# US 8,788,623 B2 · System, method, and computer program product for receiving security content utilizing a serial over LAN connection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,623 B2 - Document ID: US8788623B2 - Status: Granted - Kind: B2 - Application number: 13/662,947 - Filed: 2012-10-29 - Published: 2013-02-28 - Granted: 2014-07-22 - Earliest claimed: 2010-02-19 - Assignees: McAfee, Inc. - Applicants: McAfee, Inc. - Inventors: Ward Coburn; Harvir Singh; Roger Wood - Web page: https://patentgrep.com/patent/US8788623B2 ## CPC - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system, method, and computer program product are provided for receiving security content utilizing a serial over LAN connection. In use, an unsuccessful attempt to connect to a network for accessing security content at a remote second device is indicated by a first device, where the unsuccessful attempt results from a malfunction at the first device. Further, the security content is received at the first device utilizing a serial over local area network (LAN) connection established with the remote second device, based on the indication. ## Claims ### Claim 1 A non-transitory computer readable medium, comprising instructions stored thereon to cause one or more processors to: detect, at a central manager device, an indication of a failure of a client device to obtain security content from a security content provider system over a first computer network, the failure caused by a software malfunction at the client device; and instruct the security content provider system to: establish a serial over local area network connection to the client device in response to the detection by the central manager device of the indication of the failure of the client device to obtain the security content from the security content provider system over the first computer network; and transmit the security content to the client device utilizing the serial over local area network connection. ### Claim 2 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the security content includes signatures for use in detecting malware. ### Claim 3 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the central manager device detects the indication of the failure at the client device at least in part by reading a flag at the client device. ### Claim 4 (depends on 3) The non-transitory computer readable medium of claim 3, wherein reading the flag comprises obtaining the flag from a storage area of active management technology provided by a processor of the client device. ### Claim 5 (depends on 1) The non-transitory computer readable medium of claim 1, wherein establishing the serial over local area network connection comprises establishing a connection over a second network. ### Claim 6 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the software malfunction includes a network driver malfunction. ### Claim 7 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the software malfunction includes non-compliance with a security policy requiring compliance to connect to the first computer network. ### Claim 8 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the serial over local area network connection comprises a connection to a virtual serial port of the client device. ### Claim 9 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the serial over local area network connection includes a connection by the security content provider system to an active management technology BIOS of the client device, wherein the active management technology BIOS is able to bypass an operating system network communication protocol while the client device receives the security content. ### Claim 10 A non-transitory computer readable medium, comprising instructions stored thereon to cause one or more processors to: identify, at a client device, a failure of an attempt to connect to a first computer network to obtain security content from a security content provider system, the failure caused by a software malfunction at the client device; provide to a central manager device an indication of the failure to obtain the security content in response to the failure to obtain the security content over the first computer network from the security content provider system; and receive, at the client device, the security content from the security content provider system utilizing a serial over local area network connection. ### Claim 11 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the instructions to provide an indication of the failure comprise instructions to send an error status event over a second computer network. ### Claim 12 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the instructions to provide an indication of the failure comprise instructions to set a flag in a storage area of active management technology provided by a processor of the client device. ### Claim 13 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the storage area is readable by the central manager device to allow the central manager device to detect the flag. ### Claim 14 (depends on 12) The non-transitory computer readable medium of claim 12, further comprising instructions stored thereon to cause one or more processors to: clear the flag upon receipt of the security content. ### Claim 15 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the serial over local area network connection comprises a connection to a virtual serial port of the client device. ### Claim 16 (depends on 10) The non-transitory computer readable medium of claim 10, further comprising instructions to cause one or more processors to: install the security content on the client device. ### Claim 17 A system, comprising: a central manager device; a client device adapted to provide to the central manager an indication of a failure of an attempt to connect to a first computer network to obtain security content, the failure caused by a software malfunction at the client device; and a security content provider adapted to establish a serial over local area network connection with the client device over a second computer network in response to instructions from the central manager device responsive to a detection by the central manager device of the indication, the serial over local area network connection utilized to send the security content between the security content provider and the client device. ### Claim 18 (depends on 17) The system of claim 17, wherein the serial over local area network connection comprises a connection to a virtual serial port of the client device.