Network managed antivirus appliance

Patent metadata

Field	Value
Publication number	US-10318734-B2
Application number	US-201414528360-A
Country	US
Kind code	B2
Filing date	Oct 30, 2014
Priority date	Feb 5, 2010
Publication date	Jun 11, 2019
Grant date	Jun 11, 2019

Abstract

Data can be scanned using a network managed appliance. The network managed appliance may integrate commercial hardware elements connected through a basic or simplified operating system environment expressly developed for the appliance, thus being more malware resistant and less vulnerable to attacks from the scanned data or other sources. The network managed appliance may be a self-contained apparatus with an integrated chassis, designed and configured as “single-purpose” device. Such appliances may be connected to an appliance management network including central management servers in communication with appliances in remote locations. The central management servers may ensure that scanning software and the definitions lists for each of the appliances are current and match an enterprise-approved configuration. In addition, an antivirus appliance may facilitate creation and management of user rights assignments for those files.

First claim

We claim:

1. An apparatus comprising:
at least one processor;
at least one device port or drive configured to communicatively receive connection of a portable storage medium attached to the apparatus; and
at least one memory storing computer readable instructions that, when executed by the at least one processor, cause the apparatus to:
generate a virtualized instance of a virus scanning application;
scan, for viruses using the virtualized instance, a plurality of files stored on the portable storage medium;
determine, based on an encryption level of a first file of the plurality of files, that the first file is confidential;
determine, based on the first file being confidential, that a user of the apparatus is authorized to transfer the first file;
receive first user input that indicates a destination network for the first file;
send, based on the first user input, a request for users of the destination network;
receive, based on the request, an indication of valid users of the destination network;
cause display of information that indicates the valid users;
receive, based on the information that indicates the valid users, second user input that indicates one or more valid users that are to receive at least one user right for the first file;
receive third user input that indicates, for the one or more valid users, a user rights assignment for the first file;
based on detecting a first virus in a second file of the plurality of files, determine, based on a virus type of the first virus, a quarantine option for the second file;
send, to a server, results of the scan of the plurality of files;
send, to the destination network, the first file; and
send, to the server and to cause the one or more valid users to be notified of the first file, data that indicates the user rights assignment and that indicates the one or more valid users.

2. The apparatus of claim 1 , wherein the computer readable instructions, when executed by the at least one processor, cause the apparatus to:
communicate, based on an operating system of the apparatus, with the at least one device port or drive, wherein the operating system is stored on a solid state medium that is removable from the apparatus, and wherein the virtualized instance is configured to provide a layer of abstraction between the virus scanning application and the operating system.

3. The apparatus of claim 1 , wherein the apparatus is configured to not modify the portable storage medium based on the user rights assignment for the first file.

4. The apparatus of claim 1 , further comprising a smart card reader, wherein the computer readable instructions, when executed by the at least one processor, cause the apparatus to:
receive, via the smart card reader, data corresponding to a private encryption key, wherein the private encryption key is associated with the user of the apparatus; and
encrypt, using the private encryption key, the first file.

5. The apparatus of claim 1 , further comprising at least one of a biometric scanner or a smart card reader, wherein the at least one memory stores additional computer readable instructions that, when executed by the at least one processor, further cause the apparatus to:
authenticate, based on input received via the biometric scanner or the smart card reader, the user of the apparatus;
retrieve, from a secure memory of the apparatus, a private encryption key associated with the user of the apparatus; and
encrypt, using the private encryption key, the first file.

6. The apparatus of claim 1 , wherein the computer readable instructions, when executed by the at least one processor, cause the apparatus to:
modify first metadata, of the first file, to indicate the user rights assignment; and
modify second metadata, of the second file, to indicate the quarantine option.

7. The apparatus of claim 1 , wherein the computer readable instructions, when executed by the at least one processor, cause the apparatus to:
based on a determination that the apparatus has been physically compromised, send, to the server, an alert that indicates the apparatus has been physically compromised; and
based on the determination that the apparatus has been physically compromised, configure the apparatus to remove a function of the apparatus.

8. A method comprising:
generating, by a computing device, a virtualized instance of a virus scanning application;
scanning, by the computing device, for viruses using the virtualized instance, a plurality of files stored on a portable storage medium attached to the computing device via at least one device port or drive;
determining, by the computing device and based on an encryption level of a first file of the plurality of files, that the first file is confidential;
determining, based on the first file being confidential, that a user of the computing device is authorized to transfer the first file;
receiving, by the computing device, first user input that indicates a destination network for the first file;
sending, by the computing device, based on the first user input, a request for users of the destination network;
receiving, by the computing device, based on the request, an indication of valid users of the destination network;
causing, by the computing device, display of information that indicates the valid users;
receiving, by the computing device, based on the information that indicates the valid users, second user input that indicates one or more valid users that are to receive at least one user right for the first file;
receiving, by the computing device, third user input that indicates, for the one or more valid users, a user rights assignment for the first file;
based on detecting a first virus in a second file of the plurality of files, determining, based on a virus type of the first virus, a quarantine option for the second file;
sending, by the computing device to a server, results of the scan of the plurality of files;
sending, by the computing device to the destination network, the first file; and
sending, by the computing device to the server, and to cause the one or more valid users to be notified of the first file, data that indicates the user rights assignment and that indicates the one or more valid users.

9. The method of claim 8 , further comprising:
communicating, based on an operating system of the computing device, with the portable storage medium, wherein the operating system is stored on a solid state medium that is removable from the computing device, and wherein the virtualized instance is configured to provide a layer of abstraction between the virus scanning application and the operating system.

10. The method of claim 8 , wherein the portable storage medium is not modified based on the user rights assignment for the first file.

11. The method of claim 8 , further comprising:
receiving, via a smart card reader of the computing device, data corresponding to a private encryption key, wherein the private encryption key is associated with the user of the computing device; and
encrypting, using the private encryption key, the first file.

12. The method of claim 8 , further comprising:
authenticating, based on input received via a biometric scanner or a smart card reader of the computing device, the user of the computing device;
retrieving, from a secure memory of the computing device, a private encryption key associated with the user of the computing device; and
encrypting, using the private encryption key, the first file.

13. The method of claim 8 , further comprising:
modifying first metadata, of the first file, to indicate the user rights assignment; and
modifying

Assignees

• Leidos Inc

Inventors

• Young Alan G
• Bartruff Paul L
• Brown Eric E
• Miley Michael P

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/567 Primary

  using dedicated hardware · CPC title

• G06F21/564

  by virus signature recognition · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title