System for virus-checking network data during download to a client device

• US 6,088,803 A
• Filed: 12/30/1997
• Issued: 07/11/2000
• Est. Priority Date: 12/30/1997
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Tso, Michael Man-Hak, Bakshi, Bikram Singh
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): BONZO, BRYCE P
• Application Number:
  US09/000,778
• Time in Patent Office: 924 Days
• Field of Search: 380/4, 713/200, 713/201, 709/203, 709/219, 714/38
• US Class Current: 726/22
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system for virus checking a data object to be downloaded to a client device is implemented in a method including the steps of retrieving a data object to be downloaded, scanning the data object for a computer virus, and downloading the data object to the client device if no computer virus is detected.

Claims

1. A method for virus checking a data object to be downloaded to a client device, said method being implemented on a network device coupled to the client device by a communications link, said method comprising the steps of:

retrieving a data object to be downloaded to the client device;

scanning the data object for a computer virus; and

downloading the data object to the client device if no computer virus is detected, wherein the data object is segmented into a series of contiguous portions, said retrieving, scanning and downloading steps being performed for each of said contiguous portions.

2. The method of claim 1, further comprising the step of returning an error to the client device if a computer virus is detected.

3. The method of claim 1, wherein the network device is coupled to a server device, said method further comprising the step of returning an error to the server device if a computer virus is detected.

4. The method of claim 1, further comprising the step of withholding at least a segment of one of said contiguous portions from the client device until all of said contiguous portions of the data object have been scanned.

5. The method of claim 4, wherein absence of said withheld segment has a sufficient magnitude to cause the client device to interpret the data object as incomplete.

6. The method of claim 4, wherein the client device includes a timeout mechanism for terminating the communications link if no activity is detected for a predetermined period of time, said method further comprising the step of extending said predetermined period of time to avoid a timeout while the network device is virus checking the data object.

7. The method of claim 6, wherein said timeout mechanism comprises a protocol stack timer, said step of extending said predetermined period of time comprising a desensitization of said protocol stack timer.

8. The method of claim 7, wherein said desensitization is achieved by introducing a progressively greater delay into the download of each of said series of contiguous portions.

9. The method of claim 1, further comprising the step of repairing the data object prior to downloading it to the client device if a computer virus is detected.

10. A network device for virus checking a data object to be downloaded to a client device, said network device comprising a computer programmed to:

retrieve a data object to be downloaded to the client device;

scan the data object for a computer virus; and

download the data object to the client device if no computer virus is detected, wherein the data object is segmented into a series of contiguous portions, said retrieval, scan and download being performed for each of said contiguous portions.

11. The network device of claim 10, wherein said network device comprises a proxy.

12. The network device of claim 10, wherein the computer is programmed to perform the additional step of repairing the data object prior to downloading it to the client device if a computer virus is detected.

13. The network device of claim 10, wherein the computer includes a cache storage, said computer being further programmed to perform the steps of:

retrieving a cached version of the data object if one resides in the cache storage; and

storing a version of the data object in the cache storage if no computer virus is detected.

14. The network device of claim 13, wherein said version of the data object stored in the cache storage identifies a computer virus for which the data object was scanned.

15. The network device of claim 13, wherein said computer is further programmed to perform the step of storing a repaired version of the data object in the cache storage.

16. The network device of claim 10, wherein said network device comprises a router.

17. A storage medium containing a set of instructions for execution by a network device coupled to a client device, said set of instructions comprising instructions for:

retrieving a data object to be downloaded to the client device;

scanning the data object for a computer virus; and

downloading the data object to the client device if no computer virus is detected, wherein the data object is segmented into a series of contiguous portions, said retrieving, scanning and downloading being performed for each of said contiguous portions.

18. The storage medium of claim 17, wherein said storage medium comprises a magnetic storage device.

19. The storage medium of claim 17, wherein said storage medium comprises a memory accessible by the computer.

20. The storage medium of claim 17, wherein said set of instructions further comprises instructions for repairing the data object prior to downloading it to the client device if a computer virus is detected.

21. A system for virus checking network data, said system comprising a client device coupled to a network device by a communications link, wherein said network device is programmed to retrieve a data object to be downloaded to the client device, scan the data object for a computer virus, and download the data object to the client device if no computer virus is detected, the data object being segmented into a series of contiguous portions, with the retrieval, scan and download being performed for each of the contiguous portions.