WO1999021317A2 - Method and apparatus for isolating a computer system upon detection of viruses and similar data - Google Patents
Method and apparatus for isolating a computer system upon detection of viruses and similar data Download PDFInfo
- Publication number
- WO1999021317A2 WO1999021317A2 PCT/US1998/022276 US9822276W WO9921317A2 WO 1999021317 A2 WO1999021317 A2 WO 1999021317A2 US 9822276 W US9822276 W US 9822276W WO 9921317 A2 WO9921317 A2 WO 9921317A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- data
- data channel
- channel
- virus
- processor
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/567—Computer malware detection or handling, e.g. anti-virus arrangements using dedicated hardware
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/004—Error avoidance
Definitions
- This invention relates to computer systems. More particularly, this invention relates to a method and apparatus for isolating a computer system upon detection of a virus and similar data.
- Computer virus scanners are common and can be used to detect a virus once it is downloaded. However, such scanners cannot prevent the virus from being downloaded. They can only aid in the identification of a virus once it has already infected the user's computer.
- a first data channel is coupled to the data sending entity and a second data channel is coupled to the data receiving entity.
- a processor is operationally coupled to the first data channel and detects a data virus received from the first data channel.
- An isolation circuit that is responsive to the processor couples the first data channel to the second data channel when the processor does not detect a data virus and isolates the first data channel from the second data channel when the processor detects a data virus.
- the invention includes a first data channel coupled to the data sending entity and a second data channel coupled to the data receiving entity.
- a processor that is programmed to compare a plurality of data words received from the first data channel to at least one data word characteristic of a data virus asserts a control signal when a data word received from the first data channel corresponds to a data word characteristic of a data virus.
- a memory that is operationally coupled to the processor, stores at least one data word characteristic of a data virus. The memory presents to the processor at least one data word characteristic of a data virus and an input buffer stores data received by the processor from the first data channel.
- An optical isolator coupled to the first data channel and the second data channel and having an enable signal input, is capable of isolating the first data channel from the second data channel when the enable signal input is not asserted and is also capable of placing the first data channel and the second data channel in optical communication with each other when the enable signal input is asserted.
- a controllable power supply that is responsive to the control signal from the processor is coupled to the enable signal input of the optical isolator. The power supply asserts the enable signal when the control signal is not asserted and does not assert the enable signal when the control signal is asserted, thereby causing the optical isolator to isolate the first data channel from the second data channel.
- the invention is a method for isolating data receiving entity from a data sending entity.
- the data sending entity is isolated from the data receiving entity.
- An advantage of the invention is that it prevents a data receiving entity, such as a computer, from receiving a virus from a data sending entity, such as a computer network.
- a further advantage of the invention is that it isolates the data sending entity from the data receiving entity without disrupting normal operation of either entity.
- FIG. 1 is a simplified schematic diagram, of the invention.
- FIG. 2 is a detailed schematic diagram of the invention.
- the apparatus 10 of the invention evaluates data received from a data sending entity 20, such as the Internet, by a data receiving entity 30, such as a personal computer or even a local area network.
- the data is received via a first data channel 22 coupled to the data sending entity 20 and a second data channel 32 coupled to the data receiving entity.
- a data comparitor 40 is operationally coupled to the first data channel 22 and is used to detect data viruses received from the first data channel 22.
- a data isolator 60 that is responsive to a control signal 42 from the data comparator 40, isolates the first data channel 22 from the second data channel 32.
- viruses are detected and prevented from being received by the data receiving entity 30.
- the apparatus 10 of one preferred embodiment of the invention interfaces with a peripheral control interface (PCI) 12 of a data receiving entity 30, such as a personal computer, to provide isolation from a data sending entity 20, such as the Internet.
- the data sending entity 20 is connected to an input interface 24, such as a standard PBX interface, via a first data channel 22.
- the data stream received by the input interface 24 is demodulated using a demodulator circuit 26 so as to conform to the data format of the data receiving entity 30.
- a UART chip 46 formats the incoming serial data into parallel data words and a processor 44, such as a PCI host controller, using an asynchronous transfer mode segmentation and reassembly, compares the parallel data with known virus signatures stored in a memory 48, such as an EEPROM.
