# US 10,313,324 B2 · System and method for antivirus checking of files based on level of trust of their digital certificates > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,324 B2 - Document ID: US10313324B2 - Status: Granted - Kind: B2 - Application number: 14/557,922 - Filed: 2014-12-02 - Published: 2016-12-08 - Granted: 2019-06-04 - Earliest claimed: 2014-12-02 - Assignees: AO Kaspersky Lab - Applicants: Kaspersky Lab ZAO - Inventors: Andrey Y. Solodovnikov; Andrey V. Ladikov; Michael Pavlushik - Web page: https://patentgrep.com/patent/US10313324B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/565: {by checking file integrity} - H04L 9/3247: {involving digital signatures} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed are systems, methods and computer program products for antivirus checking of files based on level of trust of their digital certificates. An example method includes obtaining a digital certificate of a digital signature of a file; determining validity of the obtained digital certificate; assigning a level of trust to the digital certificate based on the determined validity or invalidity of the digital certificate of the file; based on the assigned level of trust of the digital certificate of the file, determining what antivirus checking method to perform on the file; and performing the determined antivirus checking method on the file. ## Claims ### Claim 1 A method for performing antivirus checking of a file, the method comprising: obtaining a digital certificate of the file, wherein the digital certificate is an end certificate associated with a certificate chain; determining, by a hardware processor, validity of the obtained digital certificate by decrypting a digital signature of the obtained digital certificate using a public key of an intermediate certificate authority, calculating a hash value of the digital certificate, and determining a match of the decrypted digital signature with the calculated hash value; assigning a level of trust to the digital certificate based on the determined validity or invalidity of the digital certificate of the file and further based on a set of intermediate digital certificates in the certificate chain, wherein a low level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates is a digital certificate used to sign a known malicious file, wherein a medium level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates is a valid digital certificate, and wherein a high level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates being issued by a trusted certification authority; and performing an antivirus checking method on the file based on the assigned level of trust of the digital certificate of the file, wherein one or more of heuristic analysis, emulation, and blocking execution is performed on the file having a digital certificate with an assigned low level of trust. ### Claim 2 (depends on 1) The method of claim 1, further comprising: assigning, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a low level of trust based on invalidity of the at least one digital certificate or based on the at least one digital certificate being used to sign a known malicious file. ### Claim 3 (depends on 1) The method of claim 1, further comprising: assigning, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a medium level of trust based on a validity of the at least one digital certificate; and performing signature matching of the file having a digital certificate with a medium level of trust. ### Claim 4 (depends on 1) The method of claim 1, further comprising: assigning, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a high level of trust based on digital certificates issued by a trusted certification authority; and not performing antivirus checking of a file having a digital certificate with a high level of trust. ### Claim 5 (depends on 1) The method of claim 1, wherein determining validity of the digital certificate includes: constructing the certificate chain associated with the certificate of the file; and traversing the certificate chain and validating each certificate in the chain. ### Claim 6 (depends on 1) The method of claim 1, further comprising: assigning a low level of trust to the end certificate based on an intermediate certificate in the certificate chain that were found in certificate chains of a malicious file even if other certificates in the certificate chain have an assigned medium or high level of trust. ### Claim 7 (depends on 1) The method of claim 1, wherein determining whether a digital certificate is valid when one or more of the following conditions is met: a digital signature of a certification authority associated with the digital certificate is correct; a validity period of the certificate has not expired at a present moment; and the certificate has not been revoked. ### Claim 8 A system for performing antivirus checking of a file, the system comprising: a hardware processor configured to: obtain a digital certificate of the file, wherein the digital certificate is an end certificate associated with a certificate chain; determine validity of the obtained digital certificate of the file by decrypting a digital signature of the obtained digital certificate using a public key of an intermediate certificate authority, calculating a hash value of the digital certificate, and determining a match of the decrypted digital signature with the calculated hash value; assign a level of trust to the digital certificate based on the determined validity or invalidity of the digital certificate of the file and further based on a set of intermediate digital certificates in the certificate chain, wherein a low level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates is a digital certificate used to sign a known malicious file, wherein a medium level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates is a valid digital certificate, and wherein a high level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates being