Anti-virus policy enforcement system and method

• US 20030065793A1
• Filed: 09/28/2001
• Published: 04/03/2003
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kouznetsov, Victor, Huang, Ricky
• Granted Patent: US 6,892,241 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method and computer program product are provided for enforcing an anti-virus policy. Initially, a status command is received at a client computer from a network device utilizing a network. In response to the status command, a status is sent to the network device utilizing the network. Such status relates to anti-virus scanning software on the client computer. Next, a response is initiated at the client computer utilizing the network based on the status.

Claims

1. A method for enforcing an anti-virus policy, comprising:

(a) receiving a status command at a client computer from a network device utilizing a network;

(b) sending a status to the network device utilizing the network in response to the status command, the status relating to anti-virus scanning software on the client computer; and

(c) initiating a response at the client computer utilizing the network based on the status.

2. The method as recited in claim 1, wherein the status command is received in response to an attempt to access the network by the client computer.

3. The method as recited in claim 1, wherein the status command is received on a predetermined port.

4. The method as recited in claim 1, wherein the status command is received utilizing user datagram protocol (UDP).

5. The method as recited in claim 1, wherein the network device i includes a firewall.

6. The method as recited in claim 5, and further comprising determining whether the status command is received from the firewall.

7. The method as recited in claim 6, wherein the status is conditionally sent based on the determination as to whether the status command is received from the firewall.

8. The method as recited in claim 1, wherein the status command is encrypted, and further comprising decrypting the status command.

9. The method as recited in claim 8, and further comprising encrypting the status prior to sending the status utilizing the network.

10. The method as recited in claim 1, wherein the response includes conditionally preventing access to the network by the client computer based on the status.

11. The method as recited in claim 1, wherein the response includes requiring an action at the client computer.

13. The method as recited in claim 1, wherein the response conditionally includes a notice to the user of the client computer based on the status.

14. The method as recited in claim 13, wherein the notice indicates that the user is required to reinstall the anti-virus scanning software.

15. The method as recited in claim 13, wherein the notice indicates that the user is required to reactivate the anti-virus scanning software.

16. The method as recited in claim 1, wherein the response conditionally requires a reinstallation of the anti-virus scanning software based on the status.

17. The method as recited in claim 1, wherein the response conditionally requires a reactivation of the anti-virus scanning software based on the status.

18. The method as recited in claim 1, wherein the response conditionally includes an update command received from the network device based on the status.

19. The method as recited in claim 18, wherein the update command is encrypted.

20. The method as recited in claim 18, wherein the update command is received if the status indicates that the anti-virus scanning software on the client computer requires an update.

21. The method as recited in claim 18, and further comprising updating the anti-virus scanning software in response to the update command.

22. The method as recited in claim 21, wherein the anti-virus scanning software is updated utilizing the network.

23. The method as recited in claim 22, wherein the updating of the anti-virus scanning software includes sending an update request to a server utilizing the network.

24. The method as recited in claim 23, wherein the updating of the anti-virus scanning software further includes receiving an update from the server.

25. The method as recited in claim 24, wherein the update includes a plurality of virus signatures.

26. The method as recited in claim 24, wherein the update includes a plurality of .DAT files.

27. The method as recited in claim 1, and further comprising determining an amount of time that elapsed between the receipt of the status command and a previous receipt of the status command.

28. The method as recited in claim 27, and further comprising conditionally sending the status in response to the status command based on the amount of time that has elapsed.

29. The method as recited in claim 28, and further comprising sending the status in response to the status command if the amount of time that has elapsed is greater than a predetermined amount to prevent a denial of service attack (DOS).

30. The method as recited in claim 1, wherein the status is automatically sent to the network device in response to the status command.

31. The method as recited in claim 20, wherein the anti-virus scanning software is automatically updated in response to the update command.

32. The method as recited in claim 1, wherein the status relates to a version of the anti-virus scanning software.

33. The method as recited in claim 1, wherein the status relates to any tampering of the anti-virus scanning software.

34. The method as recited in claim 1, wherein the status relates to any removal of the anti-virus scanning software.

35. The method as recited in claim 1, wherein the status relates to any deactivation of the anti-virus scanning software.

36. The method as recited in claim 1, wherein (a)-(c) are carried out for a plurality of client computers communicating with the network device.

37. The method as recited in claim 36, wherein the client computers communicate with the network device via a local area network (LAN).

12. The method as recited in claim 12, and further comprising preventing access to the network until the action is carried out.

38. A computer program product for enforcing an anti-virus policy, comprising:

(a) computer code for receiving a status command at a client computer from a network device utilizing a network;

(b) computer code for sending a status to the network device utilizing the network in response to the status command, the status relating to anti-virus scanning software on the client computer; and

(c) computer code for initiating a response at the client computer utilizing the network based on the status.

39. A system for enforcing an anti-virus policy, comprising:

(a) means for receiving a status command at a client computer from a network device utilizing a network;

(b) means for sending a status to the network device utilizing the network in response to the status command, the status relating to anti-virus scanning software on the client computer; and

(c) means for initiating a response at the client computer utilizing the network based on the status.

40. A system for enforcing an anti-virus policy, comprising:

(a) a client agent for receiving a status command at a client computer from a network device utilizing a network, and sending a status to the network device utilizing the network in response to the status command, the status relating to anti-virus scanning software on the client computer; and

(b) wherein a response at the client computer is initiated utilizing the network based on the status.

41. A method for enforcing an anti-virus policy, comprising:

(a) attempting to gain access to a network via a firewall utilizing a client computer;

(b) receiving a command from the firewall utilizing the network; and

(c) sending information to the firewall utilizing the network in response to the command;

(d) wherein the information relates to anti-virus scanning software on the client computer.

42. A method for enforcing an anti-virus policy, comprising:

(a) attempting to gain access to a network via a firewall utilizing a client computer;

(b) sending a status to the firewall utilizing the network, the status relating to anti-virus scanning software on the client computer; and

(c) gaining access to the network via the firewall based on the status.

43. A method for enforcing an anti-virus policy, comprising:

(a) attempting to gain access to a network via a firewall utilizing a client computer; and

(b) identifying a status relating to anti-virus scanning software on the client computer;

(c) wherein access is selectively allowed to the network via the firewall based on the status.

44. A computer program product for enforcing an anti-virus policy, comprising:

(a) computer code for attempting to gain access to a network via a firewall utilizing a client computer; and

(b) computer code for identifying a status relating to anti-virus scanning software on the client computer;

(c) wherein access is selectively allowed to the network via the firewall based on the status.

45. A method for enforcing an anti-virus policy, comprising:

(a) receiving a status command at a client computer from a network device utilizing a network;

(b) sending a status to the network device utilizing the network in response to the status command, the status relating to anti-virus scanning software on the client computer;

(c) receiving an update command from the network device based on the status, the update command being received if the status indicates that the anti-virus scanning software on the client computer requires an update; and

(d) updating the anti-virus scanning software in response to the update command.

46. A method for enforcing an anti-virus policy, comprising:

(a) monitoring a port on a client computer;

(b) receiving a command at the client computer utilizing a network;

(c) determining whether the command is received from a firewall; and

(d) if it is determined that the command is received from the firewall;

(i) decrypting the command,

(ii) determining whether the command includes a status command or an update command,

(iii) if the command includes a status command, sending a status to the firewall utilizing the network in response to the status command, the status relating to anti-virus scanning software on the client computer, and

(iv) if the command includes an update command, updating the anti-virus scanning software utilizing the network in response to the update command.