System and methods providing anti-virus cooperative enforcement

• US 6,873,988 B2
• Filed: 07/09/2002
• Issued: 03/29/2005
• Est. Priority Date: 07/06/2001
• Status: Expired due to Term

• Current Assignee: Check Point Software Technologies Incorporated (Check Point Software Technologies Limited)
• Original Assignee: Check Point Software Technologies Incorporated (Check Point Software Technologies Limited)
• Inventors: Baharestan, Kaveh, Bentley, Joseph E., Leroy, Jess A., Herrmann, Conrad K.
• Primary Examiner(s): Mizrahi, Diane D.
• Assistant Examiner(s): Wu, Yicun
• Application Number:
  US10/192,819
• Publication Number:
  US 20030055994A1
• Time in Patent Office: 994 Days
• Field of Search: 707/1, 707/2, 707/3, 707/4, 707/5, 707/6, 707/7, 707/8, 707/10, 707/9, 707/100, 707/104.1, 707/200, 713/200, 713/152, 435/5
• US Class Current: 1/1
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2876 Handling of subscriber policies group policies management H04L41/0893
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

A system providing methods for anti-virus cooperative enforcement is described. In response to a request from a device for access to protected resources, such as a network or protected data, a determination is made as to whether an anti-virus policy applies to the request for access made by the device. If an anti-virus policy is applicable, information pertaining to virus protection available on the device is collected. The virus protection information that is collected is evaluated to determine whether the device is in compliance with the anti-virus policy. If the device is determined to be in compliance with the anti-virus policy, the device is allowed to access the protected resources.

Claims

1. A method for verifying that a device is in compliance with an anti-virus policy required in order to access protected resources, the method comprising:

in response to a request from a device for access to protected resources, determining whether an anti-virus policy is applicable to said device;

if an anti-virus policy is applicable to said device, retrieving information pertaining to virus protection available on said device;

determining whether said device is in compliance with said anti-virus policy based upon said information pertaining to said virus protection available on said device; and

if said device is determined to be in compliance with said anti-virus policy, allowing said device to access said protected resources.

2. The method of claim 1, further comprising:

detecting requests from said device for access to protected resources.

3. The method of claim 1, wherein said step of determining whether an anti-virus policy is applicable to said device includes the substeps of:

detecting requests from said device for access to protected resources; and

retrieving an anti-virus policy applicable to said device.

4. The method of claim 1, wherein said anti-virus policy includes a rule requiring a particular virus protection module to be available on said device.

5. The method of claim 1, wherein said anti-virus policy includes a rule requiring a particular virus definition file to be available on said device.

6. The method of claim 1, wherein said anti-virus policy includes a rule requiring a particular anti-virus engine to be available on said device.

7. The method of claim 1, wherein said step of retrieving information pertaining to virus protection available on said device includes retrieving said information using an interface to a virus protection module.

8. The method of claim 7, wherein said interface operates in conjunction with a plurality of virus protection modules.

9. The method of claim 1, wherein said step of retrieving information pertaining to virus protection available on said device includes retrieving information about a virus definition file.

10. The method of claim 1, wherein said step of retrieving information pertaining to virus protection available on said device includes retrieving information about an anti-virus engine.

11. The method of claim 1, wherein said step of determining whether said device is in compliance with said anti-virus policy includes evaluating information about an anti-virus engine.

12. The method of claim 1, wherein said step of determining whether said device is in compliance with said anti-virus policy includes evaluating information about a virus definition file.

13. The method of claim 1, wherein said step of determining whether said device is in compliance with said anti-virus policy includes comparing information about virus protection available on said device with information about virus protection available on at least one other device.

14. The method of claim 1, wherein said step of determining whether said device is in compliance with said anti-virus policy includes the substeps of:

retrieving virus protection information from at least one other device; and

comparing virus protection information about said device with virus protection information retrieved from said at least one other device.

15. The method of claim 1, wherein said step of allowing said device to access said protected resources includes notifying a gateway server to permit access to said protected resources.

16. The method of claim 1, wherein said step of allowing said device to access said protected resources includes assigning an access policy to said device, said access policy specifying protected resources that can be accessed by said device.

17. The method of claim 1, further comprising:

if said device is determined not to be in compliance with said anti-virus policy, preventing access to said protected resources.

18. The method of claim 1, further comprising:

redirecting a device that is not in compliance with said anti-virus policy to a sandbox server.

19. The method of claim 18, further comprising:

displaying a message to any device that is not in compliance with said anti-virus policy.

20. The method of claim 1, further comprising:

providing for said anti-virus policy to be updated periodically.

21. The method of claim 20, wherein said updated policy is automatically applied to a device.

22. The method of claim 1, further comprising:

receiving an anti-virus policy requiring use of a particular virus definition file; and

automatically requiring use of said particular virus definition file in order to access said protected resources.

23. A computer-readable medium having computer-executable instructions for performing the method of claim 1.

24. A downloadable set of computer-executable instructions for performing the method of claim 1.

25. A system for determining whether a computer system is in compliance with anti-virus rules required for access to protected data, the system comprising:

a client module on a computer system that receives a request for access to protected data, invokes a supervisor module, and provides information about said request for access to said supervisor module;

an interface module that obtains information regarding a virus protection module on said computer system; and

a supervisor module that, when invoked by said client module, requests information about said virus protection module in use on said computer system from said interface module, and determines whether to allow said computer system to access said protected data based upon whether said computer system is in compliance with anti-virus rules required for access to said protected data.

