Virus protection in an internet environment

[0001] The present invention relates to virus protection in an Internet environment and in particular, though not necessarily, to computer virus protection in a WAP system. More particularly, the present invention relates to a system where WAP data is transmitted between an origin server and a WAP browser of a mobile wireless device.

[0002] The last decade has seen a rapid growth in the number and use of mobile cellular telephones. More recently, wireless devices known as communicators have been introduced and combine the functionality of mobile telephones and Personal Digital Assistants (PDAs). It is expected that this area will undergo massive growth in the near future as new cellular telecommunication standards (e.g. HSCSD, GPRS, UMTS) make possible the high speed transfer of data across the wireless interface. The introduction of Wireless Application Protocol (WAP), which it is envisaged will be a globally adopted set of rules for delivering Internet-based content to mobile platforms, is also expected to add to the growth of this area by facilitating high speed mobile Internet access. WAP makes use of a new HTML-like programming language known as Wireless Markup Language (WML).

[0003] The next generation of mobile telephones are likely to resemble mini-computers rather than telephones per se. Also, whilst to date cellular telephones have been very much manufacturer specific in terms of both hardware and software, future wireless devices are likely to be built on a much more open platform. This will allow the introduction into the devices of third party applications and will farther fuel growth in much the same way as Microsoft Windows has done for personal computers.

[0004] It can be expected that the opening up of mobile wireless platforms will make such platforms susceptible to attack from so-called malware such as viruses, Trojan horses, and worms (referred to collectively hereinafter as viruses) in much the same way as the openness of present day PCs and workstations makes them susceptible to malware attack. A number of mobile telephone viruses have recently been identified in the wild. In order to resist virus attacks, anti-virus software will be deployed into mobile platforms in much the same way as it has been deployed in the desktop environment.

[0005] A number of different desktop (i.e. server or workstation based) anti-virus applications are currently available. The majority of these applications rely upon a basic scanning engine which searches suspect files for the presence of predetermined virus signatures. These signatures are held in a database which must be constantly updated to reflect the most recently identified viruses. Typically, users regularly download replacement databases, either over the Internet, from a received e-mail, or from a CDROM or floppy disc. Users are also expected to update their software engines every so often in order to take advantage of new virus detection techniques (e.g. which may be required when a wholly new strain of virus is detected). It is expected that similar anti-virus solutions will be employed in wireless platforms, assuming that the problems caused by lack of memory space and processing power can be overcome.

[0006] Such conventional applications can be expected to function satisfactorily for standard file types downloaded or stored on a wireless platform. However, they may not be so efficient when dealing with executable binary (WML) files downloaded into a WAP browser. This is because such files are not stored in a conventional manner and an anti-virus application would not be able to access the files before they are executed.

[0007] A potential solution to this problem is to intercept executable files before they are passed to the WAP browser, i.e. before the data contained in the files is rendered. This may be done between the operating system level and the browser. It will be appreciated however that coding such a solution is extremely complex as it requires an interface at one end to the operating system and at the other end to the browser. The result is a long and complex code which occupies a large volume of memory space and which consumes a relatively large amount of processing resources merely to perform its interface functions. A further disadvantage of this solution is that it may involve the duplication of processing tasks. For example, a duplicate copy of received data may have to be unpacked and decoded prior to passing the original packed and coded data to the browser. The browser then repeats the unpacking and decoding operations prior to rendering the data.

[0008] It is an object of the present invention to overcome or at least mitigate the disadvantages of existing virus scanning systems note above. In particular, it is an object of the present invention to provide a virus scanning system which scans WAP, WWW, and/or related data before it is rendered for presentation on a computer device.

[0009] According to a first aspect of the present invention there is provided a method of scanning data for viruses in a computer device, the device having a browser for rendering the data for use, the method comprising:

[0010] storing the data in a buffer memory accessible to said browser:

[0011] creating an instance of a browser plugin, sad plugin providing a virus scanning function or providing a route to a virus scanning function;

[0012] scanning the data for viruses using the instance of the plugin;

[0013] if no viruses are detected in the data, returning the data to the browser for rendering; and

[0014] if a virus is detected in the data, inhibiting rendering of the data.