issued by a trusted certification authority; and perform an antivirus checking method on the file based on the assigned level of trust of the digital certificate of the file, wherein one or more of heuristic analysis, emulation, and blocking execution is performed on the file having a digital certificate with an assigned low level of trust. ### Claim 9 (depends on 8) The system of claim 8, wherein the hardware processor further configured to: assign, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a low level of trust based on invalidity of at least one digital certificate or based on the least one digital certificate being used to sign a known malicious file. ### Claim 10 (depends on 8) The system of claim 8, wherein the hardware processor further configured to: assign, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a medium level of trust based on validity of the at least one digital certificate; and perform signature matching of the file having a digital certificate with a medium level of trust. ### Claim 11 (depends on 8) The system of claim 8, wherein the hardware processor further configured to: assign, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a high level of trust based on digital certificates issued by a trusted certification authority; and not perform antivirus checking of a file having a digital certificate with a high level of trust. ### Claim 12 (depends on 8) The system of claim 8, wherein determining validity of the digital certificate includes: constructing the certificate chain associated with the certificate of the file; and traversing the certificate chain and validating each certificate in the chain. ### Claim 13 (depends on 8) The system of claim 8, wherein the hardware processor further configured to: assign a low level of trust to the end certificate based on an intermediate certificate in the certificate chain that were found in certificate chains of a malicious file even if other certificates in the certificate chain have an assigned medium or high level of trust. ### Claim 14 (depends on 8) The system of claim 8, wherein determining whether a digital certificate is valid when one or more of the following conditions is met: a digital signature of a certification authority associated with the digital certificate is correct; a validity period of the certificate has not expired at a present moment; and the certificate has not been revoked. ### Claim 15 A computer program product, stored on a non-transitory computer readable medium, wherein the computer program product includes computer executable instructions for performing antivirus checking of a file, including instructions for: obtaining a digital certificate of the file, wherein the digital certificate is an end certificate associated with a certificate chain; determining, by a hardware processor, validity of the obtained digital certificate by decrypting a digital signature of the obtained digital certificate using a public key of an intermediate certificate authority, calculating a hash value of the digital certificate, and determining a match of the decrypted digital signature with the calculated hash value; assigning a level of trust to the digital certificate based on the determined validity or invalidity of the digital certificate of the file and further based on a set of with intermediate digital certificates in the certificate chain, wherein a low level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates is a digital certificate used to sign a known malicious file, wherein a medium level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates is a valid digital certificate, and wherein a high level of trust is assigned to the end certificate based on a determination that at least one intermediate digital certificate of the set of intermediate digital certificates being issued by a trusted certification authority; and performing an antivirus checking method on the file based on the assigned level of trust of the digital certificate of the file, wherein one or more of heuristic analysis, emulation, and blocking execution is performed on the file having a digital certificate with an assigned low level of trust. ### Claim 16 (depends on 15) The computer program product of claim 15, further comprising instructions for: assigning, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a low level of trust based on invalidity of the at least one digital certificate or based on the at least one digital certificate being used to sign a known malicious file. ### Claim 17 (depends on 15) The computer program product of claim 15, further comprising instructions for: assigning, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a medium level of trust based on a validity of the at least one digital certificate; and performing signature matching of the file having a digital certificate with a medium level of trust. ### Claim 18 (depends on 15) The computer program product of claim 15, further comprising instructions for: assigning, to at least one digital certificate in the set of intermediate digital certificates in the certificate chain, a high level of trust based on digital certificates issued by a trusted certification authority; and not performing antivirus checking of a file having a digital certificate with a high level of trust. ### Claim 19 (depends on 15) The computer program product of claim 15, wherein instructions for determining validity of the digital certificate include instructions for: constructing the certificate chain associated with the certificate of the file; and traversing the certificate chain and validating each certificate in the chain. ### Claim 20 (depends on 15) The computer program product of claim 15, further comprising instructions for: assigning a low level of trust to the end certificate based an intermediate certificate in the certificate chain that were found in certificate chains of a malicious file even if other certificates in the certificate chain have an assigned medium or high level of trust.