Embedded anti-virus scanner for a network adapter

• US 9,055,098 B2
• Filed: 09/12/2007
• Issued: 06/09/2015
• Est. Priority Date: 12/20/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Rothwell, Anton C., Dennis, William R., Jagger, Luke D.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Pan, Peiliang
• Application Number:
  US11/854,419
• Publication Number:
  US 20130246620A1
• Time in Patent Office: 2,827 Days
• Field of Search: 709/250, 709/224, 726 22- 24, 370/463, 375/219, 375/222
• US Class Current: 1/1
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A network adapter system and associated method are provided. The network adapter system includes a processor positioned on a network adapter coupled between a computer and a network. Such processor is configured for scanning network traffic transmitted between the computer and the network.

Claims

1. A network adapter system, comprising:

a processor positioned on a network adapter and configured to assemble received packets, to perform a scan on the received packets to identify a virus, a worm, or a Trojan horse, in response to a determination that the received packets use a hypertext transfer protocol or a file transfer protocol, and to bypass the scan on the received packets, in response to a determination that the received packets do not use the hypertext transfer protocol or the file transfer protocol.

2. The network adapter system as recited in claim 1, wherein the network adapter system is user-configured.

3. The network adapter system as recited in claim 2, wherein the network adapter system is user-configured locally.

4. The network adapter system as recited in claim 2, wherein the network adapter system is user-configured remotely via a network connection with the network adapter.

5. The network adapter system as recited in claim 2, wherein the network adapter system is user-configured only after a verification of a password.

6. The network adapter system as recited in claim 2, wherein settings of the network adapter are user-configured.

7. The network adapter system as recited in claim 1, wherein the network adapter system directly passes the received packets that do not use the hypertext transfer protocol or the file transfer protocol to a computer.

8. The network adapter system as recited in claim 7, wherein the network adapter denies an access of the received packets that fail the scan to the computer.

9. The network adapter system as recited in claim 1, wherein the scan is performed based on user settings.

10. A method for scanning network traffic, the method comprising:

receiving packets at a network adapter including a processor positioned thereon;

assembling the received packets;

scanning the received packets utilizing the processor to identify a virus, a worm, or a Trojan horse, in response to determining that the received packets use a hypertext transfer protocol or a file transfer protocol; and

bypassing the scanning, in response to determining the received packets do not use the hypertext transfer protocol or the file transfer protocol.

11. The method as recited in claim 10, wherein the network adapter is user-configured.

12. The method as recited in claim 11, wherein the network adapter is user-configured locally.

13. The method as recited in claim 11, wherein the network adapter is user-configured remotely via a network connection with the network adapter.

14. The method as recited in claim 11, wherein the network adapter is user-configured only after a verification of a password.

15. A network adapter system, comprising:

means for assembling at least some received packets; and

means for performing a scan on the received packets to identify a virus, a worm, or a Trojan horse, in response to a determination that the received packets use a hypertext transfer protocol or a file transfer protocol, and for bypassing the scan, in response to a determination that the received packets do not use the hypertext transfer protocol or the file transfer protocol.

16. The network adapter system as recited in claim 15, wherein the received packets bypass the scan, in response to a determination that the received packets complete a file.

17. The network adapter system as recited in claim 16, wherein the received packets bypass the scan, in response to a determination that the file is not an executable file.

18. The network adapter system as recited in claim 15, wherein the received packets are denied access to a computer in response to a determination that the scan has identified the virus, the worm, or the Trojan horse in the received packets.

19. The network adapter system as recited in claim 15, wherein the means for performing determines whether a file is an executable file, in response to a determination that the received packets complete the file.

20. The network adapter system as recited in claim 19, wherein the means for performing scans the file in response to a determination that the file is the executable file.