Device and method for providing SOC-based anti-malware service, and interface method

Patent metadata

Field	Value
Publication number	US-8973130-B2
Application number	US-201113187977-A
Country	US
Kind code	B2
Filing date	Jul 21, 2011
Priority date	Jul 21, 2010
Publication date	Mar 3, 2015
Grant date	Mar 3, 2015

Abstract

A device in which a system-on-chip (SOC) providing an anti-malware service is mounted and a method of performing the anti-malware service are provided. The device includes: a storage unit which stores a function library which is a collection of operations provided for use in the SOC providing the anti-malware service; and a scanning data sender which forms SOC transmission data with data to be scanned for viruses by calling at least one of the operations, and transmits the SOC transmission data to the SOC. Accordingly, a mobile device scans files for viruses and filters packets at a high speed.

First claim

What is claimed is:

1. A mobile device comprising:
a system-on-chip (SOC) comprising an anti-malware system and a firewall (FW) application executed by the SOC, wherein the SOC filters packet data and the FW application receives the data filtered by the SOC;
a storage unit which stores a library which is a collection of operations provided for use in the SOC providing the anti-malware system; and
a scanning data sender which runs on an operating system that is external to the SOC and is executed by the mobile device, forms SOC transmission data with scanning data to be scanned for viruses by calling at least one of the operations, and transmits the SOC transmission data to the SOC from a location external to the SOC; and
a sender, wherein the SOC stores a pattern rule DB and the sender transmits, to the SOC, data for updating the pattern rule DB stored in the SOC,
wherein the operations relate to at least one of virus scanning, packet data filtering, virus pattern database (DB) updating, rule pattern DB updating, encrypting and decrypting, and hash value calculating, which are performed in the SOC,
wherein the scanning data sender forms the SOC transmission data to comprise an item indicating a type of the anti-malware system, the scanning data, and a command to scan, and
wherein the SOC comprises a malware manager which determines what type of the anti-malware system is related to the SOC transmission data.

2. The mobile device as claimed in claim 1 , further comprises:
a communication interface unit which operates the SOC using the library; and
a protocol unit which exchanges an operating command and an operation with the SOC through the communication interface unit.

3. The mobile device as claimed in claim 1 , wherein the scanning data sender forms the SOC transmission data to comprise the scanning data and the command to scan.

4. The mobile device as claimed in claim 1 , wherein the SOC stores a malware pattern DB which is used for scanning the scanning data.

5. The mobile device as claimed in claim 4 , further comprising a sender which transmits data for updating the malware pattern DB stored in the SOC to the SOC.

6. The mobile device as claimed in claim 1 , further comprising a message receiver which is notified by the SOC of a result of scanning the scanning data.

7. A method of providing a system-on-chip (SOC)-based anti-malware service of a mobile device, the method comprising:
forming, by the mobile device, SOC transmission data comprising a command and an item indicating a type of the anti-malware service; and
transmitting, by a scanning data sender on the mobile device which runs on an operating system that is external to the SOC and is executed by the mobile device, the SOC transmission data to an SOC mounted in the mobile device, from a location external to the SOC,
wherein the SOC performs a virus scanning operation or a packet filtering operation according to the command included in the SOC transmission data,
wherein the SOC determines whether the anti-malware service relates to the packet filtering operation or the virus scanning operation by referring to the item of the SOC transmission data indicating the type of the anti-malware service,
wherein the SOC stores a rule pattern DB for the packet filtering operation and a virus pattern DB for the virus scanning operation,
wherein the SOC transmission data comprising the command and the item indicating the type of the anti-malware service is at least one of:
first SOC transmission data comprising virus scanning data and a first command to scan;
second SOC transmission data comprising a virus pattern DB for updating and a second command to update a virus pattern DB; and
third SOC transmission data comprising a filtering rule list for updating and a third command to update a rule pattern DB, and

wherein the second SOC transmission data further comprises a hash coefficient which is generated based on the virus pattern DB pre-stored in the SOC and the virus pattern DB for updating.

8. The method as claimed in claim 7 , wherein the SOC simultaneously performs the packet filtering operation and the virus scanning operation with respect to data to be filtered.

9. The method as claimed in claim 7 , further comprising dividing, by the mobile device, scanning data by a predetermined size,
wherein the first SOC transmission data comprises the divided scanning data.

10. The method as claimed in claim 7 , wherein the mobile device stores a library which is a collection of operations for use in the SOC and forms the SOC transmission data by calling at least one of the operations.

11. The method as claimed in claim 10 , wherein the operations relate at least one of virus scanning, packet data filtering, virus pattern DB updating, and rule pattern DB updating, which are performed in the SOC.

12. A method of providing a system-on-chip (SOC)-based anti-malware service, the method comprising:
storing a library which is a collection of operations for use in a SOC in a mobile device in which the SOC is mounted;
forming, by the mobile device, SOC transmission data with scanning data to be scanned for viruses by calling at least one of the operations included in the library; and
transmitting, by a scanning data sender on the mobile device which runs on an operating system that is external to the SOC and is executed by the mobile device, the SOC transmission data for the scanning data to the SOC, from a location external to the SOC,
wherein the operations relate to at least one of virus scanning, packet data filtering, virus pattern DB updating, and rule pattern DB updating, which are performed in the SOC,
wherein the SOC determines whether the anti-malware service relates to the packet filtering operation or the virus scanning operation by referring to an item of the SOC transmission data indicating a type of the anti-malware service,
wherein the SOC stores a rule pattern DB for the packet filtering operation and a virus pattern DB for the virus scanning operation,
wherein the SOC transmission data comprising a command and the item indicating the type of the anti-malware service is at least one of:
first SOC transmission data comprising virus scanning data and a first command to scan;
second SOC transmission data comprising a virus pattern DB for updating and a second command to update a virus pattern DB; and
third SOC transmission data comprising a filtering rule list for updating and a third command to update a rule pattern DB, and

wherein the second SOC transmission data further comprises a hash coefficient which is generated based on the virus pattern DB pre-stored in the SOC and the virus pattern DB for updating.

13. The method as claimed in claim 12 , further comprising dividing, by the mobile device, the scanning data by a predetermined size,
wherein the transmitting comprises transmitting the divided scanning data to the SOC in sequence.

14. The method as claimed in claim 12 , further comprising receiving, by the SOC, the virus pattern DB used for the virus scanning operation from the mobile device and storing the virus pattern DB,
wherein the SOC performs the virus scanning operation using the virus pattern DB.

15. The method as claimed in claim 14 , further comprising;
forming, by the mobile device, SOC transmission data with the virus pattern DB for updating by calling at least one of the operations included in the library;
transmitting, by the mobile device, the SOC transmission data for the virus pattern DB for updating to the SOC; and
updating, by the SOC, a pre-stored virus pattern DB with the virus pattern DB i

Assignees

• Yoo Inseon
• Samsung Sds Co Ltd

Inventors

• Yoo Inseon

Classifications

• G06F21/567 Primary

  using dedicated hardware · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/564

  by virus signature recognition · CPC title