Method and system for retrieving an anti-virus signature from one or a plurality of virus-free certificate authorities

• US 6,976,271 B1
• Filed: 09/19/2000
• Issued: 12/13/2005
• Est. Priority Date: 01/06/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Le Pennec, Jean-Francois, Hericourt, Olivier
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US09/665,524
• Time in Patent Office: 1,911 Days
• Field of Search: 713/156, 713/158, 713/202, 713/200, 713/201, 713/175, 713/176, 713/188, 709/219, 709/203, 709/223, 709/224, 707/9, 717/178, 715/500, 714/4, 705/7, 345/744
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method and system as disclosed for use in a virus-free certificate proxy (107, 801), of retrieving from one or a plurality of virus-free certificate authorities (104, 804) a virus-free certificate (200) certifying that a file is virus-free. The method includes the steps of: receiving (1001) virus-free certificate request for a file; selecting a virus-free certificate authority (104, 804) having authority to generate a virus-free certificate (200) for the file; requesting (1003 . . . 1007) the virus-free certificate to the selected virus-free certificate authority (104, 804); receiving (1003 . . . 1007) from the selected virus-free certificate authority the generated virus-free certificate; sending back (1005) in response to the virus-free certificate request the received virus-free certificate.

Claims

1. A method for use in a virus-free certificate proxy, of retrieving from one or a plurality of virus-free certificate authorities a virus-free certificate certifying that a file is virus-free, said method comprising the steps of:

receiving a virus-free certificate request for a file;

selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file;

requesting the virus-free certificate to the selected virus-free certificate authority;

receiving from the selected virus-free certificate authority the generated virus-free certificate; and

sending back in response to the virus-free certificate request the received virus-free certificate; and

wherein the virus-free certificate request comprises;

a list of one or a plurality of anti-virus programs to execute on the file to determine whether the file is virus-free or not and the file for which the virus-free certificate is requested.

2. The method according to claim 1 wherein the virus-free certificate request comprises:

an identification of the file comprising;

a file identity, or

an identification of the provider of the file, or

both.

3. The method according to claim 1 wherein the step of selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file comprises the further steps of:

determining whether the virus-certificate request comprises an identification of a virus-free certificate authority or not; and

if the virus-free certificate request does not comprises an identification of a virus-free certificate authority, selecting a virus-free certificate authority referring to a first table, said first table comprising for each identified file a list of one or a plurality anti-virus programs, each list being associated with a virus-free certificate authority.

4. The method according to claim 3 wherein the step of selecting a virus-free certificate authority referring to a first table comprises the steps of:

determining whether the file is identified or not in the first table;

if the file is identified in the first table, selecting a list of one or a plurality of anti-virus programs according to a list of one or plurality of anti-virus programs that is included in the virus-free certificate request;

determining whether a virus-free certificate authority is associated with the selected list or not; and

if a virus-free certificate authority is associated with the selected list, selecting the virus-free certificate authority associated with the selected list.

5. The method according to claim 3 wherein the step of selecting a virus-free certificate authority referring to a first table comprises the steps of:

determining whether the file is identified or not in the first table;

if the file is identified in the first table, selecting a list of one or a plurality of anti-virus programs according to a list of one or plurality of anti-virus programs that is included in the virus-free certificate request;

determining whether a virus-free certificate authority is associated with the selected list or not;

if a virus-free certificate authority is not associated with the selected list, determining whether a virus-free certificate relay is associated with the selected list or not; and

if a virus-free certificate relay is associated with the selected list, selecting a virus-free certificate authority referring to the virus-free certificate relay.

6. The method according to claim 5 wherein the step of selecting a virus-free certificate authority referring to a virus-free certificate relay comprises the step of:

selecting a virus-free certificate authority referring to a second table in said virus-free certificate relay, said second table comprising for each identified file a list of one or a plurality of anti-virus programs, each list being associated with a virus-free certificate authority.

7. The method according to claim 3 wherein the step of selecting a virus-free certificate authority referring to a first table comprises the steps of:

determining whether the file is identified or not in the first table; and

if the file is not identified in the first table, selecting a default virus-free certificate authority in the first table.

