System and method of providing virus protection at a gateway

Patent metadata

Field	Value
Publication number	US-9392002-B2
Application number	US-5918202-A
Country	US
Kind code	B2
Filing date	Jan 31, 2002
Priority date	Jan 31, 2002
Publication date	Jul 12, 2016
Grant date	Jul 12, 2016

Abstract

A system, a method for providing virus protection, and a computer program stored on a storage medium in a communication system including at least a first network coupled to a destination to which transmissions of data packets are made from the first network to the destination is described. A virus protection system includes a gateway, coupled between the first network and the destination, which includes a firewall which receives data packets and a virus scanning engine, coupled to the firewall, which receives the data packets after reception by the firewall, tests the data packets, passes any data packets, which are tested by the virus scanning engine to not contain a virus to the destination and discards any data packets which are tested by the virus scanning engine to contain a virus.

First claim

The invention claimed is:

1. An apparatus comprising:
a hardware firewall configured to
receive a first data packet and a second data packet intended for a destination in networked communication with the hardware firewall;
classify, responsive to a determination that the first data packet includes audio or video content, the first data packet as being a first type of data packet that cannot contain a virus;
classify the second data packet as being a second type of data packet that can contain a virus;
cause, responsive to classifying the first data packet as being the first type, transmission of the first data packet to the destination; and
cause, responsive to classifying the second data packet as being the second type, transmission of the second data packet to a virus scanning engine for testing.

2. The apparatus of claim 1 , wherein the determination that the first data packet includes audio or video content comprises a determination that the first data packet includes video content.

3. The apparatus of claim 2 , wherein the determination that the first data packet includes audio or video content comprises a determination that the first data packet includes audio content.

4. The apparatus of claim 1 , wherein the hardware firewall is configured to cause a stop in reception of a data stream which carried the first data packet and the second data packet in response to an alert from the virus scanning engine.

5. The apparatus of claim 1 , further comprising a buffer configured to store the second data packet while the virus scanning engine is testing the second data packet to detect a virus, and wherein the hardware firewall is configured to cause the second data packet to be stored in the buffer.

6. The apparatus of claim 1 , wherein the hardware firewall is configured to receive, from a packet classification database, information defining the first type and the second type.

7. The apparatus of claim 6 , further comprising:
the virus scanning engine configured to receive, from a virus detection database, programming information that controls the testing of the second data packet by the virus scanning engine.

8. The apparatus of claim 1 , further comprising:
the virus scanning engine configured to receive, from a virus detection database, programming information that controls the testing of the second data packet by the virus scanning engine.

9. The apparatus of claim 1 , further comprising the virus scanning engine configured to cause transmission of an alert to the destination upon detection of a virus in the second data packet.

10. The apparatus of claim 1 wherein the destination is in networked communication with the hardware firewall via a local area network.

11. The apparatus of claim 10 wherein the destination is a personal computer.

12. The apparatus of claim 1 , wherein the hardware firewall is configured to receive the first data packet and the second data packet via a first network, and wherein the destination is in networked communication with the hardware firewall via a second network.

13. The apparatus of claim 12 , wherein the first network comprises a wide area network.

14. The apparatus of claim 12 , wherein the first network comprises the Internet.

15. The apparatus of claim 1 , wherein the destination comprises an Internet service provider configured to connect to a gateway.

16. The apparatus of claim 1 , further comprising the virus scanning engine configured to decode the second data packet during the testing of the second data packet.

17. The apparatus of claim 16 , wherein the virus scanning engine is configured to function as a proxy for a destination processor configured to receive data packets.

18. A method comprising:
receiving, by a computing device, a first data packet and a second data packet intended for a destination;
classifying, responsive to a determination that the first data packet includes audio or video content, the first data packet as being a first type of data packet that cannot contain a virus;
classifying the second data packet as being a second type of data packet that can contain a virus;
transmitting, responsive to classifying the first data packet as being the first type, the first data packet to the destination; and
transmitting, responsive to classifying the second data packet as being the second type, the second data packet to a virus scanning engine for testing.

19. The method of claim 18 , wherein the determination that the first data packet includes audio or video content comprises a determination that the first data packet includes video content.

20. The method of claim 19 , wherein the determination that the first data packet includes audio or video content comprises a determination that the first data packet includes audio content.

21. The method of claim 18 , further comprising receiving, from a packet classification database, information defining the first type and the second type.

22. The method of claim 18 , wherein classifying the first data packet as being the first type and classifying the second data packet as being the second type are both performed by a firewall.

23. One or more non-transitory computer readable media storing executable instructions that, when executed, cause an apparatus to:
receive a first data packet and a second data packet intended for a destination;
classify, responsive to a determination that the first data packet includes audio or video content, the first data packet as being a first type of data packet that cannot contain a virus;
classify the second data packet as being a second type of data packet that can contain a virus;
transmit, responsive to classifying the first data packet as being the first type, the first data packet to the destination; and
transmit, responsive to classifying the second data packet as being the second type, the second data packet to a virus scanning engine for testing.

24. The one or more non-transitory computer readable media of claim 23 , wherein the determination that the first data packet includes audio or video content comprises a determination that the first data packet includes video content.

25. The one or more non-transitory computer readable media of claim 24 , wherein the determination that the first data packet includes audio or video content comprises a determination that the first data packet includes audio content.

26. The one or more non-transitory computer readable media of claim 23 , wherein the executable instructions, when executed, cause the apparatus to:
cause a stop in reception of a data stream which carried the first data packet and the second data packet in response to an alert from the virus scanning engine.

27. The one or more non-transitory computer readable media of claim 23 , wherein the executable instructions, when executed, cause the apparatus to receive, from a packet classification database, information defining the first type and the second type.

28. The one or more non-transitory computer readable media of claim 23 , wherein the apparatus comprises a firewall, wherein causing the apparatus to classify the first data packet as being the first type comprises causing the firewall to classify the first data packet as being the first type, and wherein causing the apparatus to classify the second data packet as being the second type comprises causing the firewall to classify the second

Assignees

• Suuronen Janne
• Bergenwall Martin
• Nokia Technologies Oy

Inventors

• Suuronen Janne
• Bergenwall Martin

Classifications

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title