[0015] Embodiments of the present invention provide an elegant solution to the problem of virus scanning as the virus scanning plugin, or routing plugin, requires only a simple interface to the browser. The need to copy and buffer data, and the duplicated processing of data at the input to the browser is avoided. Data may be provided to the virus scanning plugin in a suitably pre-processed form. The pre-processing may be done by the browser or by an application or plugin called by the browser.

[0016] Preferably, the computer device is a mobile wireless platform such as a mobile telephone, communicator, palmtop computer etc, and said browser is a WAP browser. The data scanned may be an executable file or part thereof. Alternatively, the data scanned may be data associated with an executable file such as image data. The present invention is also applicable to WWW browsers such as Netscape Navigator and Microsoft Explorer. In this case, the scanned data may be an HTML file, a part of an HTML file, or data associated with an HTML file.

[0017] The plugin of the present invention may comprise virus scanning functionality. Alternatively however, the instance of the plugin created by the browser may cause a separate virus scanning application to be opened. The plugin may then make the WML/HTML data accessible to the scanning application.

[0018] According to a second aspect of the present invention there is provided a mobile wireless device comprising a memory having a WAP browser application stored therein and a virus scanning browser plugin, wherein in use the WAP browser creates an instance of the virus scanning plugin for scanning WAP data prior to rendering the data.

[0019] According to a third aspect of the present invention there is provided a mobile wireless device comprising a memory having a WAP browser application stored therein, a browser plugin, and a virus scanning application, wherein in use the WAP browser creates an instance of the plugin, which instance makes WAP data available to the virus scanning application for virus scanning.

[0020] According to a fourth aspect of the present invention there is provided a computer memory encoded with executable instructions representing an Internet browser plugin, the executable instructions being arranged to cause a mobile wireless platform to scan WAP and or HTML data for viruses prior to rendering of the data for display on a display of the device.

[0021] Rather than scan data for viruses at a receiving wireless mobile platform, it is of course possible to scan data prior to sending to the platform over the air interface.

[0022] According to a fifth aspect of the present invention there is provided a method of scanning WAP data for viruses, the method comprising receiving WAP related data at a WAP gateway from an origin, the data being in an encrypted form, decrypting the data at the WAP gateway and scanning the data for viruses, and in the event that no viruses are found in the data, re-encrypting the data and sending the data to a destination.

[0023] Encrypted data may be received at the WAP gateway either from an origin server or from a mobile wireless platform, with the data being sent from the gateway to the other of the origin server or from a mobile wireless platform. Data sent between the WAP gateway and the mobile wireless platform may be encrypted according to the Wireless Transport Layer Security (WTLS) protocols. Data sent between the WAP gateway and the origin server may be encrypted using for example IPsec protocols.

[0024] For a better understanding of the present invention and in order to show how the same may be carried into effect reference will now be made, by way of example, to the accompanying drawings in which:

[0025] FIG. 1 illustrates schematically a system for delivering WAP data to a mobile wireless device;

[0026] FIG. 2 illustrates schematically software installed in a mobile wireless device; and

[0027] FIG. 3 is a flow diagram illustrating a method of scanning WAP data for viruses in a mobile wireless device.

[0028] There is illustrated in FIG. 1 a wireless mobile device or client 1 which may be for example a WAP enabled cellular telephone or communicator type device. The device 1 may also be for example a palm top computer coupled to a cellular telephone. It is assumed that the mobile device 1 belongs to a subscriber of a GSM cellular telecommunications network. Also illustrated in FIG. 1 are a WAP gateway 2 and an origin server 3. Typically, the WAP gateway 2 is located within the GSM network (although this need not be the case) and communicates with the mobile device 1 using the Wireless Session Protocol (WSP) and the Wireless Transaction Protocol (WTP)-WSP and WTP related data is carried between the mobile device 1 and the WAP gateway using a variety of transport mechanisms. The origin server 3which is in some ways analogous to a WWW servermay be operated by a third party (e.g. content provider, bank, e-merchant etc.) and communicates with the WAP gateway 2 over the Internet using HTTP. As is well known, an end-to-end data connection can be established between the mobile device 1 and the origin server 3 via the WAP gateway 2.

[0029] FIG. 2 illustrates the higher level protocol layers present at the WAP gateway 2. The WAP layers represent the interface to the mobile device 1, whilst the Internet layers represent the interface to the origin server 3. It will be appreciated that peer WAP layers are present in the mobile device 1, whilst peer Internet layers are preset in the origin server 3.

