Patent Grant
10162965
The present invention relates generally to a portable media system, and more particularly to a virus protection system for portable memory drives and mobile devices containing memory.
Viruses have been spreading for a long time from one host computer system to another by the various networks that connect them. With the increasing popularity of portable media systems, such as flash memory drives, viruses are now copying themselves into portable media systems and then again to other host computer systems when the portable media system(s) is/are connected to them. In this manner, viruses are able to spread between host computer systems even when no network is used.
A growing trend is to put anti-virus (AV) software on the host computer system and/or portable media systems and provide a means of scanning files before they are written to the portable media systems. It has been found that there are some problems using this approach
The AV software often requires a time-consuming installation procedure to be performed prior to activation on the portable media system.
Often AV software stored on the portable media system may conflict with AV software already on a host computer system and cause both to become inoperative.
As the memory capacity of the portable media system continues to increase, a complete scan of the portable media system by the AV software stored on the portable media system becomes impractical because of the time required.
AV software often comes equipped with features unrelated to scanning the portable media system, making it expensive and impractical for widespread distribution on portable media systems.
Solutions to these problems have been long sought but prior developments have not taught or suggested any solutions and, thus, solutions to these problems have long eluded those skilled in the art.
The present invention provides a method of operation of a portable media system with a host computer system that includes: providing metadata programming in the portable media system, the metadata programming for constructing metadata of a file in the portable media system; and constructing new metadata in the portable media system in response to a new file loaded into the portable media system.
The present invention provides a portable media system with a host computer system that includes: metadata programming in the portable media system, the metadata programming for constructing metadata of a file in the portable media system; and construction programming for constructing new metadata in the portable media system in response to a new file loaded into the portable media system.
Certain embodiments of the invention have other steps or elements in addition to or in place of those mentioned above. The steps or elements will become apparent to those skilled in the art from a reading of the following detailed description when taken with reference to the accompanying drawings.
The following embodiments are described in sufficient detail to enable those skilled in the art to make and use the invention. It is to be understood that other embodiments would be evident based on the present disclosure, and that system, method, or mechanical changes may be made without departing from the scope of the present invention.
In the following description, numerous specific details are given to provide a thorough understanding of the invention. However, it will be apparent that the invention may be practiced without these specific details. In order to avoid obscuring the present invention, some well-known circuits, system configurations, and method steps are not disclosed in detail.
The drawings showing embodiments of the system are semi-diagrammatic and not to scale. Similarly, although the views in the drawings for ease of description generally show similar orientations, this depiction in the FIGS. is arbitrary for the most part. The invention can be operated in any orientation.
Where multiple embodiments are disclosed and described having some features in common, for clarity and ease of illustration, description, and comprehension thereof, similar and like features will ordinarily be described with similar reference numerals.
The term “host computer system” as used herein includes computing devices, such as computers, production machines with embedded computers, smart phones, and other processor-equipped devices which are subject to infiltration by malicious software.
The term “portable media system” means a hand-held device containing solid-state, optical disk, or hard disk memory storage. The term “portable” means that a device is capable of being easily held in one hand like a Flash memory device or portable hard disk drive.
The term “computer virus” is used herein as a catch-all phrase to include all types of malicious software, such as computer viruses, computer worms, Trojan horses, spyware, dishonest adware, and other malicious and unwanted software.
The term “virus blocker” means anti-virus software used to block transfer, contain, delete, or otherwise prevent the transfer of a computer virus.
Referring now to
The portable media system 102 has a file repository 108. A virus blocker 110 is stored as an executable file within the file repository 108. The virus blocker 110, when activated, has the capability of downloading virus signatures from a web-based repository and scan files for possible infections with the latest virus signatures downloaded or previously stored on the portable media system 102. The virus blocker 110, when activated, is able to detect file updates in the file repository 108.
The virus blocker 110 runs in the background of a host computer system 202 of
The connector 104 is connected to an interface controller 106 that manages communication between the host computer system 202 and the portable media system 102. An example of the interface controller 106 would be a USB controller which sends/reads data over a USB bus and reads/sends data to a memory such as a NAND flash. Other types of interface controllers may communicate over Serial Advanced Technology Attachment (SATA), Personal Computer Memory Card International Association (PCMCIA), Integrated Drive Electronics (IDE), etc.
