Update protection system and method

• US 7,516,150 B1
• Filed: 10/29/2004
• Issued: 04/07/2009
• Est. Priority Date: 10/29/2004
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., McCorkendale, Bruce, Szor, Peter
• Primary Examiner(s): Chace; Christian P.
• Assistant Examiner(s): Vu; Bai D
• Application Number:
  US10/978,051
• Time in Patent Office: 1,621 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method includes determining that an entire update name list has been attempted and obtaining a verified IP address from a success history file. The success history file includes verified IP addresses of computer systems from which update information has previously been successfully obtained. The method further includes obtaining update information from a computer system located at the verified IP address.

Claims

1. A method comprising:

obtaining an update name from an update name list on a host computer system comprising a processor, said update name list comprising domain names of sites that distribute update information for protecting said host computer system;

resolving an Internet Protocol address of said update name;

attempting to obtain said update information from a server computer system located at said Internet Protocol address;

determining whether said attempting is successful comprising determining whether integrity of said update information is verified comprising determining whether a signature of a sender of said update information is valid, wherein upon a determination that said attempting is successful, said method further comprising updating a success history file comprising adding a record comprising said Internet Protocol address to said success history file, said success history file is stored in a computer readable storage medium;

wherein upon a determination that said attempting is not successful, said method further comprising determining whether entire update name list has been attempted, wherein upon a determination that said entire update name list has been attempted, said method further comprising obtaining a verified Internet Protocol address from said success history file;

attempting to obtain said update information from a server computer system located at said verified Internet Protocol address;

determining whether said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful;

wherein upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful, said method further comprising updating said success history file;

wherein upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is not successful, said method further comprising removing said verified Internet Protocol address from said success history file; and

determining whether said success history file has entirely been attempted, wherein upon a determination that said success history file has not entirely been attempted, said method further comprising selecting an unattempted verified Internet Protocol address from said success history file.

2. The method of claim 1 wherein said determining whether said attempting is successful further comprises determining whether said update information is obtained.

3. The method of claim 2 wherein upon a determination that said update information is obtained and that said integrity of said update information is verified, a determination is made that said attempting is successful.

4. The method of claim 2 wherein upon a determination that said update information is not obtained, a determination is made that said attempting is not successful.

5. The method of claim 1 wherein upon a determination that said integrity of said update information is not verified, a determination is made that said attempting is not successful.

6. The method of claim 1 wherein said determining whether the integrity of said update information is verified comprises determining whether said update information is outdated.

7. The method of claim 1 wherein said determining whether the integrity of said update information is verified comprises determining whether a hash of said update information is valid.

8. The method of claim 1 wherein said update information is obtained from said server computer system at said Internet Protocol address.

9. The method of claim 8 wherein said record further comprises a timestamp of when said update information was obtained.

10. The method of claim 1 wherein said updating said success history file comprises adding a record to said success history file, said record comprising said verified Internet Protocol address.

11. The method of claim 10 wherein said record further comprises a timestamp of when said update information was obtained from said server computer system located at said verified Internet Protocol address.

12. The method of claim 1 wherein said updating said success history file comprises modifying a record of said success history file, said record comprising said verified Internet Protocol address.

13. The method of claim 12 wherein said modifying comprises updating a timestamp of said record.

14. The method of claim 1 wherein upon a determination that said success history file has entirely been attempted, said method further comprising providing an error notification.

15. The method of claim 1 further comprising attempting to obtain said update information from said unattempted verified Internet Protocol address.

16. A system comprising:

a memory;

a processor coupled to said memory;

means for obtaining an update name from an update name list on a host computer system, said update name list comprising domain names of sites that distribute update information for protecting said host computer system;

means for resolving an Internet Protocol address of said update name;

means for attempting to obtain said update information from a server computer system located at said Internet Protocol address;

means for determining whether said attempting is successful comprising a means for determining whether an integrity of said update information is verified comprising means for determining whether a signature of a sender of said update information is valid;

means for updating a success history file upon a determination that said attempting is successful comprising means for adding a record comprising said Internet Protocol address to said success history file;

means for determining whether entire update name list has been attempted upon a determination that said attempting is not successful;

means for obtaining a verified Internet Protocol address from said success history file upon a determination that said entire update name list has been attempted;

means for attempting to obtain said update information from a server computer system located at said verified Internet Protocol address;

means for determining whether said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful;

means for updating said success history file upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful;

means for removing said verified Internet Protocol address from said success history file upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is not successful;

means for determining whether said success history file has entirely been attempted; and

means for selecting an unattempted verified Internet Protocol address from said success history file upon a determination that said success history file has not entirely been attempted.

17. A computer-program product comprising a computer readable storage medium containing computer program code comprising:

an update protection application for obtaining an update name from an update name list on a host computer system, said update name list comprising domain names of sites that distribute update information for protecting said host computer system;

said update protection application for resolving an Internet Protocol address of said update name;

said update protection application for attempting to obtain said update information from a server computer system located at said Internet Protocol address;

said update protection application for determining whether said attempting is successful comprising determining whether an integrity of said update information is verified comprising determining whether a signature of a sender of said update information is valid;

said update protection application further for updating a success history file upon a determination that said attempting is successful comprising adding a record comprising said Internet Protocol address to said success history file;

said update protection application further for determining whether entire update name list has been attempted upon a determination that said attempting is not successful;

said update protection application further for obtaining a verified Internet Protocol address from said success history file upon a determination that said entire update name list has been attempted;

said update protection application further for attempting to obtain said update information from a server computer system located at said verified Internet Protocol address;

said update protection application further for determining whether said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful;

said update protection application further for updating said success history file upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful;

said update protection application further for removing said verified Internet Protocol address from said success history file upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is not successful;

said update protection application further for determining whether said success history file has entirely been attempted; and

said update protection application further for selecting an unattempted verified Internet Protocol address from said success history file upon a determination that said success history file has not entirely been attempted.

18. A computer system comprising:

a memory having stored therein an update protection application; and

a processor coupled to said memory, wherein execution of said update protection application generates a method comprising;

obtaining an update name from an update name list on a host computer system, said update name list comprising domain names of sites that distribute update information for protecting said host computer system;

resolving an Internet Protocol address of said update name;

attempting to obtain update information from a server computer system located at said Internet Protocol address;

determining whether said attempting is successful comprising determining whether integrity of said update information is verified comprising determining whether a signature of a sender of said update information is valid, wherein upon a determination that said attempting is successful, said method further comprising updating a success history file comprising adding a record comprising said Internet Protocol address to said success history file;

wherein upon a determination that said attempting is not successful, said method further comprising determining whether entire update name list has been attempted, wherein upon a determination that said entire update name list has been attempted, said method further comprising obtaining a verified Internet Protocol address from said success history file;

attempting to obtain said update information from a server computer system located at said verified Internet Protocol address;

determining whether said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful;

wherein upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is successful, said method further comprising updating said success history file;

wherein upon a determination that said attempting to obtain said update information from said server computer system located at said verified Internet Protocol address is not successful, said method further comprising removing said verified Internet Protocol address from said success history file; and

determining whether said success history file has entirely been attempted, wherein upon a determination that said success history file has not entirely been attempted, said method further comprising selecting an unattempted verified Internet Protocol address from said success history file.