8. The method according to claim 1 wherein the step of selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file comprises the further steps of:

determining whether the virus-certificate request comprises an identification of a virus-free certificate authority or not;

if the virus-free certificate request does not comprise an identification of a virus-free certificate authority, determining whether the virus-certificate request comprises an identification of a virus-free certificate relay or not; and

if the virus-certificate request does not comprise an identification of a virus-free certificate relay, selecting a virus-free certificate authority referring to a first table, said first table comprising for each identified file a list of one or a plurality anti-virus programs, each list being associated with a virus-free certificate authority, or a virus-free certificate relay or both.

9. The method according to claim 1 wherein the step of selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file comprises the further steps of:

determining whether the virus-certificate request comprises an identification of a virus-free certificate authority or not; and

if the virus-free certificate request comprises an identification of a virus-free certificate authority, selecting the virus-free certificate authority identified in the virus-free certificate request.

10. The method according to claim 1 wherein the step of selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file comprises the further steps of:

determining whether the virus-certificate request comprises an identification of a virus-free certificate authority or not;

if the virus-free certificate request does not comprises an identification of a virus-free certificate authority, determining whether the virus-certificate request comprises an identification of a virus-free certificate relay or not; and

if the virus-certificate request comprises an identification of a virus-free certificate relay, selecting a virus-free certificate authority referring to the virus-free certificate relay.

11. The method according to claim 1 wherein the generated virus-free certificate comprises:

a file signature for certifying that the file is declared virus-free by the selected virus-free certificate authority.

12. The method according to claim 1 wherein the virus-free certificate further comprises:

a file identification;

a virus-free certificate authority identification;

a public key for decrypting the file signature;

a certificate signature for authenticating the virus-free certificate; and

an indication of the virus-free certificate validity.

13. A system implementing a virus-free certificate proxy, said system comprising a processor that executes a program for implementing a method having the steps of:

receiving virus-free certificate request for a file;

selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file;

requesting the virus-free certificate to the selected virus-free certificate authority;

receiving from the selected virus-free certificate authority the generated virus-free certificate; and

sending back in response to the virus-free certificate request the received virus-free certificate; and

wherein the virus-free certificate request comprises;

a list of one or a plurality of anti-virus programs to execute on the file to determine whether the file is virus-free or not and the file for which the virus-free certificate is requested.

14. A computer program recorded on a computer-readable medium and comprising instructions for executing a method having the steps of:

receiving virus-free certificate request for a file;

selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file;

requesting the virus-free certificate to the selected virus-free certificate authority;

receiving from the selected virus-free certificate authority the generated virus-free certificate; and

sending back in response to the virus-free certificate request the received virus-free certificate; and

wherein the virus-free certificate request comprises;

a list of one or a plurality of anti-virus programs to execute on the file to determine whether the file is virus-free or not and the file for which the virus-free certificate is requested.

15. A method for use in a virus-free certificate proxy, of retrieving from one or a plurality of virus-free certificate authorities a virus-free certificate certifying that a file is virus-free, said method comprising the steps of:

receiving a virus-free certificate request for a file;

selecting a virus-free certificate authority having authority to generate a virus-free certificate for the file;

requesting the virus-free certificate to the selected virus-free certificate authority;

receiving from the selected virus-free certificate authority the generated virus-free certificate; and

sending back in response to the virus-free certificate request the received virus-free certificate;

determining whether the virus-certificate request comprises an identification of a virus-free certificate authority or not; and

if the virus-free certificate request does not comprises an identification of a virus-free certificate authority, selecting a virus-free certificate authority referring to a first table, said first table comprising for each identified file a list of one or a plurality anti-virus programs, each list being associated with a virus-free certificate authority, and

wherein the virus-free certificate request comprises;

a list of one or a plurality of anti-virus programs to execute on the file to determine whether the file is virus-free or not, and an identification of the file comprising;

a file identity, or an identification of the provider of the file, or both.