Referring now to
The virus blocker 110 contains programming that during execution updates its database through the host computer system 202 from a remote location via the internet to be able to detect viruses. Signature-based malware detection involves searching for known malicious patterns and executable code. Signature-less malware detection uses heuristic approaches by looking for known malicious code, or slight variations of such codes. Some virus blockers can also predict what a file will do if opened/run by emulating it in a sandbox or security mechanism for separating running programs.
The virus blocker 110 then monitors the file repository 108 in the portable media system 102 for file accesses, such as reads, writes, or executes. The portable media system 102 includes programming for monitoring for file modifications in real time for new or modified files and scanning only the new or modified files for a computer virus. Using signature comparison, the virus blocker 110 flags infected files within the file repository 108.
Referring now to
Once the virus blocker 110 is running on the host computer system 202, it can monitor the file repository 108 of the portable media system 102. The virus blocker 110 monitors the portable media system 102 for file accesses, which include read, write, and execute, by waiting for file access on portable media system in a block 302. When a file is accessed in a block 304, the target file is scanned in a scan target file in a block 306 for a virus signature to determine if the file is infected in a target file infected block 308. If the target file is not infected, the method 300 returns to wait for file access on the portable media system in the block 302.
If the target file is infected, the method 300 proceeds to a process-infected file block 310. The infected file may be processed by being automatically deleted from the portable media system 102, quarantined by modifying the target file to render it ineffective, or querying the user whether to keep or delete the infected file.
Referring now to
The private partition 408 is not accessible until the virus blocker 110 is activated on the host computer system 202. When execution of the virus blocker 110 is terminated, the virus blocker 110 sends a command over the communication channel 204 to the interface controller 106 to close the private partition 408.
Referring now to
The method 500 begins with a user connecting the portable media system to the host computer system in a block 502. The host computer system then performs all the tasks associated with managing the portable media system. The particular tasks are dependent upon the operating system of the host computer system.
The host computer system then communicates with the interface controller and opens the public partition in a block 504. This step makes the public partition accessible by the host computer system and the host computer system assigns a drive letter to the portable media system.
The user activates the virus blocker resident on the public partition in a block 506. This step causes the host computer system to read the virus blocker into memory and begin execution of the virus blocker. Once activated, the virus blocker sends a command to the interface controller of the portable media system to open the private partition in a block 508. The interface controller opens the private partition in the block 510, and this guarantees virus protection is in place prior to granting file access for the host computer system to the portable media system.
Once the virus protection is in place, the user is able to read, write, and/or execute files stored in the private partition of the portable media system in a block 512. All file accesses are now sensed by the virus blocker.
When the virus blocker is terminated in a block 514, the interface controller will automatically close the private partition of the portable media system in a block 516.
Computer applications are typically notified by the operating system they are being terminated and instructed to perform clean-up operations. This is the logical place to close the private partition.
The virus blocker may be terminated by a number of different means, such as user interaction with the virus blocker to shut it down, the virus blocker tasks/processes are terminated by other software running on the computer, or the host computer system shuts down.
Referring now to
In another embodiment of the present invention, the virus blocker 110 of
Once invoked, the virus blocker 110 can construct metadata for the current state of the portable media system 102 and compare it with file repository metadata 608 in the file repository 600. In this manner, the virus blocker 110 can detect which files have been written or modified since the last time the virus blocker 110 was run. These files are then scanned for infiltration of viruses. A snapshot of the metadata is stored in the portable media system 102 for future reference. As an example, the change in file size would trigger the scan of the changed file.
Once the newly created metadata in the block 606 and the file repository metadata 608 have undergone comparison 610, the newly created metadata in the block 606 is written to the file repository 600 replacing the file repository metadata 608. A copy of the newly created metadata in block 606 can be written to any non-volatile memory, either on the portable media system 102 or on the host computer system 202.
For example, the host computer system 202 may keep multiple copies of metadata from multiple portable media systems that have been previously connected. Thus, the host computer system 202 is able to detect if a particular portable media system was used on a different host computer system.
The virus blocker includes programming for constructing metadata in the host computer system for comparison with metadata in the portable media system for tracking portable media system file changes, interoperability history, and a combination thereof. The term “inoperability history” refers to tracking the history of different portable media system changes to a host computer system and/or tracking different host computer systems that are connected to a portable media system.
Referring now to
The virus blocker 110 of
If a check shows that the files are the same in a block 706, the flowchart moves to the next file. If the file entry is different, the file is scanned. The conditions that start a file scan are differences in file name, size, date and time, or a newly created file.