- the processor 44 which is controlled by a control memory 50, buffers data from the UART chip 46 in a memory chip 52 as it awaits virus scanning analysis.
- the data isolator 60 comprises an optical isolator 62 that is driven by a power enable signal 66 received from a power supply conditioning ISO drive 64.
- the power supply conditioning ISO drive 64 receives power from a power up control logic circuit 54 which receives power from a power line 74 in the PCI bus 12.
- the data stream is transferred through the optical isolator 62 to a modulation level shifting circuit 68, that conditions the data for receipt by the data receiving entity 30, to a modem interface 34.
- the modem interface 34 provides protocol matching to the input interface 24 and sends the data to the data receiving entity 30.
- a control line 42 from the processor 44 causes the power up control logic circuit 54 to cause the power supply conditioning ISO drive 64 to cut off power to the optical isolator 62, thereby causing the optical isolator 62 to prevent passage of data therethrough.
- a modem standby circuit 36 then takes over and simulates protocol exchanges with the input interface 24, thereby preventing an abnormal disconnect.
- the processor 40 runs the system through a self checking routine. If any system abnormalities are detected, an interrupt line 70 is asserted.
- the interrupt line 70 passes through an optical isolator 14 to ensure unidirectional data transmission to the PCI bus 12.
- the power up control logic circuit 54 also performs a self check, a battery reference 56 is compared to the value on the incoming power line 74 from the PCI bus 12, and if the system is improperly powered, an interrupt line 72 is asserted.
Abstract
Description
Claims
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AU13623/99A AU1362399A (en) | 1997-10-22 | 1998-10-21 | Method and apparatus for isolating a computer system upon detection of viruses and similar data |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US08/955,912 US6003132A (en) | 1997-10-22 | 1997-10-22 | Method and apparatus for isolating a computer system upon detection of viruses and similar data |
US08/955,912 | 1997-10-22 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO1999021317A2 true WO1999021317A2 (en) | 1999-04-29 |
WO1999021317A3 WO1999021317A3 (en) | 2001-12-20 |
Family
ID=25497525
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US1998/022276 WO1999021317A2 (en) | 1997-10-22 | 1998-10-21 | Method and apparatus for isolating a computer system upon detection of viruses and similar data |
Country Status (3)
Country | Link |
---|---|
US (1) | US6003132A (en) |
AU (1) | AU1362399A (en) |
WO (1) | WO1999021317A2 (en) |
Families Citing this family (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2000034867A1 (en) | 1998-12-09 | 2000-06-15 | Network Ice Corporation | A method and apparatus for providing network and computer system security |
US7346929B1 (en) | 1999-07-29 | 2008-03-18 | International Business Machines Corporation | Method and apparatus for auditing network security |
US8006243B2 (en) | 1999-12-07 | 2011-08-23 | International Business Machines Corporation | Method and apparatus for remote installation of network drivers and software |
AU2001257400A1 (en) | 2000-04-28 | 2001-11-12 | Internet Security Systems, Inc. | System and method for managing security events on a network |
US7162649B1 (en) | 2000-06-30 | 2007-01-09 | Internet Security Systems, Inc. | Method and apparatus for network assessment and authentication |
GB2357939B (en) * | 2000-07-05 | 2002-05-15 | Gfi Fax & Voice Ltd | Electronic mail message anti-virus system and method |
US7093239B1 (en) | 2000-07-14 | 2006-08-15 | Internet Security Systems, Inc. | Computer immune system and method for detecting unwanted code in a computer system |
US9027121B2 (en) | 2000-10-10 | 2015-05-05 | International Business Machines Corporation | Method and system for creating a record for one or more computer security incidents |
US7130466B2 (en) | 2000-12-21 | 2006-10-31 | Cobion Ag | System and method for compiling images from a database and comparing the compiled images with known images |
AU2002243763A1 (en) | 2001-01-31 | 2002-08-12 | Internet Security Systems, Inc. | Method and system for configuring and scheduling security audits of a computer network |
US6748542B2 (en) * | 2001-03-12 | 2004-06-08 | Pathlock Corporation | Timed disconnect switch for data and telephone circuits |
