Pre-emptive anti-virus protection of computing systems

• US 20060031937A1
• Filed: 08/05/2004
• Published: 02/09/2006
• Est. Priority Date: 08/05/2004
• Status: Active Grant

• Current Assignee: Digital Guardian LLC
• Original Assignee: Savant Protection, Inc. (Digital Guardian LLC)
• Inventors: Steinberg, Ken
• Granted Patent: US 7,712,135 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/565 by checking file integrity

Abstract

A system is provided that strongly inhibits infection and spread of computer viruses. Valid executable software files and supporting files, even files provided by mass-released commercial software, are associated with a numeric key that is unique to each individual computer running the software. For a file to be processed by the central processing unit (CPU) of the computer, the presence of a valid key must first be verified. Every valid executable file, including files relating to the operating system and application layer code, is provided with a unique key. Thus, viruses that attempt to gain access to the CPU to perform unauthorized actions, including replication, are prevented due to lack of a valid execution key. Execution keys are generated locally on each individual computer using a variety of methods. Execution keys can be regenerated if the security of a computer system has been compromised, or appears to have been compromised.

Claims

1. A method for enabling a computing system to resist infection by a computer virus, the computing system performing the method, the method comprising:

receiving an executable file into the computing system;

determining whether there is a key associated with the executable file;

if there is a key associated with the executable file, verifying the validity of the key; and

only if the key is valid, processing the executable file with a computational processing unit (CPU) of the computing system.

2. The method of claim 1, wherein determining includes:

determining whether the executable file is decrypted, and wherein verifying the validity of the key includes;

decrypting the executable file with a key associated with the executable file.

3. The method of claim 1, wherein the key associated with the executable file is unique to the executable file.

4. The method of claim 1, wherein verifying the validity of the key includes:

comparing the key to a valid execution key.

5. The method of claim 1, wherein verifying the validity of the key includes:

validating the key without reference to another key.

6. The method of claim 1 further comprising:

if determining whether there is a key associated with the executable file determines that there is no key associated with the executable file, and if a user provides authorization, associating a valid key with the executable file.

7. The method of claim 1 further comprising:

if determining whether there is a key associated with the executable file determines that there is no key associated with the executable file, and if a user provides authorization, executing the executable file.

8. The method of claim 1, wherein the key is associated with the executable file upon installation of the executable file onto the computing system.

9. A method for installing software on a computing system so as to inhibit infection and spread of computer viruses, the method comprising:

loading the software into the computing system so as to provide at least one executable file stored in the computing system;

associating a key with the executable file; and

storing key information in a key store of the computing system for validating the key.

10. The method of claim 9, wherein the key associated with the executable file is unique to the executable file.

11. The method of claim 9, wherein associating a key includes encrypting the executable file with the key.

12. The method of claim 9, wherein the key information is a key that matches the key associated with the executable file.

13. The method of claim 9, wherein the key information is an equation for providing a key that matches the key associated with the executable file.

14. The method of claim 9, wherein the key information is an equation for validating the key associated with the executable file.

15. The method of claim 9, wherein associating a key with the executable file includes:

including a key in the header of the executable file.

16. The method of claim 9, wherein associating a key with the executable file includes:

including a key in the footer of the executable file.

17. The method of claim 9, wherein associating a key with the executable file includes:

including a key in the body of the executable file.

18. The method of claim 9, wherein the software is commercially available software.

19. The method of claim 9, wherein every valid executable file, including files relating to the operating system and application layer code, is provided with a unique key.

20. An improved operating system for a computing device, the improved operating system comprising:

a determiner that determines presence of a key associated with an executable file;

a verifier that verifies validity of the key so as to determine presence of a valid key associated with the executable file; and

an execution queue for queuing a plurality of executable files for processing by a processor of the computing device, each executable file being associated with a valid execution key.

21. The improved operating system of claim 20, further comprising:

a scheduler, cooperative with the determiner, that schedules executable files for execution by a computational processing unit (CPU) of the computing device.

22. The improved operating system of claim 20, further comprising:

a quarantine unit that isolates an executable file that is not associated with a valid key.

23. The improved operating system of claim 20, wherein the determiner determines presence of a key associated with an executable file by reading a header of the executable file.

