Computer virus protection

• US 9,906,550 B2
• Filed: 06/04/2014
• Issued: 02/27/2018
• Est. Priority Date: 06/22/2000
• Status: Expired due to Fees

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: Stewart, Walter Mason, Carrera, Marcelo, Hook, Robert G.
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US14/295,636
• Publication Number:
  US 20140289857A1
• Time in Patent Office: 1,364 Days
• Field of Search: 726 24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 51/066 Format adaptation, e.g. format conversion or compression
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A network is protected from e-mail viruses through the use of a sacrificial server. Any executable programs or other suspicious parts of incoming e-mail messages are forwarded to a sacrificial server, where they are converted to non-executable format such as Adobe Acrobat PDF and sent to the recipient. The sacrificial server is then checked for virus activity. After the execution is completed, the sacrificial server is rebooted.

Claims

1. A method comprising:

receiving, at a sacrificial computing device, a message from an email server, wherein the received message includes a file comprising an executable code;

disconnecting the sacrificial computing device from communication with the email server after receiving the message from the email server;

executing the executable code at the sacrificial computing device while the sacrificial computing device is disconnected from communication with the email server;

performing a check of the sacrificial computing device to identify unexpected changes after executing the executable code;

if the unexpected changes are identified, activating a virus alert and executing a ghost copy reboot of the sacrificial computing device; and

re-establishing a communication connection between the sacrificial computing device and the email server.

2. The method of claim 1, wherein the message includes an email attachment.

3. The method of claim 1, further comprising converting the file to a secure format.

4. The method of claim 3, further comprising encrypting the file in the secure format using an encryption key.

5. The method of claim 4, further comprising communicating the encrypted file to the email server.

6. The method of claim 1, further comprising, if the unexpected changes are not identified, encrypting the file using an encryption key.

7. The method of claim 1, wherein the ghost copy reboot is located in a read only memory.

8. The method of claim 1, further comprising determining if the file is of a type of disapproved attachment types.

9. The method of claim 1, wherein the unexpected changes comprise any one of addition or deletion of files, changing file name, file extension, or file content unexpectedly, morphing of the file, and attempted sensing of date and time features.

21. The method of claim 1, further comprising identifying a presence of a malicious code in response to executing the executable code and performing the check of the sacrificial computing device.

22. The method of claim 1, wherein performing the check of the sacrificial computing device to identify unexpected changes is performed while the sacrificial computing device is disconnected from communication with the email server.

10. A system comprising:

an email server configured to send and receive email messages; and

a sacrificial computing device configured to receive a message from the email server, wherein the received message includes a file comprising an executable code, wherein the sacrificial computing device includes a processor configured to;

disconnect the sacrificial computing device from communication with the email server after receiving the message from the email server;

execute the executable code while the sacrificial computing device is disconnected from communication with the email server;

perform a check of the sacrificial computing device to identify unexpected changes after executing the executable code;

activate a virus alert and execute a ghost copy reboot of the sacrificial computing device if unexpected changes are identified; and

re-establish a communication connection between the sacrificial computing device and the email server.

11. The system of claim 10, wherein the message includes an email attachment.

12. The system of claim 10, wherein the processor is further configured to convert the file to a secure format.

13. The system of claim 12, wherein the processor is further configured to encrypt the file in the secure format using an encryption key.

14. The system of claim 13, wherein the processor is further configured to communicate the encrypted file to the email server.

15. A non-transitory computer readable storage medium having instructions stored thereon that, upon execution by a computing device, cause the computing device to perform operations comprising:

disconnecting a sacrificial computing device from communication with the email server after receiving a message from an email server, wherein the received message includes a file comprising an executable code;

executing the executable code at the sacrificial computing device while the computing device is disconnected from communication with the email server;

performing a check of the sacrificial computing device to identify unexpected changes after executing the executable code;

if the unexpected changes are identified, activating a virus alert and executing a ghost copy reboot of the sacrificial computing device; and

re-establishing a communication connection between the sacrificial computing device and the email server.

16. The computer readable storage medium of claim 15, further comprising, encrypting the file using an encryption key if the unexpected changes are not identified.

17. The computer readable storage medium of claim 15, wherein the ghost copy reboot is located in a read only memory.

18. The computer readable storage medium of claim 15, further comprising determining if the file is of a type of disapproved attachment types.

19. The computer readable storage medium of claim 15, further comprising converting the file to a secure format.

20. The computer readable storage medium of claim 19, wherein the operations further comprising communicating the encrypted file the email server.