[0030] FIG. 3 illustrates the organisation of a number of software components present in the memory of the mobile device 1. The core of the system is an operating system such as the EPOC operating system currently used on a number of mobile platforms. A number of applications are interfaced to the operating system. These applications might include for example a telephone application and a contacts database. Of particular interest here is a Wireless Application Protocol (WAP) browser which is used to allow WAP related data including executable WML files to be rendered and displayed on a display of the mobile device 1. The WAP data to be displayed is typically downloaded from a remote origin server such as the server 3 of FIG. 1. Alternatively however, WAP data may be read from a memory of the mobile device 1 or may be downloaded into the mobile device 1 from some other source, e.g. via a Bluetooth link.

[0031] The process of downloading WAP data from the origin server 3 may be initiated by the sending of a request from the mobile device 1 to the origin server 3, e.g. the user may enter a URL such as wap.f-secure.com into the address space of the browser. The request goes via the WAP gateway 2. The origin server 3 responds to receipt of the request by returning WAP data comprising an executable WML file and any associated files such as image and audio files. The WAP data is received at the mobile device 1. After processing by lower (GSM) layers, the WAP data is made available to the operating system. The operating system in turn makes the data available to the WAP browser, for example, the operating system may provide pointers to the location of the WAP data in certain memory buffers. It is possible that the received data will be encrypted, for example if Wireless Transport Layer Security (WTLS) is in use between the device 1 and the WAP gateway 7. In this case, the received WAP data must be decrypted. This could be done at the operating system level or in a lower layer, or by the browser.

[0032] In a conventional browser, when the browser is started it looks for installed plugins and creates a plugin library. A plugin is a program extension which connects to an application (or the operating system) in real time. Each plugin is associated in the created library with one or more MIME types. A MIME type is a code indicating a type of data. For example, MIME types are specified (by the IETF) for different video and audio formats. When an executable WML file is downloaded, the browser looks into the file to identify any MIME types. If a MIME type is present, the browser identifies any relevant plugin in the library, and creates an instance of the plugin. For virus scanning plugins, all WAP files should be scanned for malicious code regardless of MIME type as the MIME type is something which is written into a WAP page by the page creator (and can be easily altered). This may require a modification to the current WAP browser structure.

[0033] Once the instance of the plugin is created by the WAP browser, the browser makes the WAP data available to the plugin. This may be done by the browser passing memory buffer address pointers to the plugin. The plugin may use a scanning system similar to the F-Secure Anti-Virus for WAP Gateway system to scan the WAP data for viruses. Assuming that no viruses are identified by the scanning process, the WAP data is returned unmodified to the browser. The browser then renders the data for display in the normal way.

[0034] In the event that a virus is detected in the WAP data (or the presence of a virus is suspected) one of a number of actions may be taken. For example, the user of the device 1 may be notified by displaying a message on the device's display, and attempt may be made to disinfect the data, and/or a message may be returned to the WAP server 3 advising the server is sending out suspect data. In any case, the result is that the browser is prevented from rendering the data.

[0035] As an alternative to scanning WAP data at a mobile device, the scanning may be carried at the WAP gateway 2 using for example the F-Secure Anti-Virus for WAP Gateway system. This may present certain problems in so far as the data which must be scanned is encrypted for transmission between the origin server 3 and the device 1 and the scanning of encrypted data may be ineffective. However, it is possible to take advantage of a white spot which exists at the WAP gateway 2. More particularly, it may often be the case that data will be encrypted for transmission between the origin server 3 and the WAP gateway 2, for example where the corporation to which they belong is a bank. Encryption may be negotiated and conducted using IPsec. As already mentioned above, data sent between the WAP gateway 2 and the mobile device 1 may be encrypted if WTLS is in use. However, as the WAP gateway 2 is an end point for both encryption services, unencrypted data will be present at the WAP gateway (this is possible because the WAP gateway 2 is under the control of a trusted party, e.g. a telco or bank). Virus scanning can be effectively carried out at the WAP gateway 2.

[0036] It will be appreciated by the person of skill in the art that various modifications may be made to the above described embodiments without departing from the scope of the present invention.