Method for securing software against corruption by computer viruses

• US 5,359,659 A
• Filed: 06/19/1992
• Issued: 10/25/1994
• Est. Priority Date: 06/19/1992
• Status: Expired due to Fees

• Current Assignee: Doren Rosenthal
• Original Assignee: Doren Rosenthal
• Inventors: Rosenthal, Doren
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US07/901,552
• Time in Patent Office: 858 Days
• Field of Search: 380/4, 364/269.4, 395/575, 395/700
• US Class Current: 726/24
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity

Abstract

A method is disclosed for securing an existing executable software program against infection or corruption by software viruses or the like, without requiring any modification to the program'"'"'s source code or any recompilation or relinking. Security routines capable of detecting the presence of any virus infection or other corruption are coupled to the program. The loading information for the program is modified so that upon any attempt to execute the program, the security routines will execute first and scan for viruses or other corruption. If any viruses or corruption are detected, execution of the program is aborted and a warning is displayed. If no viruses or corruption are found, the security routines are removed from memory and execution of the program continues normally.

Claims

1. A method of using a computer system to secure against corruption by virus an existing executable software program, said computer system having one or more storage media, said existing executable software program being stored on at least one of said storage media, said method comprising the steps of:

identifying one or more security routines, said one or more security routines to detect corruption by virus of said existing executable software program and to detect the presence of corruption by virus of portions of said computer system external to said existing executable software program;

modifying electronic signals representative of said existing executable software program to cause said computer system to execute said one or more security routines first during each execution of said existing routines to said software program; and

storing said modifications to said existing executable software program.

2. The method of claim 1 further including the step of storing said one or more security routines to at least one of said storage media.

3. The method of claim 1, wherein said modifying step further includes the step of modifying electronic signals representative of loading information associated with said existing executable software program.

4. The method of claim 3, wherein said loading information is stored contiguously with said existing executable software program.

5. The method of claim 3, wherein said loading information is stored separately from said existing executable software program.

6. The method of claim 1, wherein said storage media comprise one or more memories and at least one of said one or more security routines scans for the presence of corruption by virus in said one or more memories.

7. The method of claim 1, wherein said storage media comprise one or more mass storage devices and at least one of said one or more security routines scans for the presence of corruption by virus on said one or more mass storage devices.

8. The method of claim 1, wherein at least one of said one or more security routines computes and verifies one or more checksum test values for said existing executable software program.

9. The method of claim 1, wherein at least one of said one or more security routines computes and verifies one or more cyclic redundancy check test values for said existing executable software program.

10. The method of claim 1, wherein said modifying step further includes the step of encrypting said existing executable software program.

11. The method of claim 10, wherein at least one of said one or more security routines decrypts said existing executable software program.

12. The method of claim 1, wherein said modifying step further includes the step of compressing said existing executable software program.

13. The method of claim 12, wherein at least one of said one or more security routines decompresses said existing executable software program.

14. The method of claim 1, wherein at least one of said one or more security routines warns an operator of said computer system when any corruption by virus is detected by said one or more security routines.

15. The method of claim 1, wherein at least one of said one or more security routines aborts the execution of said existing executable software program when any corruption by virus is detected by said one or more security routines.

16. An apparatus for securing against corruption by virus an existing executable software program, said apparatus comprising:

a computer system comprising one or more storage media, said existing executable software program stored on at least one of said storage media;

means for identifying one or more security routines, said one or more security routines to detect corruption by virus of said existing executable software program and to detect corruption by virus of portions of said computer system external to said existing executable software program;

means for modifying electronic signals representative of said existing executable software program to cause said computer system to execute said one or more security routines first during each execution of said existing executable software program; and

means for storing said modifications to said existing executable software program.

17. The apparatus of claim 16 further comprising a means for storing said one or more security routines to at least one of said storage media.

18. The apparatus of claim 16, wherein said modifying means further includes means for modifying electronic signals representative of loading information associated with said existing executable software program.

19. The apparatus of claim 18, wherein said loading information is stored contiguously with said existing executable software program on at least one of said storage media.

20. The apparatus of claim 18, wherein said loading information is stored on at least one of said storage media and separately from said existing executable software program.

21. The apparatus of claim 16, wherein said storage media comprise one or more memories and at least one of said one or more security routines scans for the presence of corruption by virus in said one or more memories.

22. The apparatus of claim 16, wherein said media comprise one or more mass storage devices and at least one of said one or more security routines scans for the presence of corruption by virus on said one or more mass storage devices.

23. The apparatus of claim 16, wherein at least one of said one or more security routines computes and verifies one or more checksum test values for said existing executable software program.

24. The apparatus of claim 16, wherein at least one of said one or more security routines computes and verifies one or more cyclic redundancy check test values for said existing executable software program.

25. The apparatus of claim 16, said modifying means further including a means for encrypting said existing executable software program.

26. The apparatus of claim 25, wherein at least one of said one or more security routines decrypts said existing executable software program.

27. The apparatus of claim 16, said modifying means further including a means for compressing said existing executable software program.

28. The apparatus of claim 27, wherein at least one of said one or more security routines decompresses said software program.

29. The apparatus of claim 16, wherein at least one of said one or more security routines warns an operator of said computer system when any corruption by virus is detected by said one or more security routines.

30. The apparatus of claim 16, wherein at least one of said one or more security routines aborts the execution of said existing executable software program when any corruption by virus is detected by said one or more security routines.