Virus detection in mobile devices having insufficient resources to execute virus detection software

• US 7,945,955 B2
• Filed: 09/11/2007
• Issued: 05/17/2011
• Est. Priority Date: 12/18/2006
• Status: Expired due to Fees

• Current Assignee: Cat Computer Services PVT Limited
• Original Assignee: Quick Heal Technologies Limited
• Inventors: Katkar, Sanjay Sahebrao
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US11/853,071
• Publication Number:
  US 20080148407A1
• Time in Patent Office: 1,344 Days
• Field of Search: 713/188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

A virus scanning system which scans a mobile device/mobile device for files containing viruses even if the files are not executable on the mobile device. Corrective actions such as removing the files can be performed once the viruses are detected. As a result, viruses which are not executable (as being designed for other mobile device types) can also be detected and removed from mobile devices. According to another aspect, a common interface is provided when a virus scanning program requests data from mobile devices, and the computer is provided with different remote application programming interfaces suited to retrieve the specified data from the corresponding mobile devices. As a result, the computer can be extended to integrate scanning of new device types easily. According to one more aspect, a scanning program retrieves only data portions required for continuing the scan operation. According to yet another aspect, the program modules and virus definitions for scanning are received from a server on a network.

Claims

1. A method of scanning a mobile device for existence of a set of viruses, said method comprising:

establishing, from a system, communication with said mobile device;

determining, in said system, a portion of a file required to scan said file present on said mobile device, wherein said portion is determined by a program logic underlying a virus scan software;

retrieving, by said system, said portion from said file on said mobile device;

scanning, in said system, said portion to determine whether any of said set of viruses are present on said file;

determining in said system, whether another portion of said file is required to continue scan according to said program logic;

retrieving by said system from said mobile device, said another portion by sending an identifier of said another portion, and repeating said scanning if said determining indicates that said another portion is required,

wherein said system is external to said mobile device,

whereby said entire file need not be retrieved into said system to determine existence of said set of virus programs.

2. The method of claim 1, wherein said mobile device is of a first operating environment and a first virus contained in said set of viruses is not designed to execute in said first operating environment, said method further comprising:

receiving in said system information indicating that said mobile device is of said first operating environment,

wherein said scanning detects the existence of said first virus in said file even though said first virus is designed not to execute in said first operating environment indicated by said received information.

3. The method of claim 2, further comprising removing said first file from said mobile device upon detection of said first virus in said file.

4. The method of claim 1, wherein said retrieving comprises sending a first request to provide said portion of said file according to an Application Programming Interface (API) and sending a second request to provide said another portion of said file according to said API.

5. The method of claim 1, wherein said mobile device is a mobile phone.

6. A method of detecting a plurality of mobile devices each having a corresponding one of a plurality of operating environments and exposure to execution of a corresponding one of a plurality of sets of viruses, said method being implemented in a single scan application on a system external to said plurality of mobile devices, said method comprises:

implementing a plurality of device interfaces, wherein each of said plurality of device interfaces comprises a respective Application Programming Interface (API) to perform operations related to data in the form of files stored according to corresponding one of said plurality of operating environments on the respective mobile devices;

receiving information indicating a first operating environment present on a first mobile device sought to be scanned, said first operating environment being comprised in said plurality of operating environments and said first mobile device being comprised in said plurality of mobile devices, a first device interface contained in said plurality of device interfaces having the ability to interface with said first mobile device;

sending commands via the API of said first interface to access content of a file present on said first mobile device; and

scanning said file for existence of viruses.

7. The method of claim 6, providing a common interface using which said single scan application can request said file irrespective of the operating environment of said plurality of mobile devices, wherein each of said plurality of interfaces is designed to interface with said common interface also.

8. The method of claim 7, wherein said scanning scans said first mobile device for each of said plurality of sets of viruses.

9. A non-transitory computer readable medium carrying one or more sequences of instructions to cause a digital processing system to detect a plurality of mobile devices each having a corresponding one of a plurality of operating environments and exposure to execution of a corresponding one of a plurality of sets of viruses, said computer readable medium carrying a single scan application, said digital processing system being external to said plurality of mobile devices, wherein execution of said one or more sequences of instructions by one or more processors contained in said digital processing system causes said one or more processors to perform the actions of:

implementing a plurality of device interfaces, wherein each of said plurality of device interfaces comprises a respective Application Programming Interface (API) to perform operations related to data in the form of files stored according to corresponding one of said plurality of operating environments on the respective mobile devices;

receiving information indicating a first operating environment present on a first mobile device sought to be scanned, said first operating environment being comprised in said plurality of operating environments and said first mobile device being comprised in said plurality of mobile devices;

identifying a first device interface contained in said plurality of device interfaces having the ability to interface with said first mobile device;

sending commands related to file operations via the API of said first interface in response to said identifying to access content of a file present on said first mobile device; and

scanning said file for existence of viruses.

10. A method of scanning a mobile device for existence of a plurality of viruses, said method comprising:

receiving in a system, a request for scanning said mobile device, said request being received from a user of said system which is external to said mobile device;

determining in said system, a type of said mobile device;

obtaining in said system, from a server a plurality of program modules and virus definitions together designed to scan said type of said mobile device, wherein said server is designed to maintain program modules and virus definitions for many types of mobile device, wherein the specific program modules and virus definitions corresponding to said type are obtained based on said determining; and

executing, in said system, said plurality of program modules based on said virus definitions to identify viruses present on said mobile device,

wherein said determining, said obtaining and said executing are performed in response to receiving of said request for scanning,

wherein said system and said server are separate processing systems external to said mobile device.

11. A method of providing a plurality of program modules and virus definitions from a server to a system to scan a mobile device for existence of a plurality of viruses, said system being external to said mobile device, said method being performed in said server, said method comprising:

receiving a type of said mobile device on a network;

selecting said plurality of program modules and virus definitions designed to scan said type of said mobile device; and

sending said plurality of program modules and virus definitions to said system on said network.