US7657419B2 (en) | 2001-06-19 | 2010-02-02 | International Business Machines Corporation | Analytical virtual machine |
WO2003058451A1 (en) | 2002-01-04 | 2003-07-17 | Internet Security Systems, Inc. | System and method for the managed security control of processes on a computer system |
US20030229810A1 (en) * | 2002-06-05 | 2003-12-11 | Bango Joseph J. | Optical antivirus firewall for internet, LAN, and WAN computer applications |
US7526809B2 (en) * | 2002-08-08 | 2009-04-28 | Trend Micro Incorporated | System and method for computer protection against malicious electronic mails by analyzing, profiling and trapping the same |
US20040078580A1 (en) * | 2002-10-18 | 2004-04-22 | Trend Micro Incorporated | Antivirus network system and method for handling electronic mails infected by computer viruses |
US20040093514A1 (en) * | 2002-11-08 | 2004-05-13 | International Business Machines Corporation | Method for automatically isolating worm and hacker attacks within a local area network |
US7913303B1 (en) | 2003-01-21 | 2011-03-22 | International Business Machines Corporation | Method and system for dynamically protecting a computer system from attack |
US7657938B2 (en) | 2003-10-28 | 2010-02-02 | International Business Machines Corporation | Method and system for protecting computer networks by altering unwanted network data traffic |
US7571483B1 (en) | 2005-08-25 | 2009-08-04 | Lockheed Martin Corporation | System and method for reducing the vulnerability of a computer network to virus threats |
Citations (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US3609697A (en) * | 1968-10-21 | 1971-09-28 | Ibm | Program security device |
US5121345A (en) * | 1988-11-03 | 1992-06-09 | Lentz Stephen A | System and method for protecting integrity of computer data and software |
US5126728A (en) * | 1989-06-07 | 1992-06-30 | Hall Donald R | ADP security device for labeled data |
US5414833A (en) * | 1993-10-27 | 1995-05-09 | International Business Machines Corporation | Network security system and method using a parallel finite state machine adaptive active monitor and responder |
US5434562A (en) * | 1991-09-06 | 1995-07-18 | Reardon; David C. | Method for limiting computer access to peripheral devices |
US5550818A (en) * | 1994-09-19 | 1996-08-27 | Bell Communications Research, Inc. | System for wavelength division multiplexing/asynchronous transfer mode switching for network communication |
US5559814A (en) * | 1994-03-11 | 1996-09-24 | France Telecom | Verification of integrity of data exchanged between two telecommunication network stations |
US5572590A (en) * | 1994-04-12 | 1996-11-05 | International Business Machines Corporation | Discrimination of malicious changes to digital information using multiple signatures |
US5613002A (en) * | 1994-11-21 | 1997-03-18 | International Business Machines Corporation | Generic disinfection of programs infected with a computer virus |
US5815571A (en) * | 1996-10-28 | 1998-09-29 | Finley; Phillip Scott | Computer system with secured data paths and method of protection |
US5826013A (en) * | 1995-09-28 | 1998-10-20 | Symantec Corporation | Polymorphic virus detection module |
US5832208A (en) * | 1996-09-05 | 1998-11-03 | Cheyenne Software International Sales Corp. | Anti-virus agent for use with databases and mail servers |
-
1997
- 1997-10-22 US US08/955,912 patent/US6003132A/en not_active Expired - Fee Related
-
1998
- 1998-10-21 WO PCT/US1998/022276 patent/WO1999021317A2/en active Application Filing
- 1998-10-21 AU AU13623/99A patent/AU1362399A/en not_active Abandoned
Patent Citations (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US3609697A (en) * | 1968-10-21 | 1971-09-28 | Ibm | Program security device |
US5121345A (en) * | 1988-11-03 | 1992-06-09 | Lentz Stephen A | System and method for protecting integrity of computer data and software |
US5126728A (en) * | 1989-06-07 | 1992-06-30 | Hall Donald R | ADP security device for labeled data |
US5434562A (en) * | 1991-09-06 | 1995-07-18 | Reardon; David C. | Method for limiting computer access to peripheral devices |
US5414833A (en) * | 1993-10-27 | 1995-05-09 | International Business Machines Corporation | Network security system and method using a parallel finite state machine adaptive active monitor and responder |
US5559814A (en) * | 1994-03-11 | 1996-09-24 | France Telecom | Verification of integrity of data exchanged between two telecommunication network stations |
