Method and system for controlling and filtering files using a virus-free certificate

• US 20020016925A1
• Filed: 01/02/2001
• Published: 02/07/2002
• Est. Priority Date: 04/13/2000
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Pennec, Jean-Francois Le, Hericourt, Olivier
• Granted Patent: US 6,986,051 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention is directed to computer viruses and more particularly to a method and system for use in a virus-free certificate firewall, of controlling and filtering files using a virus-free certificate. An example embodiment of the method comprises the steps of: receiving a file; if a virus-free certificate (200) is required for the file: determining whether the a virus-free certificate is already associated with the file; if a virus-free certificate is already associated with the file: authenticating the associated virus-free certificate, said virus-free certificate comprising a certificate signature; if the virus-free certificate is authenticated, determining whether the file is virus-free or not; if the file is virus-free, forwarding the file with the associated virus-free certificate; if the virus-free certificate is not authenticated or if no virus-free, certificate is associated with the file; determining whether the file is virus-free or not, if the file is virus-free, associating with the file a new virus-free certificate; and forwarding the file with the new virus-free certificate.

Claims

1. A method comprising the steps of:

employing a virus-free certificate firewall in controlling and filtering files using a virus-free certificate including;

receiving a file;

if a virus-free certificate is required for the file, determining whether the a virus-free certificate is already associated with the file;

if a virus-free certificate is already associated with the file, authenticating the associated virus-free certificate, said virus-free certificate comprising a certificate signature;

if the virus-free certificate is authenticated, determining whether the file is virus-free or not;

if the file is virus-free, forwarding the file with the associated virus-free certificate;

if the virus-free certificate is not authenticated or if no virus-free certificate is associated with the file determining whether the file is virus-free or not;

if the file is virus-free, associating with the file a new virus-free certificate, and forwarding the file with the new virus-free certificate.

2. The method according to claim 1, further comprising the steps of:

identifying the file in a table, said table comprising for each identified file at least one anti-virus criteria;

referring to the table and retrieving at least one of said at least one anti-virus criteria,; and

determining from said at least one anti-virus criteria whether a virus-free certificate is required for the file or not.

3. The method according to claim 2, wherein the step of referring to the table and retrieving at least one of said at least one anti-virus criteria includes the step of determining whether or not the identified file satisfies the requirements of the retrieved anti-virus criteria.

4. The method according to claim 1, wherein the virus-free certificate comprises a file signature for determining that the file is virus-free.

5. The method according to claim 1, wherein the virus-free certificate includes a list of anti-virus programs that have been executed on the file;

6. The method according to any one of the preceding claims wherein the virus-free certificate (200) further comprises at least one of the following:

a file identification;

a virus-free certificate authority identification;

a public key for decrypting the file signature;

a certificate signature for authenticating the virus-free certificate; and

an indication of the virus-free certificate validity.

7. The method according to claim 1, wherein said step of determining whether the file is virus-free or not includes:

decrypting the file signature using a public key comprised in the virus-free certificate;

hashing the file to generate a file digest; and

comparing the decrypted file signature with the generated file digest.

8. The method according to any one of the preceding claims wherein said step of determining whether the file is virus-free or not comprises the further step of

if the file is not virus-free, discarding (413) the file.

9. The method according to claim 1, wherein the step of authenticating the virus-free certificate includes:

validating the virus-free certificate, and

verifying that the list of said at least one anti-virus program comprised in the virus-free certificate is included in a list of anti-virus programs associated with the file in the table.

10. The method according to claim 1, wherein the step of associating with the file a new virus-free certificate includes the step of requesting a virus-free certificate from a virus-free certificate authority.

11. The method according to claim 1, wherein the step of associating with the file a new virus-free certificate includes the step of retrieving a virus-free certificate from a cache, said cache storing existing virus-free certificates.

12. The method according to any one of the preceding claims wherein the step of forwarding the file with the new virus-free certificate includes updating a cache with the new virus-free certificate.

13. A system comprising means adapted for carrying out the method according to claim 1.

14. A computer program comprising instructions for carrying out the method according to claim 1.

15. An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing employment of a virus-free certificate firewall, the computer readable program code means in said article of manufacture comprising computer readable program code means for causing a computer to effect the steps of claim 1.

16. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing employment of a virus-free certificate firewall, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the steps of claim 1.

17. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for employment of a virus-free certificate firewall, said method steps comprising the steps of claim 1.