Method and system for providing automated updating and upgrading of antivirus applications using a computer network

• US 6,269,456 B1
• Filed: 01/11/2000
• Issued: 07/31/2001
• Est. Priority Date: 12/31/1997
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Network Associates, Inc.
• Inventors: OʼDonnell, Shawn, Hodges, Vernon
• Primary Examiner(s): Shalwala, Bipin
• Assistant Examiner(s): Patel, Nitin
• Application Number:
  US09/481,014
• Time in Patent Office: 567 Days
• Field of Search: 714/38, 713/201, 713/200, 710/243, 710/260, 710/261, 710/269
• US Class Current: 714/38.1
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

A method for updating antivirus files on a computer using push technology is disclosed. In a preferred embodiment, updated virus signature files or other updated antivirus information is loaded onto a central antivirus server, while local push agent software is installed on the client computer. When the user of the client computer is connected to the Internet, the push agent software operates in the background to receive updated antivirus files from the central antivirus server across the Internet, in a manner which is substantially transparent to the user. In another preferred embodiment, antivirus files on a plurality of client computers on a corporate computer network are automatically updated using push technology and automated network installation scripts. A service computer associated with the plurality of client computers receives one or batches of antivirus updates from a central antivirus server across the Internet using push technology. An automatic installation script is executed to install the antivirus updates on the client computers of the corporate computer network with a minimum of involvement from a corporate system administrator or, optionally, no involvement from the corporate system administrator.

Claims

1. A method for providing an updated antivirus file to a client computer, comprising the steps of:

storing the updated antivirus file on a central antivirus server;

retrieving, from an antivirus update database associated with the central antivirus server, information about a current antivirus file installed on the client computer; and

transferring the updated antivirus file from said central antivirus server to the client computer over the Internet using push technology, if it is determined from the retrieved information that the updated antivirus file supersedes the current antivirus file.

2. The method of claim 1, further comprising the step of installing push agent software onto the client computer, said push agent software being capable of instructing said client computer to communicate over the Internet with said central antivirus server when said client computer is connected to the Internet, said push agent software being capable of instructing said computer to receive the updated antivirus file from said central antivirus server.

3. The method of claim 2, further comprising the step of establishing a connection between the client computer to the Internet, wherein said push agent software receives the antivirus update file in a background procedure which is substantially transparent to a user of the client computer.

4. The method of claim 3, wherein said updated antivirus file is a self-extracting archive file, and wherein said push agent software is capable of executing said updated antivirus file automatically upon receipt, whereby no affirmative user commands are required during a time period between said establishment of said Internet connection and a completed installation of the updated antivirus file.

5. The method of claim 4, further comprising the step of notifying the user that said installation of said updated installation file is complete.

6. A method for providing an updated antivirus file to a client computer for use by antivirus application software on the client computer, comprising the steps of:

storing the updated antivirus file on a central antivirus server;

transmitting the updated antivirus file from said central antivirus server to a push administration computer connected to the Internet, said push administration computer being capable of transmitting antivirus update files to said client computer using push technology, said push administration computer also being adapted for transmitting non-antivirus file information to the client computer;

retrieving, from an antivirus update database associated with one of the central antivirus server and the push administration computer, information about a current antivirus file installed on the client computer; and

transferring the updated antivirus file from said push administration computer to the client computer over the Internet using push technology, if it is determined from the retrieved information that the updated antivirus file supersedes the current antivirus file.

7. The method of claim 6, further comprising the step of installing push agent software onto the client computer, said push agent software being capable of instructing said client computer to communicate over the Internet with said push administration server when said client computer is connected to the Internet, said push agent software being capable of instructing said computer to receive the updated antivirus file from said central antivirus server across an antivirus update subscriber channel.

8. The method of claim 7, further comprising the step of establishing a connection between the client computer to the Internet, wherein said push agent software receives the antivirus update file in a background procedure which is substantially transparent to a user of the client computer.

9. The method of claim 8, wherein said updated antivirus file is a self-extracting archive file, and wherein said push agent software is capable of executing said updated antivirus file automatically upon receipt, whereby no affirmative user commands are required during a time period between said establishment of said Internet connection and a completed installation of the updated antivirus file.

10. The method of claim 9, further comprising the step of notifying the user that said installation of said updated installation file is complete.

11. The method of claim 10, further comprising the steps of establishing a news-based subscriber channel between said push administration computer and the client computer, thereby increasing the likelihood that the user will likewise establish an antivirus update channel between said push administration computer and the client computer.

12. A method for providing updated antivirus files to a plurality of client computers on a local area network, the client computers being supported by a common service computer on the local area network, the common service computer being operated by a system administrator, the method for providing allowing for minimal affirmative involvement by the system administrator in updating antivirus files on the plurality of client computers, the method for providing comprising the steps of:

storing the updated antivirus files on a central antivirus server;

transmitting the updated antivirus files from said central antivirus server to a push administration computer connected to the Internet;

transmitting the updated antivirus files from said push administration computer to said service computer using push technology; and

obtaining, from a network antivirus database, information about current antivirus files installed on each client computer; and

executing an automatic installation script at said service computer for automatically installing updated antivirus information on said plurality of client computers across the local area network, if it is determined from the retrieved information that the updated antivirus files supersede the current antivirus files on each corresponding client computer.

