MALWARE SCANNER FOR RFID TAGS

• US 20080022160A1
• Filed: 06/21/2007
• Published: 01/24/2008
• Est. Priority Date: 12/30/2005
• Status: Abandoned Application

• Current Assignee: GSI Group Corporation (Novanta Inc.)
• Original Assignee: SkyeTek, Inc. (RFID Holdings, Inc.)
• Inventors: Chakraborty, Sayan
• Application Number:
  US11/766,621
• Publication Number:
  US 20080022160A1
• Time in Patent Office: Days
• US Class Current: 714/100
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A method for detecting and isolating malware stored in an RFID tag. Data stored on the tag is read and scanned to detect malware in the data. if any suspected malware is detected, then the data is stored in a quarantine file in reader memory. The data isolated in the quarantine file may be flagged with a corrupted-tag indicator to indicate the presence of suspected said malware, or a corrupted-tag indicator may be stored in the quarantine file in lieu of the data read from the tag.

Claims

1. A method for detecting and isolating malware stored in an RFID tag comprising:

reading data stored on the tag;

scanning the data read from the tag to detect possible malware in the data; and

if said possible malware is detected, then isolating the data by storing the data in a quarantine file in tag reader memory.

2. The method of claim 1, further including flagging the data isolated in the quarantine file with a corrupted-tag indicator to indicate the presence of suspected said malware.

3. The method of claim 1, wherein a corrupted-tag indicator is stored in the quarantine file instead of the data read from the tag.

4. The method of claim 1, wherein the step of scanning the data includes scanning the data for at least one data situation selected from the list of data types and conditions consisting of:

executable code, SQL, out of bounds variables, mismatches between expected and actual data lengths and formats, and rule-based data defined by a set of rules;

to determine the presence of said possible malware.

5. The method of claim 4, wherein the set of rules defines syntax constructions representative of certain computer languages.

6. The method of claim 5, wherein the computer languages include languages selected from the list consisting of SQL, Java, Javascript, C, C++, Perl, Python, Ruby, and Groovy.

7. The method of claim 1, wherein said syntax constructions include keywords selected from the list consisting of SELECT in SQL, an “

if . . . then”

construction, and predefined operators.

8. The method of claim 7, wherein said predefined operators include “

*” and

“

;

=”

.

9. A method for detecting and isolating malware stored in an RFID tag comprising:

reading data stored on the tag;

storing the data in a temporary file;

scanning the data in the temporary file to detect malware in the data; and

if said malware is detected, then storing the data, in a quarantine file in reader memory, together with an indicator to indicate the presence of suspected said malware;

wherein the step of scanning the data includes scanning the data for possible malware including executable code and rule-based data defined by a set of rules.

10. The method of claim 9, wherein the set of rules defines syntax constructions representative of computer languages including languages selected from the list consisting of SQL, Java, Javascript, C, C++, Perl, Python, Ruby, and Groovy.

11. The method of claim 10, wherein said syntax constructions include keywords selected from the list consisting of SELECT in SQL, an “

if . . . then”

construction, and predefined operators, and wherein said predefined operators include “

*” and

“

;

=”

.

12. A method for detecting malware stored in an RFID tag comprising:

reading data stored on the tag; and

scanning the data read from the tag to detect malware in the data;

if said malware is detected, then storing an indicator in a file in tag reader memory, wherein the indicator indicates the presence of suspected said malware;

wherein the step of scanning the data includes;

scanning the data for possible malware including executable code, data format, range, and length mismatches, and rule-based data defined by a set of rules; and

if the data thus scanned includes said possible malware, then isolating the data in a quarantine file in tag reader memory;

wherein the set of rules defines syntax constructions representative of certain computer languages.

13. The method of claim 12, wherein the computer languages include languages selected from the list consisting of SQL, Java, Javascript, C, C++, Perl, Python, Ruby, and Groovy.

14. The method of claim 12, wherein said syntax constructions include keywords selected from the list consisting of SELECT in SQL, an “

if . . . then”

construction, and predefined operators, including “

*” and

“

;

=”

.

15. An RFID reader, including memory for storing data, for detecting malware stored in an RFID tag comprising:

a scanner for detecting malware;

a set of rules, used by the scanner, for detecting malware;

a quarantine file, for isolating suspected malware; and

a temporary file;

wherein;

data stored on the tag is read into the temporary file by the reader and scanned by the scanner for the presence of possible malware;

if said possible malware is detected, then an indicator, indicating the presence of suspected said malware, is stored in the quarantine file in RFID reader memory;

wherein the process of scanning the data includes scanning the data for said possible malware including executable code, data format/range/length mismatches, and rule-based data defined by a set of rules indicating predefined operators and syntax constructions representative of certain computer languages.

16. The method of claim 15, wherein, if said possible malware is detected, then the data read into the temporary file is transferred to the quarantine file.

17. The method of claim 15, further including isolating the data in a quarantine file in tag reader memory if the data thus scanned includes said possible malware.

18. The method of claim 15, wherein the syntax constructions include keywords selected from the list consisting of SELECT in SQL, and an “

if . . . then”

construction.

19. The method of claim 15, wherein the computer languages include languages selected from the list consisting of SQL, Java, Javascript, C, C++, Perl, Python, Ruby, and Groovy.

20. The method of claim 15, wherein the predefined operators include “

*” and

“

;

=”

.