Temporal access control for computer virus prevention

• US 20030088680A1
• Filed: 10/04/2002
• Published: 05/08/2003
• Est. Priority Date: 04/06/2001
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., Nachenberg, Carey S.
• Granted Patent: US 7,483,993 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An access control system (200) enables a computer network (1) to prevent execution of computer code that may contain computer viruses. An access control console (201) generates an access control message (260) including control parameters such as a time limit (255). Said time limit (255) is disseminated to computers (2, 3) on the network (1). Said computers (2, 3) use the time limit (255) to determine the executability of computer code. Access control system (200) also enables blocking data communications with suspicious or susceptible programs in network (1) during virus outbreaks.

Claims

1. A computer-implemented method for computer virus prevention, said method comprising the steps of:

receiving a virus prevention report, the virus prevention report including a time limit;

determining a length of time since a computer code entered a computer system;

comparing the length of time since the computer code entered the computer system to the time limit; and

determining executability of the computer code in response to the result of the comparing step.

2. The method of claim 1, further comprising the steps of:

determining a source of the computer code; and

determining executability of the computer code in response to the source of the computer code.

3. The method of claim 1, wherein determining a length of time since the computer code entered the system further comprises the sub-step of referencing a time stamp associated with the computer code.

4. The method of claim 1, wherein the virus prevention report further includes types of computer code that should be monitored, and further comprising the steps of:

determining a type of computer code for the computer code; and

determining executability of the computer code in response to whether the computer code comprises a type of computer code included in the virus prevention report.

5. The method of claim 1, wherein the virus prevention report further includes an expiration time, and further comprising the steps of:

determining an expiration time for the virus prevention report; and

determining executability of the computer code in response to whether the expiration time is later than a current time.

6. The method of claim 1, further comprising the step of intercepting an attempt to execute the computer code.

7. A system for preventing infection of a host system by a virus, the system comprising:

a memory module configured to store a time stamp in association with a computer code; and

an access control module coupled to the memory module and configured to;

receive an access control message including a time limit; and

determine executability of the computer code in response to whether the difference between a current time and the time stamp is greater than the time limit.

8. The system of claim 7, wherein the access control module is further configured to:

determine a source of the computer code; and

determine executability of the computer code in response to the source of the computer code.

9. The system of claim 7, wherein:

the access control message further includes types of computer code; and

the access control module is further configured to determine executability of the computer code in response to whether the computer code comprises a type of computer code included in the access control message.

10. The system of claim 7, wherein

the access control message further includes sources of computer code;

the access control module is further configured to determine executability of the computer code in response to whether the computer code originated from a source of computer code included in the access control message.

11. The system of claim 7, wherein

the access control message further includes an expiration time;

and

the access control module is further configured to determine executability of the computer code in response to whether the expiration time is later than a current time.

12. The system of claim 7, wherein the access control module is further configured to intercept an attempt to execute the computer code.

13. A computer readable medium having computer readable code embodied therein for computer access control for computer virus prevention, the computer code comprising instructions for:

receiving a virus prevention report, the virus prevention report including a time limit;

determining a length of time since a computer code entered a computer system;

comparing the length of time since the computer code entered the computer system to the time limit; and

determining executability of the computer code in response to the result of the comparing step.

14. The method computer readable medium of claim 13, further comprising instructions for:

determining a source of the computer code; and

determining executability of the computer code in response to the source of the computer code.

15. The method of claim 13, wherein the instructions for determining a length of time since the computer code entered the system further comprises instructions for referencing a time stamp associated with the computer code.

16. The method of claim 13, wherein the virus prevention report further includes types of computer code that should be monitored, and further comprising the steps of:

determining a type of computer code for the computer code; and

determining executability of the computer code in response to whether the computer code comprises a type of computer code included in the virus prevention report.

17. The computer readable medium of claim 13, further comprising instructions for:

determining a current time; and

determining executability of the computer code in response to whether an expiration time is later than a current time.

18. The method of claim 13, further comprising instructions for intercepting an attempt to execute the computer code.

19. A computer-implemented method for computer virus prevention, said method comprising the steps of:

entering a first computer virus status mode in response to a first computer virus outbreak report;

generating a first computer virus alert time corresponding to entry into the first computer virus status mode;

comparing a time stamp of a computer code with the first computer virus alert time;

determining a source of the computer content; and

determining executability of the computer code in response to the result of the comparing step and the source of the computer content.

20. A computer access control system for computer virus prevention, said system comprising:

an access control console, for entering a first computer virus status mode and for generating a time limit; and

an anti-virus module, coupled to the access control console, configured to;

determine a time difference between a time indicated in a time stamp of a target computer code and a current time; and

determine executability of the computer code in response to whether the time difference is greater than the time limit.

21. A computer-implemented method for computer virus prevention, said method comprising the steps of:

receiving a virus prevention report, the virus prevention report including a time limit;

determining a length of time since a computer code entered a computer system;

comparing the length of time since the computer code entered the computer system to the time limit; and

restricting the execution of the computer code in response to the result of the determining step.

22. The method of claim 21, wherein the step of restricting the execution of the computer code comprises the sub-steps of:

permitting the computer code to execute;

monitoring the behavior of the executing computer code;

detecting an attempt by the executing computer code to open a network connection; and

blocking the attempt to open a network connection.