US 2010/0169972 A1 · SHARED REPOSITORY OF MALWARE DATA

Abstract

Various principles for maintaining a shared repository of authorization scanning results, which may be populated with results of authorization scans of particular files (and other content units) as well as a signature for those particular files. When a particular file is to be scanned by a client computing device to determine whether it contains unauthorized software, a signature for the file may be calculated and provided to the shared repository. If the repository has a result for that file—as indicated by a signature for the file being present in the repository—the result in the repository may be provided to the client computing device that issued the query, and the client computing device may accept the answer in the shared repository. If the result is not in the repository (i.e., the file has not been scanned), then the file may be scanned, and a result may be placed in the repository.

Claims20

Dependent claims

A method for making a determination of whether a particular content unit to be accessed in a computer system contains unauthorized software, the computer system comprising at least two client computing devices and a shared repository of authorization determinations, the shared repository of authorization determinations being accessible to each of the at least two client computing devices and comprising results of authorization determinations, each authorization determination being a determination of whether a corresponding content unit contains unauthorized software, at least some of the authorization determinations having been made by one or more of the at least two client computing devices, the method comprising:

(A) providing a unique identifier for the particular content unit to the shared repository of authorization determinations;
(B) receiving an indication of whether the shared repository includes an authorization determination for the particular content unit;
and
(C) if the shared repository includes an authorization determination for the particular content unit, using the authorization determination in the shared repository to inform access to the particular content unit.

1 more element

At least one computer-readable medium encoded with computer-executable instructions that, when executed by a computer, cause the computer to carry out a method for making a determination of whether a particular file to be accessed in a computer system contains malicious software, the computer system comprising at least two client computing devices and a shared repository of malware determinations, the shared repository of malware determinations being accessible to each of the at least two client computing devices and comprising results of malware determinations, each malware determination being a determination of whether a corresponding file contains malicious software, at least some of the malware determinations having been made by one or more of the at least two client computing devices, the method comprising:

(A) providing a unique identifier for the particular file to the shared repository of malware determination results;
(B) receiving an indication of whether the shared repository includes a malware determination for the particular file;
(C) if the shared repository includes a malware determination for the particular file, using the malware determination in the shared repository to inform access to the particular file;
and
(D) if the shared repository does not include a malware determination,
(D1) determining whether the particular file contains malicious software;
and
(D2) updating the shared repository with a result of the determining in act (D1).

5 more elements

A first client computing device for use in a computer system comprising the first client computer, at least one second client computing devices and a shared repository of authorization determinations, the shared repository of authorization determinations being accessible to each of the at least two client computing devices and comprising results of authorization determinations, each authorization determination being a determination of whether a corresponding content unit contains unauthorized software, at least some of the authorization determinations having been made by one or more of the at least two client computing devices, the first client computing device comprising:

at least one processor adapted to make a determination of whether a particular content unit to be accessed in the computer system contains unauthorized software by:
providing a unique identifier for the particular content unit to the shared repository of authorization determinations;
receiving an indication of whether the shared repository includes an authorization determination for the particular content unit;
and
if the shared repository includes an authorization determination for the particular content unit, using the authorization determination in the shared repository to inform access to the particular content unit.

2 more elements

Dependencies are inferred from the claim text.

Shared repository of malware data

Life of this patent

Shared repository of malware data

Life of this patent

Abstract

Claims20