) EP1137992A4 (en)
CA (1) CA2360782A1 (en)
WO (1) WO2000036515A1 (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7263616B1 (en) * 2000-09-22 2007-08-28 Ge Medical Systems Global Technology Company, Llc Ultrasound imaging system having computer virus protection
DE10064658B4 (en) * 2000-12-22 2004-04-08 Siemens Ag Computer arrangement that can be connected to a data transmission network
FI113499B (en) * 2002-09-12 2004-04-30 Jarmo Talvitie Security system, method and device for the fight against computer viruses, as well as to isolate data
RU2462750C2 (en) * 2004-06-21 2012-09-27 Анатолий Владимирович Копытко Method to protect computer equipment against viral codes

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5319776A (en) * 1990-04-19 1994-06-07 Hilgraeve Corporation In transit detection of computer virus with safeguard
WO1995033237A1 (en) * 1994-06-01 1995-12-07 Quantum Leap Innovations Inc. Computer virus trap
GB2322035A (en) * 1997-02-05 1998-08-12 Stuart Justin Nash Computer connected to telecommunication network modem via buffer computer

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5826013A (en) * 1995-09-28 1998-10-20 Symantec Corporation Polymorphic virus detection module
US5832208A (en) * 1996-09-05 1998-11-03 Cheyenne Software International Sales Corp. Anti-virus agent for use with databases and mail servers

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5319776A (en) * 1990-04-19 1994-06-07 Hilgraeve Corporation In transit detection of computer virus with safeguard
WO1995033237A1 (en) * 1994-06-01 1995-12-07 Quantum Leap Innovations Inc. Computer virus trap
GB2322035A (en) * 1997-02-05 1998-08-12 Stuart Justin Nash Computer connected to telecommunication network modem via buffer computer

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of WO0036515A1 *

Also Published As

Publication number Publication date Type
WO2000036515A1 (en) 2000-06-22 application
EP1137992A4 (en) 2003-02-05 application
CA2360782A1 (en) 2000-06-22 application

Similar Documents

Publication Publication Date Title
US6327625B1 (en) FIFO-based network interface supporting out-of-order processing
US6526446B1 (en) Hardware only transmission control protocol segmentation for a high performance network interface card
US20050259678A1 (en) Network interface controller circuitry
US20050268082A1 (en) Method and apparatus to boot system from the USB port
US5678059A (en) Technique for time-sharing a microprocessor between a computer and a modem
US20030056051A1 (en) System and method for connecting a universal serial bus device to a host computer system
US20060236143A1 (en) Communication control apparatus, communication control system, power-saving control method, power-saving control program, and recording medium for recording the program
US5812875A (en) Apparatus using a state device and a latching circuit to generate an acknowledgement signal in close proximity to the request signal for enhancing input/output controller operations
US20070199058A1 (en) Method of using a security token
US6678833B1 (en) Protection of boot block data and accurate reporting of boot block contents
US20040199790A1 (en) Use of a programmable network processor to observe a flow of packets
US5815571A (en) Computer system with secured data paths and method of protection
US5548782A (en) Apparatus for preventing transferring of data with peripheral device for period of time in response to connection or disconnection of the device with the apparatus
US6216183B1 (en) Apparatus and method for securing information entered upon an input device coupled to a universal serial bus
US20090064326A1 (en) Method and a system for advanced content security in computer networks
US6772338B1 (en) Device for transfering data between an unconscious capture device and another device
US20050077355A1 (en) Card recognition system for recognizing standard card and non-standard card
US20030233497A1 (en) DMA controller and method for checking address of data to be transferred with DMA
US20040255070A1 (en) Inter-integrated circuit router for supporting independent transmission rates
US20090313493A1 (en) Information processing apparatus and control method therefor
US20080196085A1 (en) Communication Control Apparatus
US20030200445A1 (en) Secure computer system using SIM card and control method thereof
US5958029A (en) Method and system for efficient message validation
US6098120A (en) Peripheral sharing system using a bus bridge to emulate peripherals on a first bus to a host on a second bus
US20090293126A1 (en) Malware detection device

Legal Events

Date Code Title Description
AK Designated contracting states:

Kind code of ref document: A1

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE

17P Request for examination filed

Effective date: 20010711

DAX Request for extension of the european patent (to any country) deleted
A4 Despatch of supplementary search report

Effective date: 20021219

RIC1 Classification (correction)

Ipc: 7G 06F 12/14 A

Ipc: 7G 06F 1/00 B

18W Withdrawn

Effective date: 20030224

REG Reference to a national code

Ref country code: HK

Ref legal event code: WD

Ref document number: 1038270

Country of ref document: HK