Data processing: generic control systems or specific application – Generic control system – apparatus or process – Plural processors
Reexamination Certificate
1994-04-28
2001-02-27
Grant, William (Department: 2121)
Data processing: generic control systems or specific application
Generic control system, apparatus or process
Plural processors
C713S152000, C713S187000
Reexamination Certificate
active
06195587
ABSTRACT:
BACKGROUND OF THE INVENTION
The present invention relates to a method and apparatus for checking the validity of data in a data processing network, for example for checking whether the data contains viruses or other unwanted data or whether it has been authorised for or barred from use in the network or a part of it.
In general, data of a computer file or disk sector (such as a computer program) can be checked for unwanted data, or information indicating whether the file has been authorized for or barred from use, by the file being searched for data of a predetermined form. This form may comprise predetermined characteristics such as the presence of certain information anywhere in the file, possibly in any order, or at a certain location in the file, possibly in combination with other such data. For instance, computer viruses are stored in the data of a computer file as a set of virus data which can serve as instructions for the virus to operate. A file can be checked for known viruses by a virus detection procedure which searches the file for characteristics that are known to be indicative of each virus. As the number of known viruses to be checked for increases (around 3000 are currently known) the amount of storage capacity needed to store information defining the characteristics of all the known viruses increases too.
In a computer network of workstations and a file server it is conventional for each workstation to itself check on the validity of the data held by it. However, this means that every workstation must use a portion of its storage capacity to store information defining all the characteristic forms to be searched for. In total this requires a large amount of storage capacity, and as more characteristic forms come to be searched for, for example as new viruses are identified, it may become infeasible for workstations to carry out searching themselves because of the limitations of their operating systems. Also, each workstation must be updated individually to include new characteristics. This is inconvenient where there is a large number of workstations.
WO 93/01550 discloses a system for controlling the use of a licensed product, in which in order to determine whether access can be made to a licensed product stored for access by a licensee's data processor a licence datagram is copied to a licensor's data processor which returns a reply message. The licence datagram contains different data from the licensed product.
SUMMARY OF THE INVENTION
According to a first aspect of the present invention there is provided a method for checking the validity of an item of data stored for access by a first data processor of a data processing network comprising at least two interconnected data processors, the method comprising the steps of: the first data processor causing the item of data to be copied to the second data processor; and the second data processor determining whether data of a characteristic form indicative of validity or invalidity of the item is present in the item and reporting to the first data processor on the validity of the item. Preferably, the first data processor is a workstation of the network. Preferably, the second data processor is a file server of the network. The data of a characteristic form is suitably indicative of the invalidity of the item of data, for example indicating a virus or other unwanted data or indicating that the item has been barred from use.
In a system of this type information defining the characteristic form(s) to be tested for needs to be stored for access only by the second data processor. When new characteristics are to be added only a single storage means (to which the second data processor has access) needs to be updated. Where the network includes further data processors equivalent to the first data processor these can preferably also cause any item of data stored for access by them whose validity is to be checked to be copied to the second data processor. The first data processor and any data processors equivalent to it preferably do not store or normally have access to a list of information defining any characteristic forms of data to be tested for.
Preferably, the second data processor reports to the first data processor on the validity (or invalidity) of the item of data.
Preferably, information defining a plurality of characteristic forms of data to be tested for is stored by, or for access by, the second data processor, and the second data processor tests for the presence of such characteristic forms in an item of data by testing for the presence of data of any of the characteristic forms in the item.
The item of data may suitably be a file or program to be accessed, for example by being loaded or executed, by the first data processor. The item of data preferably comprises a sequence of executable instructions.
Preferably, the first data processor intercepts commands to access an item of data and in response to such a command being detected causes the validity of the item of data to be checked. Preferably, the first data processor prevents access to the item of data, for example by a user of the first data processor, unless or until the item has been found to be valid, i.e. free of unwanted data of the characteristic form(s) or of data indicating that the item has been barred from use. To achieve this, the first data processor suitably includes means for detecting a command to access an item of data, to allow it to intercept that command and ensure that the item is valid before it is accessed. Preferably the first data processor may allow a user of the first data processor to force the system to check the validity of any or all items of data stored for access by the first data processor. Preferably, the first data processor is configured to, on receipt of a report from the second data processor on whether data of the characteristic form(s) has been found in the item, prevent or deny access to an item of data that has been found to contain data of the characteristic forms, and/or to allow access to an item of data that has been found not to contain such data. Thus access may be prevented to items that contain unwanted data such as viruses or which have been barred from use.
Preferably, the characteristic forms of data may include forms of data indicative of the validity of the item of data, for example indicating whether the item has been authorized for use. The first data processor may then prevent or deny access to any item that does not include such data and/or allow access only to items that do include such data.
Preferably, the first data processor stores or has access to a set of records, each characteristic of an item of data that has been found to be valid, and the method comprises the steps of: generating a record characteristic of an item of data whose validity is to be checked; searching for that record in the set of records; and causing the item of data to be copied to the second data processor only if the record is not found in the set of records. Preferably, the first data processor includes storage means for storing the set of records and/or processing means for generating records and comparing them with the contents of the set of records. Preferably, in response to the second data processor reporting that an item of data is valid the record that is characteristic of that item of data is added to the set of records. Each record is preferably a checksum calculated for the corresponding item of data.
According to the present invention from a second aspect there is provided a data processing system comprising a plurality of data processors interconnected as a network, and comprising: means in a first data processor of the network (preferably a workstation) for causing an item of data to be copied to a second data processor of the network (preferably a file server); means in the second data processor for testing for the presence, in the item, of data indicative of the validity or invalidity of the item and on the basis of that test generating a validity signal indicative of the validity of the ite
Hruska Jan
Lammer Peter
Grant William
Greer Burns & Crain Ltd.
Rao Sheela S.
Sophos PLC
LandOfFree
Validity checking does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Validity checking, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Validity checking will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2582563