24. The improved operating system of claim 20, wherein the determiner determines presence of a key associated with an executable file by reading a footer of the executable file.

25. The improved operating system of claim 20, wherein the determiner determines presence of a key associated with an executable file by reading a body of the executable file.

26. The improved operating system of claim 20, wherein the determiner determines the presence of a key associated with an executable file by detecting encryption of the file.

27. The improved operating system of claim 20, wherein the verifier verifies validity of the key by comparing the key using key validity information.

28. The improved operating system of claim 20, wherein the verifier verifies validity of the key by decrypting the executable file using the key.

29. A system for use in a computing system, the computing system having a scheduler, an execution queue, and a computational processing unit, the system being for helping the computer system to resist infection by a computer virus, the system comprising:

a verification unit, cooperative with the scheduler, for determining the presence of a key associated with an executable file stored in the computing system, and for verifying the validity of the key so as to determine the presence of a valid key associated with the executable file, a valid key being required to process the executable file with the computational processing unit.

30. The system of claim 29, wherein the verification unit determines the presence and validity of a key associated with the executable file by attempting to decrypt the executable file using a key associated with the executable file.

31. The system of claim 29, wherein the verification unit comprises:

a validation unit for verifying the validity of the key, and for providing one of an executable file associated with a valid key, and an executable file not associated with a valid key; and

a quarantine unit, cooperative with the validation unit, for sequestering an executable file not associated with a valid key.

32. The system of claim 31, the quarantine unit also being for one of:

deleting the executable file not associated with a valid key;

tagging the executable file not associated with a valid key so as to render the executable file non-executable;

allowing execution after communicating the existence of the virus;

allowing execution and gathering information about the virus; and

saving the virus for further study.

33. The system of claim 31, the validation unit verifying the validity of the key by comparing the key with a valid execution key.

34. The system of claim 33, wherein comparing the key with the protected key includes:

performing a logical NOT operation on the key to provide an inverse key;

performing a logical XOR operation on the inverse key and the protected key to as to provide a key comparison result; and

comparing the key comparison result to a selected value to determine the validity of the key.

35. A computer-readable medium incorporating operating system software of a computing system, the operating system software being improved so as to substantially reduce the ability of computer viruses to infect the computing system, the operating system causing the computing system to:

for each executable file loaded onto the computing system, determine presence of a key associated with the executable file;

verify validity of the key so as to determine presence of a valid key associated with the executable file; and

process the executable file using a processor of the computing system only if the presence of a valid key associated with the executable file has been verified.

36. The computer-readable medium of claim 35, wherein the computer-readable medium is a signal received by the computer system.

37. The computer-readable medium of claim 35, wherein the computer-readable medium is an information storage device.

38. A method for preventing further infection by a computer virus due to the spread of the computer virus from a first computing system to a second computing system, the method comprising:

assigning a first key to an executable file containing the computer virus that does not have a valid key, the first key being valid only on the first computing system;

executing the executable file containing the virus on the first computing system, and consequently communicating an executable file containing the virus and first key to a second computing system;

receiving at the second computing system the executable file containing the virus, and verifying at the second computing system whether a key that is valid on the second computing system is present; and

placing the executable file containing the virus and the first key in quarantine upon verification that the first key is not valid on the second computing system, and consequently not allowing the executable file to execute on the second computing system, thereby avoiding infection by the virus of the second computing system, and avoiding further spread of the virus to a third computing system.

39. The method of claim 38, wherein when receiving at the second computing system the executable file containing the virus, the executable file also contains first key.

40. A computer-readable transmitted signal incorporating operating system software of a computing system, the operating system software being improved so as to substantially reduce the ability of computer viruses to infect the computing system, the operating system causing the computing system to:

for each executable file loaded onto the computing system, determine presence of a key associated with the executable file;

verify validity of the key so as to determine presence of a valid key associated with the executable file; and

process the executable file using a processor of the computing system only if the presence of a valid key associated with the executable file has been verified.

41. The computer-readable transmitted signal of claim 40, wherein the computer-readable transmitted signal originates from one of:

a network, a fiber-optic cable, a telephone wire, a radio transmitter, a microwave transmitter, a satellite dish, a cellphone, an automobile, a modem, and a hot-spot.