The files are scanned in a scanned file for viruses block 708 and processes previously discussed. After all the files have been processed and the end of the metadata is reached 710, the latest copy of metadata is stored in a nonvolatile memory in a block 712 for comparison again at a later date.
Referring now to
While the invention has been described in conjunction with a specific best mode, it is to be understood that many alternatives, modifications, and variations will be apparent to those skilled in the art in light of the aforegoing description. Accordingly, it is intended to embrace all such alternatives, modifications, and variations that fall within the scope of the included claims. All matters hithertofore set forth herein or shown in the accompanying drawings are to be interpreted in an illustrative and non-limiting sense.
This is a continuation of co-pending U.S. patent application Ser. No. 12/796,665 filed Jun. 8, 2010, which claims the benefit of U.S. Provisional Patent Application Ser. No. 61/185,193 filed Jun. 8, 2009, and the subject matter thereof is incorporated herein by reference thereto.
| Number | Name | Date | Kind |
|---|---|---|---|
| 5473769 | Cozza | Dec 1995 | A |
| 5559960 | Lettvin | Sep 1996 | A |
| 5826012 | Lettvin | Oct 1998 | A |
| 6763466 | Glover | Jul 2004 | B1 |
| 6842861 | Cox et al. | Jan 2005 | B1 |
| 7069447 | Corder | Jun 2006 | B1 |
| 7591018 | Lee | Sep 2009 | B1 |
| 7716741 | Forman et al. | May 2010 | B2 |
| 7930531 | Chow et al. | Apr 2011 | B2 |
| 7938863 | Skinner et al. | May 2011 | B2 |
| 7975304 | Lu | Jul 2011 | B2 |
| 8312548 | Cnudde | Nov 2012 | B1 |
| 8826435 | Chiang et al. | Sep 2014 | B1 |
| 8832440 | Johnson et al. | Sep 2014 | B2 |
| 9015840 | Johnson et al. | Apr 2015 | B2 |
| 9075571 | Bolotin et al. | Jul 2015 | B2 |
| 9262611 | Johnson et al. | Feb 2016 | B2 |
| 20040068664 | Nachenberg | Apr 2004 | A1 |
| 20040172551 | Fielding et al. | Sep 2004 | A1 |
| 20060004974 | Lin et al. | Jan 2006 | A1 |
| 20070061894 | Skinner et al. | Mar 2007 | A1 |
| 20070113279 | Wang et al. | May 2007 | A1 |
| 20070261118 | Lu | Nov 2007 | A1 |
| 20080082813 | Chow et al. | Apr 2008 | A1 |
| 20080109903 | Werner et al. | May 2008 | A1 |
| 20090094698 | Nichols | Apr 2009 | A1 |
| 20090113128 | Zhao | Apr 2009 | A1 |
| 20160119339 | Bolotin et al. | Apr 2016 | A1 |
| 20160259736 | Bolotin et al. | Sep 2016 | A1 |
| Entry |
|---|
| “U.S. Appl. No. 12/796,665, Advisory Action dated Aug. 8, 2013”, 3 pgs. |
| “U.S. Appl. No. 12/796,665, Final Office Action dated May 21, 2013”, 25 pgs. |
| “U.S. Appl. No. 12/796,665, Non Final Office Action dated Aug. 15, 2014”, 20 pgs. |
| “U.S. Appl. No. 12/796,665, Non Final Office Action dated Sep. 26, 2012”, 18 pgs. |
| “U.S. Appl. No. 12/796,665, Notice of Allowance dated Dec. 19, 2014”, 15 pgs. |
| “U.S. Appl. No. 12/796,665, Response filed Jul. 15, 2013 to Final Office Action dated May 21, 2013”, 11 pgs. |
| “U.S. Appl. No. 12/796,665, Response filed Sep. 14, 2013 to Advisory Action dated Aug. 8, 2013”, 13 pgs. |
| “U.S. Appl. No. 12/796,665, Response filed Nov. 17, 2014 to Non Final Office Action dated Aug. 15, 2014”, 37 pgs. |
| “U.S. Appl. No. 12/796,665, Response filed Dec. 26. 2012 to Non Final Office Action dated Sep. 26, 2012”, 17 pgs. |
| U.S. Appl. No. 12/796,665, filed Jun. 8, 2010. |
| Number | Date | Country | |
|---|---|---|---|
| 20150227743 A1 | Aug 2015 | US |
| Number | Date | Country | |
|---|---|---|---|
| 61185193 | Jun 2009 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 12796665 | Jun 2010 | US |
| Child | 14691453 | US |
