Computer virus containment

• US 20030074578A1
• Filed: 12/05/2001
• Published: 04/17/2003
• Est. Priority Date: 10/16/2001
• Status: Abandoned Application

• Current Assignee: Omnicluster Technologies Incorporated
• Original Assignee: Omnicluster Technologies Incorporated
• Inventors: Ford, Richard, Brooks, Bart J., Fleck, Christopher, Heath, Chester A., Mendenhall, David
• Application Number:
  US10/005,886
• Publication Number:
  US 20030074578A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

This invention provides a system for the prevention of the spread of a computer virus by intercepting outgoing messages from a computer device and determining whether the message is of an acceptable type. The system is provided as a firedoor that compares outgoing messages to a previously established list of approved actions and, if the message does not conform to an approved action on the list, the firedoor blocks transmission and prevents the virus from spreading any further. If a further embodiment, multiple firedoors are applied in a cascaded series to compare the transmission to different acceptance criteria in tandem.

Claims

1. A method for the containment of a virus in a computer network, comprising evaluating an outgoing message from a computer device and blocking the transmission of the message if it does not conform to an established list of permitted actions.

2. A method for the containment of a virus in a computer network, comprising:

(a) establishing a list of permitted operations in a computer network;

(b) intercepting a message emanating from a device in the computer network;

(c) comparing the intercepted message to the list of permitted operations;

(d) transmitting the message if the message conforms to one of the permitted operations on the list; and

(e) blocking the message if the message does not conform to one of the permitted operations on the list.

3. The method for the containment of a virus in a computer network as described in claim 2, wherein the list of permitted operations comprises permitting transmission only to another network or computer device having one of certain addresses or protocols.

4. The method for the containment of a virus in a computer network as described in claim 2, wherein the list of permitted operations comprises transmission to another network or computer device only in response to an external initiation.

5. The method for the containment of a virus in a computer network as described in claim 2, wherein one of the permitted operations comprises establishing communications between two servers or the like devices.

6. The method for the containment of a virus in a computer network as described in claim 2, further comprising transmitting the message only if the message conforms to a first and a second of the permitted operations on the list.

7. A firedoor system for the containment of a virus in a computer network, comprising a firedoor for receiving a message from a computer device, comparing the received message to an established list of permitted operations and transmitting the received message only if it conforms to the list of permitted operations.

8. A firedoor system for the containment of a virus in a computer network, comprising:

(a) a firewall connected to the computer network so as to receive messages from an outside source and adapted for screening unwanted messages;

(b) a computer device connected to receive messages passed by the firewall; and

(c) a firedoor connected to the computer device so as to receive messages from the computer device and to evaluate the received messages and transmit only permitted messages to other computer devices in the computer network.

9. The firedoor system for the containment of a virus in a computer network as described in claim 8, wherein the firedoor is connected to an output port of the computer device.

10. The firedoor system for the containment of a virus in a computer network as described in claim 8, wherein the firedoor is connected to a computer network bus.

11. The firedoor system for the containment of a virus in a computer network as described in claim 8, wherein the firedoor is connected to a computer network channel.

12. The firedoor system for the containment of a virus in a computer network as described in claim 8, wherein the firedoor is provided in series with a second firedoor so that different verification criteria from each firedoor are applied serially.