# US 2014/0196149 A1 · Anti-malware system, method of processing data in the same, and computing device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0196149 A1
- Document ID: US20140196149A1
- Status: Published application
- Kind: A1
- Application number: 14/082,520
- Filed: 2013-11-18
- Published: 2014-07-10
- Earliest claimed: 2012-11-19
- Assignees: Samsung Sds Co., Ltd.
- Applicants: Samsung Sds Co., Ltd.
- Inventors: In Seon YOO
- Web page: https://patentgrep.com/patent/US20140196149A1

## CPC

- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/567: {using dedicated hardware}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Provided are an anti-malware (AM) system, a method of processing data in the AM system, and a computing device including the AM system. The AM system includes a hardware-based AV engine configured to perform hash matching on data for AV scanning of the data, and an AV function module configured to determine whether or not the data includes a virus pattern on the basis of a result of the hash matching.

## Claims

### Claim 1

An anti-malware (AM) apparatus, comprising:
a hardware-based anti-virus (AV) engine configured to perform hash matching on data for AV scanning of the data, and to generate a hash matching result; and
an AV function module configured to determine whether the data includes a virus pattern, on the basis of the hash matching result.

### Claim 2 (depends on 1)

The AM apparatus of claim 1, wherein:
the hardware-based AV engine includes:
a hash loader configured to perform a first hash matching operation on a first portion of the data, and
a suffix matcher configured to perform a second hash matching operation on a second portion of the data in response to detecting that a matching occurs in the first hash matching operation, the second portion of the data being subsequent to said first portion of the data.

### Claim 3 (depends on 2)

The AM apparatus of claim 2, wherein the hardware-based AV engine further includes an AV digest unit configured to calculate a message digest of the data.

### Claim 4 (depends on 3)

The AM apparatus of claim 3, wherein:
said first portion of the data, when input to the hash loader, is input to the AV digest unit; and
the calculation of the message digest is performed in parallel with at least one of the first hash matching operation and the second hash matching operation.

### Claim 5 (depends on 3)

The AM apparatus of claim 3, wherein the AV digest unit temporarily pauses the hash loader to prevent the hash loader from performing a hash matching operation on a subsequent portion of the data while the AV digest unit is calculating the message digest.

### Claim 6 (depends on 1)

The AM apparatus of claim 1, wherein the AV function module loads, for use by the hardware-based AV engine, at least one of a hash matching database and the virus pattern.

### Claim 7 (depends on 1)

The AM apparatus of claim 1, wherein the AV function module is implemented as firmware.

### Claim 8 (depends on 1)

The AM apparatus of claim 1, wherein the AV function module is implemented as an application, said application being executed by an external CPU in cooperation with the hardware-based AV engine.

### Claim 9 (depends on 7)

The AM apparatus of claim 7, wherein the hardware-based AV engine includes a central processing unit (CPU) and a memory, and wherein the firmware implementing the AV function module is stored in the memory.

### Claim 10 (depends on 1)

The AM apparatus of claim 1, wherein the hardware-based AV engine is integrated with a processor, and wherein the processor includes a security execution environment module configured to virtualize the processor into different processors respectively corresponding to a normal mode and a security mode.

### Claim 11 (depends on 10)

The AM apparatus of claim 10, wherein the virtualized processor corresponding to the security mode is configured to execute an application received by the AM apparatus.

### Claim 12 (depends on 10)

The AM apparatus of claim 10, further comprising a storage device connected to the processor, wherein the security execution environment module further virtualizes the storage device into different storage devices respectively corresponding to the normal mode and the security mode.

### Claim 13 (depends on 12)

The AM apparatus of claim 12, wherein the virtualized storage device corresponding to the security mode stores at least one of a library related to the AM apparatus, a driver related to the AM apparatus, and the virus pattern.

### Claim 14

A method of processing data in an anti-malware (AM) apparatus, comprising:
performing, hash matching on data for AV scanning of the data, with a hardware-based anti-virus (AV) engine;
generating a hash matching result; and
determining, at an AV function module, whether the data includes a virus pattern, on the basis of a the hash matching result.

### Claim 15 (depends on 14)

The method of claim 14, wherein the performing of the hash matching includes:
performing, at a hash loader of the hardware-based AV engine, a first hash matching operation on a first portion of the data;
performing, at a suffix matcher of the hardware-based AV engine, a second hash matching operation on a second portion of the data in response to detecting that a matching occurs in the first hash matching operation, the second portion of the data being subsequent to said first portion of the data.

### Claim 16 (depends on 15)

The method of claim 15, further comprising calculating, at an AV digest unit of the hardware-based AV engine, a message digest of the data.

### Claim 17 (depends on 16)

The method of claim 16, wherein:
said first portion of the data, when input to the hash loader, is input to the AV digest unit; and
the calculation of the message digest is performed in parallel with at least one of the first hash matching operation and the second hash matching operation.

### Claim 18 (depends on 16)

The method of claim 16, further comprising using the AV digest unit to temporarily pause the hash loader to prevent the hash loader from performing a hash matching operation on a subsequent portion of the data while the AV digest unit is calculating the message digest.

### Claim 19 (depends on 14)

The method of claim 14, further comprising loading at least one of a hash matching database and the virus pattern for use by the hardware-based AV engine.

### Claim 20 (depends on 14)

The method of claim 14, further comprising providing the AV function module implemented as firmware.

### Claim 21 (depends on 14)

The method of claim 14, further comprising providing the AV function module implemented as an application, said application being executed by an external CPU in cooperation with the hardware-based AV engine.

### Claim 22 (depends on 20)

The method of claim 20, wherein the hardware-based AV engine includes a central processing unit (CPU) and a memory, and wherein the providing of the AV function module includes storing the firmware in the memory.

### Claim 23 (depends on 14)

The method of claim 14, further comprising:
using a security execution environment module to virtualize a processor integrated with the hardware-based AV engine into different processors respectively corresponding to a normal mode and a security mode,
wherein the security execution environment module is included in the processor.

### Claim 24 (depends on 23)

The method of claim 23, further comprising executing an application using the AM apparatus on the virtualized processor corresponding to the security mode.

### Claim 25 (depends on 23)

The method of claim 23, further comprising virtualizing, at the security execution environment module, a storage device connected to the processor into different storage devices respectively corresponding to the normal mode and the security mode.

### Claim 26 (depends on 25)

The method of claim 25, further comprising storing at least one of a library related to the AM apparatus, a driver related to the AM apparatus, and the virus pattern in the virtualized storage device corresponding to the security mode.

### Claim 27

A computing device, comprising:
a CPU core, and
an anti-malware (AM) apparatus configured to provide a security platform on which an anti-virus (AV) software application is executed;
wherein the AM apparatus includes:
a hardware-based AV engine configured to perform hash matching on data for AV scanning of the data, and to generate a hash matching result; and
an AV function module configured to determine whether the data includes a virus pattern on the basis of the hash matching result.