US5572590A (en) * | 1994-04-12 | 1996-11-05 | International Business Machines Corporation | Discrimination of malicious changes to digital information using multiple signatures |
US5550818A (en) * | 1994-09-19 | 1996-08-27 | Bell Communications Research, Inc. | System for wavelength division multiplexing/asynchronous transfer mode switching for network communication |
US5613002A (en) * | 1994-11-21 | 1997-03-18 | International Business Machines Corporation | Generic disinfection of programs infected with a computer virus |
US5826013A (en) * | 1995-09-28 | 1998-10-20 | Symantec Corporation | Polymorphic virus detection module |
US5832208A (en) * | 1996-09-05 | 1998-11-03 | Cheyenne Software International Sales Corp. | Anti-virus agent for use with databases and mail servers |
US5815571A (en) * | 1996-10-28 | 1998-09-29 | Finley; Phillip Scott | Computer system with secured data paths and method of protection |
Also Published As
Publication number | Publication date |
---|---|
US6003132A (en) | 1999-12-14 |
AU1362399A (en) | 1999-05-10 |
WO1999021317A3 (en) | 2001-12-20 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6003132A (en) | Method and apparatus for isolating a computer system upon detection of viruses and similar data | |
US6081894A (en) | Method and apparatus for isolating an encrypted computer system upon detection of viruses and similar data | |
CA1287905C (en) | Method and apparatus for detecting a rate of data transmission | |
US5418812A (en) | Radio network initialization method and apparatus | |
US7668169B2 (en) | Device and method that allows single data recovery circuit to support multiple USB ports | |
AU5164793A (en) | Method and apparatus for automatic transfer of control from an internal processor to an external computer | |
CA2253933A1 (en) | Half duplex uart control for single channel bi-directional wireless communications | |
US7155555B2 (en) | Communication system and method of controlling same | |
US20070245404A1 (en) | Information processing apparatus, management method therefor, computer-readable recording medium recording management program, information processing system | |
US7176785B2 (en) | Device control system | |
WO2000036515A1 (en) | Method and apparatus for isolating a computer system upon detection of viruses and similar data | |
CN101561876A (en) | Method and system for collecting and identifying ID card information | |
KR920008450B1 (en) | Method for apparatus for detecting synchronous or asynchronous data transmission | |
US20020073342A1 (en) | Verifying physical universal serial bus keystrokes | |
US6252874B1 (en) | Ethernet card and ethernet card improvement methods | |
JP4145171B2 (en) | Image processing device unauthorized use monitoring device | |
US6643717B1 (en) | Flow control | |
KR100537930B1 (en) | Guarding method for input data by usb keyboard and guarding system | |
US20100158007A1 (en) | Method and apparatus for aggregating single packets in a single session | |
US20230259369A1 (en) | Method and microcontroller for driving in-system-programming | |
JP3682403B2 (en) | Information transmission system | |
KR19980039827A (en) | Force Document Receiving on Facsimile with Complex Functions | |
JPH10294756A (en) | Electronic mail terminal equipment | |
US7126983B1 (en) | Methods and apparatus for communicating commands and data using logical channels | |
US20050004772A1 (en) | Method for eliminating noise signals in radio signal receiving devices |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): AL AM AT AU AZ BA BB BG BR BY CA CH CN CU CZ DE DK EE ES FI GB GD GE GH GM HR HU ID IL IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG US UZ VN YU ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): GH GM KE LS MW SD SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
REG | Reference to national code |
Ref country code: DE Ref legal event code: 8642 |
|
NENP | Non-entry into the national phase |
Ref country code: CA |
|
122 | Ep: pct application non-entry in european phase | ||
AK | Designated states |
Kind code of ref document: A3 Designated state(s): AL AM AT AU AZ BA BB BG BR BY CA CH CN CU CZ DE DK EE ES FI GB GD GE GH GM HR HU ID IL IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG US UZ VN YU ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A3 Designated state(s): GH GM KE LS MW SD SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |