Network Managed Antivirus Appliance

• US 20110197280A1
• Filed: 02/04/2011
• Published: 08/11/2011
• Est. Priority Date: 02/05/2010
• Status: Active Grant

• Current Assignee: Leidos, Inc. (Leidos Holdings, Inc.)
• Original Assignee: Science Applications International Corporation
• Inventors: Brown, Eric E., Bartruff, Paul L., Miley, Michael P., Young, Alan G.
• Granted Patent: US 8,910,288 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Data can be scanned using a network managed appliance. The network managed appliance may integrate commercial hardware elements connected through a basic or simplified operating system environment expressly developed for the appliance, thus being more malware resistant and less vulnerable to attacks from the scanned data or other sources. The network managed appliance may be a self-contained apparatus with an integrated chassis, designed and configured as “single-purpose” device. Such appliances may be connected to an appliance management network including central management servers in communication with appliances in remote locations. The central management servers may ensure that scanning software and the definitions lists for each of the appliances are current and match an enterprise-approved configuration.

Claims

1. Apparatus comprising:

at least one processor;

an input configured to communicatively connect a portable data storage medium to the apparatus;

a network interface; and

at least one memory storing computer readable instructions that, when executed, cause the apparatus to;

identify the attachment of a portable storage medium via the input;

scan the attached portable storage medium using software installed on the apparatus; and

transmit the results of the media scan via the network interface to a management server,

wherein the at least one memory of the apparatus further stores an operating system configured to reduce vulnerabilities to viruses and malware by supporting a reduced number of digital inputs to the apparatus and having a reduced number of digital outputs from the apparatus.

2. The apparatus of claim 1, further comprising a biometric scanner, where the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

receive user data via the biometric scanner;

authenticate a first user based on said user data; and

prior to scanning the attached portable storage medium, determine that the first user is authorized to scan media using the apparatus.

3. The apparatus of claim 1, wherein the apparatus does not have an input configured to receive data from or transmit data to a keyboard, mouse, or monitor.

4. The apparatus of claim 1, wherein the apparatus does not have an input for serial, keyboard, mouse, monitor, or any other external I/O devices not needed for the scanning and the reporting of results.

5. The apparatus of claim 1, further comprising a write block component configured to prevent modification of an attached portable storage medium.

6. The apparatus of claim 1, further comprising a non-detachable display configured to display the results of the scan on the apparatus.

7. The apparatus of claim 1, wherein the scanning comprises performing a virus scan on the attached portable storage medium using virus scanning software installed on the apparatus, and wherein the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

receive at least one of an updated operating system image or updated virus definition files from the management server via the network interface; and

configure the apparatus to use the received updated operating system image or updated virus definition files.

8. The apparatus of claim 1, wherein the scanning comprises searching the attached portable storage medium for secure files using content searching software installed on the apparatus, and wherein the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

receive updated content searching software from the management server via the network interface; and

configure the apparatus to use the updated content searching software.

9. The apparatus of claim 1, wherein the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

receive, via a user interface on the apparatus, user input identifying a user rights assignment for a first file on the attached portable storage medium; and

transmit data identifying the user rights assignment for the first file to the management server via the network interface.

10. The apparatus of claim 1, wherein the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

receive, via a user interface on the apparatus, user input identifying a user rights assignment for a first file on the attached portable media; and

modify the first file to implement the received user rights assignment.

11. Apparatus comprising:

at least one processor;

an input configured to connect a portable storage medium to the apparatus;

a network interface; and

at least one memory storing computer readable instructions that, when executed, cause the apparatus to;

receive a plurality of data files;

scan the plurality of data files using software installed on the apparatus;

based on the results of the scan, allow or prohibit a requested transfer of one or more of the scanned data files,

wherein the at least one memory of the apparatus further stores an operating system configured to reduce vulnerabilities to viruses and malware by supporting a reduced number of digital inputs to the apparatus and having a reduced number of digital outputs from the apparatus.

12. The apparatus of claim 11, wherein scanning the plurality of data files comprises performing a malware scan on the data files using virus scanning software installed on the apparatus.

13. The apparatus of claim 12, wherein allowing or prohibiting the requested transfer of the scanned data files comprises:

determining that a first scanned data file contains malware;

prohibiting the requested transfer of the first scanned data file; and

transferring the first scanned data file to a separate quarantine location for analysis.

14. The apparatus of claim 11, wherein scanning the plurality of data files comprises scanning for secure files using content searching software installed on the apparatus.

15. The apparatus of claim 14, wherein allowing or prohibiting the requested transfer of the scanned data files comprises:

determining that a first scanned data file contains secure content; and

requiring the first scanned data file to be encrypted before it is transferred from the apparatus.

16. The apparatus of claim 11, wherein receiving the plurality of data files comprises receiving the files from a secure computer network over a second network interface, and wherein prohibiting the requested transfer comprises preventing the one or more scanned data files from being written to a portable storage medium connected to the apparatus.

17. The apparatus of claim 11, wherein receiving the plurality of data files comprises reading the files from a portable storage medium connected to the apparatus, and wherein prohibiting the requested transfer comprises preventing the one or more scanned data files from being transmitted over a second network interface to a secure computer network.

18. The apparatus of claim 11, wherein the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

transmit results of the scan of the plurality of data files via the network interface to a management server.

19. The apparatus of claim 11, wherein the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

receive, via a user interface on the apparatus, user input identifying a user rights assignment for a first file in the plurality of data files; and

transmit data identifying the user rights assignment for the first file to a management server via the network interface.

20. The apparatus of claim 11, wherein the at least one memory stores additional computer readable instructions that, when executed, further cause the apparatus to:

receive, via a user interface on the apparatus, user input identifying a user rights assignment for a first file in the plurality of data files; and

modify the first file to implement the received user rights assignment.