26. The system of claim 25, wherein said client module detects requests from said computer system for access to protected data.

27. The system of claim 25, wherein said anti-virus policy includes a particular virus protection module that is required to be in operation on said computer system.

28. The system of claim 25, wherein said anti-virus policy includes a particular virus definition file that is required to be in operation on said computer system.

29. The system of claim 25, wherein said anti-virus policy includes a particular anti-virus engine that is required to be in operation on said computer system.

30. The system of claim 25, wherein said supervisor module determines whether said computer system is in compliance with said anti-virus policy based upon information about said virus protection module on said computer system.

31. The system of claim 25, wherein said virus protection module includes a virus protection engine and at least one virus definition file.

32. The system of claim 25, wherein said interface module operates in conjunction with virus protection modules from a plurality of vendors.

33. The system of claim 25, wherein said interface module obtains information about at least one virus definition file on said computer system.

34. The system of claim 33, wherein said information about said virus definition file includes a selected one of publication date and version number.

35. The system of claim 25, wherein said interface module obtains information about a virus protection engine on said computer system.

36. The system of claim 35, wherein said information about said virus protection engine includes a selected one of publication date and version number.

37. The system of claim 25, wherein said supervisor module determines whether said computer system is in compliance with said anti-virus policy by comparing information about said virus protection module on said computer system with information about a virus protection module on at least one other device.

38. The system of claim 25, wherein said supervisor module determines whether said computer system is in compliance with said anti-virus policy based upon version information about said virus protection module.

39. The system of claim 25, wherein said supervisor module determines whether said computer system is in compliance with said anti-virus policy based upon publication date information about said virus protection module.

40. The system of claim 25, wherein said supervisor module prevents access to said protected data if said computer system is determined not to be in compliance with said anti-virus policy.

41. The system of claim 25, further comprising:

a sandbox server for providing information to computer systems not in compliance with said anti-virus policy.

42. A method for enforcing compliance with an anti-virus policy required for a device to obtain access to a network, the method comprising:

detecting a request from a device for access to a network;

determining an anti-virus policy applicable to the device;

collecting information about virus protection available on the device;

determining whether the device is in compliance with the anti-virus policy based upon the collected information; and

based upon said determination, applying an access policy to the device, said access policy for governing access by the device to the network.

43. The method of claim 42, wherein said determining step includes the substeps of:

determining the device requesting access to the network; and

retrieving an anti-virus policy applicable to that device.

44. The method of claim 42, wherein said collecting step includes retrieving the information using an interface to a virus protection application available on the device.

45. The method of claim 42, wherein said collecting step includes retrieving information about a virus definition file of said virus protection application.

46. The method of claim 42, wherein said collecting step includes retrieving information about a virus protection engine of said virus protection application.

47. The method of claim 42, wherein said determining step includes comparing the collected information to requirements of the anti-virus policy.

48. The method of claim 42, wherein said determining step includes comparing the collected information with information about an virus protection application on at least one other device.

49. The method of claim 42, wherein said determining step includes the substeps of:

retrieving virus protection information from at least one other device; and

comparing the collected information about the device to the information retrieved from said at least one other device.

50. The method of claim 42, further comprising:

displaying a message to a device that is not in compliance with said anti-virus policy.

51. The method of claim 42, further comprising:

providing for said anti-virus policy to be updated periodically.

52. The method of claim 51, wherein said updated anti-virus policy is automatically applied to a device.

53. The method of claim 51, further comprising:

receiving an updated anti-virus policy requiring a particular virus definition file; and

denying access to the network until said particular virus definition file is available on a device.

54. A method for requiring a plurality of devices connected to a network to apply a particular virus protection update, the method comprising:

receiving a request requiring devices connected to a network to apply a particular virus protection update;

determining whether each device connected to the network has applied the required virus protection update;

if a given device has applied the required update, permitting that device to continue to access the network; and

if a given device has not applied the required update, terminating access to the network by that device.

55. The method of claim 54, wherein said request is a virus alert issued by a user.

56. The method of claim 54, wherein said particular virus protection update is a virus definition file update.

57. The method of claim 56, wherein a particular virus definition file version number is required.

58. The method of claim 56, wherein a virus definition file published more recently than a given time is required.

59. The method of claim 54, wherein said particular virus protection update is a virus protection engine update.

60. The method of claim 59, wherein a particular virus engine version number is required.

61. The method of claim 59, wherein a virus engine update published more recently than a given time is required.

62. The method of claim 54, wherein said determining step includes collecting virus protection information from each device.

63. The method of claim 54, wherein said determining step includes the substeps of:

collecting virus protection information from each device; and

comparing the collected information to the virus protection update requirement.

64. The method of claim 54, wherein said step of terminating access to the network includes redirecting the device to a sandbox server for installation of the required virus protection update.

65. The method of claim 54, further comprising:

issuing a notification to a device that has not applied the required update.