13. The method of claim 12, wherein the network antivirus database comprises:

an identifier for each of the plurality of client computers;

a first field for storing an identifier of the operating system used by each of the plurality of client computers;

a second field for storing the identity of the last updated antivirus file received by each of said plurality of computers; and

wherein said service computer transmits information from said network antivirus database to said push administration computer prior to receiving the updated antivirus files.

14. The method of claim 12, wherein the network antivirus database comprises:

an identifier for the local area network;

an identifier for each of the plurality of client computers on the local area network;

a first field for storing an identifier of the operating system used by each of the plurality of client computers on the local area network;

a second field for storing the identity of the last updated antivirus file received by each of said plurality of computers on the local area network.

15. In a computer network comprising a wide area packet switched network, a first computer coupled to the packet switched network, and a second computer intermittently coupled to the packet-switched network, a method for providing an updated antivirus file from the first computer to the second computer in a manner which is transparent to a user of the second computer, comprising the steps of:

at the first computer, executing a first program for detecting when said second computer is connected to said packet switched network;

when the second computer is connected to the packet-switched network, transmitting a first signal from the second computer to the first computer indicating that the second computer is connected to the packet-switched network;

retrieving at the first computer, from an antivirus update database, information about a current antivirus file installed on the second computer to determine whether said second computer has received the most recently updated antivirus file; and

if, based on said retrieved information, said second computer has not received the most recently updated antivirus file, transmitting said most recently updated antivirus file from the first computer to the second computer across the packet switched network.

16. The method of claim 15, further comprising the step of, subsequent to said step of transmitting said most recently updated antivirus file, updating said antivirus update database with the identity of said most recently updated antivirus file transmitted to the second computer.

17. A method for providing antivirus files to a plurality of client computers connected to a first network, the client computers being connected to a common service computer also connected to said first network, the method for providing comprising:

installing a first set of antivirus files on each of said plurality of client computers;

storing a second set of antivirus files on a central antivirus server, at least one of said second set of antivirus files comprising an updated version of at least one of said antivirus files in said first set;

transmitting the second set of antivirus files from said central antivirus server to a push administration computer connected to the internet;

maintaining in an antivirus update database associated with one of the central antivirus server and the push administration computer, information reflective of which antivirus files are to be updated on each of said plurality of client computers, and when each of said antivirus files on each of the computers was last updated;

transmitting the second set of antivirus files from said push administration computer to said service computer using push technology; and

executing an installation script at said service computer to automatically install said second set of antivirus files on said plurality of client computers across said first network.

18. The method of claim 17, comprising the step of transmitting said first set of antivirus files from said push administration computer to said common service computer, prior to installing said first set of antivirus files on said plurality of client computers.

19. The method of claim 17, wherein the second set of antivirus files is transmitted to said common service computer in accordance with a subscription plan associated with said plurality of client computers.

20. A method for providing antivirus files to a client computer connected to the internet via an internet service provider, the method for providing comprising:

installing a first set of antivirus files on said client computer;

storing a second set of antivirus files on a central antivirus server, at least one of said second set of antivirus files comprising an updated version of at least one of said antivirus files in said first set;

transmitting the second set of antivirus files from said central antivirus server to a push administration computer connected to the internet;

maintaining in an antivirus update database associated with one of the central antivirus server and the push administration computer, information reflective of which antivirus files are to be updated on the client computer, and when each of said antivirus files on said client computer was last updated;

transmitting the second set of antivirus files from said push administration computer to said client computer using push technology; and

automatically installing said second set of antivirus files on said client computer.

21. The method of claim 20, wherein the second set of antivirus files is transmitted to said client computer in accordance with a subscription plan associated with said client computer.

22. A method for providing antivirus files to a client computer connected to the internet, the method comprising:

installing a first set of antivirus files on said client computer;

storing a second set of antivirus files on a central antivirus server, at least one of said second set of antivirus files comprising an updated version of at least one of said antivirus files in said first set;

transmitting the second set of antivirus files from said central antivirus server to a push administration computer connected to the internet;

maintaining in an antivirus update database not associated with the client computer, information reflective of which antivirus files are to be updated on the client computer, and when each of said antivirus files on said client computer was last updated;

transmitting the second set of antivirus files from said push administration computer to said client computer using push technology; and

automatically installing said second set of antivirus files on said client computer if, based on information retrieved from said antivirus update database, the second set of antivirus files supersedes said first set of antivirus files.

23. The method of claim 22, wherein the antivirus update database is associated with the push administration computer.

24. The method of claim 22, wherein the antivirus update database is associated with the central antivirus server.

25. The method of claim 22, wherein the antivirus update database is associated with a service computer connected to the client computer.