PATENT ABSTRACT
A system and method for providing a quarantine network to address threats emanating from viruses and worms. A quarantine network quarantines an infected terminal&#39;s traffic from the normal traffic flow. During the quarantine period, all of the traffic is analyzed by a quarantine network component. Based upon the results of this analysis, the network can restrict the access of infected terminals to various services, as well as prevent other devices from becoming infected by blocking infected materials such as attachments from reaching their respective recipients.

PATENT DESCRIPTION
FIELD OF THE INVENTION  
       [0001]     The present invention relates generally to cellular networks. More particularly, the present invention relates to the prevention of viruses and worms from entering and propagating through cellular networks.  
       BACKGROUND OF THE INVENTION  
       [0002]     Mobile devices such as mobile telephones and personal digital assistants (PDAs) can become infected by computer viruses and worms through several mechanisms. A computer virus is a parasitic program that is designed to enter a computer or other electronic device without the user&#39;s permission or knowledge. The virus attaches to files or boot sectors and replicates itself, thus continuing to spread. A computer worm also copies itself across a network but, unlike a computer virus, is capable of spreading without a host program.  
         [0003]     In recent years, virus and worm attacks have proliferated on the Internet. Attacks using malicious objects such as viruses and worms not only perform malicious actions, such as using up a terminal&#39;s resources, modifying the configuration of the terminal, preventing applications from running, or shutting down the system, but these programs can often infect other terminals at an extraordinary rate.  
         [0004]     In a short period of time, these viruses and worms can quickly spread, affecting a considerable number of users and affecting the network resources because of the traffic that is generated.  
         [0005]     When it comes to viruses and worms propagating through cellular networks, it is understood that prevention is the best approach to addressing this issue. Protecting the network infrastructure may not be enough to completely protect a network, but it is often desirable or necessary to implement at least some procedures for detecting infected terminals, as well as repairing and cleaning infected terminals.  
         [0006]     A number of entities are continuously attempting to solve the problems associated with the infection and propagation of viruses and worms within cellular networks. However, conventional systems are currently only capable of preventing and addressing some of the problems associated with worms and viruses.  
       SUMMARY OF THE INVENTION  
       [0007]     To address the problem of viruses and worms propagating through a cellular network, the present invention provides for an antivirus architecture with a quarantine network. If a terminal within the network is suspected of being infected by a virus or worm, the terminal is placed within the quarantine network. Traffic to and from terminals in the quarantine network is separated from normal traffic. During the quarantine process, the traffic is analyzed by a quarantine network component. Based upon the result of this analysis, the quarantine component selectively allows the access of infected terminals to the network and network services. The quarantine network can also provide ‘special treatment’ to such terminals through the existing network.  
         [0008]     With the present invention, the quarantine network has the ability to quarantine the infected terminal without completely shutting it out from the access network. The present invention can also result in more support being provided for repairing infected terminals.  
         [0009]     These and other objects, advantages and features of the invention, together with the organization and manner of operation thereof, will become apparent from the following detailed description when taken in conjunction with the accompanying drawings, wherein like elements have like numerals throughout the several drawings described below.  
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0010]      FIG. 1  is an overview diagram of a system within which the present invention may be implemented;  
         [0011]      FIG. 2  is a perspective view of a mobile telephone that can be used in the implementation of the present invention;  
         [0012]      FIG. 3  is a schematic representation of the telephone circuitry of the mobile telephone of  FIG. 2 ;  
         [0013]      FIG. 4  is a representation of an antivirus architecture for use with one embodiment of the present invention; and  
         [0014]      FIG. 5  is a flow chart showing the implementation of one embodiment of the present invention. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0015]      FIG. 1  shows a system  10  in which the present invention can be utilized, comprising multiple communication devices that can communicate through a network. The system  10  may comprise any combination of wired or wireless networks including, but not limited to, a mobile telephone network, a wireless Local Area Network (LAN), a Bluetooth personal area network, an Ethernet LAN, a token ring LAN, a wide area network, the Internet, etc. The system  10  may include both wired and wireless communication devices.  
         [0016]     For exemplification, the system  10  shown in  FIG. 1  includes a mobile telephone network  11  and the Internet  28 . Connectivity to the Internet  28  may include, but is not limited to, long range wireless connections, short range wireless connections, and various wired connections including, but not limited to, telephone lines, cable lines, power lines, and the like.  
         [0017]     The exemplary communication devices of the system  10  may include, but are not limited to, a mobile telephone  12 , a combination PDA and mobile telephone  14 , a PDA  16 , an integrated messaging device (IMD)  18 , a desktop computer  20 , and a notebook computer  22 . The communication devices may be stationary or mobile as when carried by an individual who is moving. The communication devices may also be located in a mode of transportation including, but not limited to, an automobile, a truck, a taxi, a bus, a boat, an airplane, a bicycle, a motorcycle, etc. Some or all of the communication devices may send and receive calls and messages and communicate with service providers through a wireless connection  25  to a base station  24 . The base station  24  may be connected to a network server  26  that allows communication between the mobile telephone network  11  and the Internet  28 . The system  10  may include additional communication devices and communication devices of different types.  
         [0018]     The communication devices may communicate using various transmission technologies including, but not limited to, Code Division Multiple Access (CDMA), Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Transmission Control Protocol/Internet Protocol (TCP/IP), Short Messaging Service (SMS), Multimedia Messaging Service (MMS), e-mail, Instant Messaging Service (IMS), Bluetooth, IEEE 802.11, etc. A communication device may communicate using various media including, but not limited to, radio, infrared, laser, cable connection, and the like.  
         [0019]      FIGS. 2 and 3  show one representative mobile telephone  12  within which the present invention may be implemented. It should be understood, however, that the present invention is not intended to be limited to one particular type of mobile telephone  12  or other electronic device. The mobile telephone  12  of  FIGS. 2 and 3  includes a housing  30 , a display  32  in the form of a liquid crystal display, a keypad  34 , a microphone  36 , an ear-piece  38 , a battery  40 , an infrared port  42 , an antenna  44 , a smart card  46  in the form of a UICC according to one embodiment of the invention, a card reader  48 , radio interface circuitry  52 , codec circuitry  54 , a controller  56  and a memory  58 . Individual circuits and elements are all of a type well known in the art, for example in the Nokia range of mobile telephones.  
         [0020]     The present invention involves the introduction of a quarantine network in order to address threat emanating from viruses and worms. The present invention particularly focuses on limiting the damage that can result from these types of malicious programs. A quarantine network according to the present invention quarantines an infected terminal&#39;s traffic from the normal traffic flow. During the quarantining period, all of the traffic will be analyzed by the quarantine network component. Based upon the result of this analysis, the network can restrict the access of infected terminals to various services. The present invention also allows the network to lower the quality of service (QoS) for an infected terminal. The quarantine network can forward packets directly to and from the Internet  28  in a normal fashion if the packets are considered to be free of malicious objects. Furthermore, the quarantine network can notify the user of the infected terminal user by utilizing an already-established session. The quarantine network can also be additional support to the infected terminal. For example, the quarantine network can undertake various repairs if so required.  
         [0021]      FIG. 4  is a representation of the antivirus architecture according to one embodiment of the present invention. The architecture of  FIG. 4  shows the interaction between a quarantine network  100  and a separate public data network (PDN)  110  or other network. The quarantine network  100  can include its own antivirus service  120  with a virus signature storage region, while an antivirus scanner  130  with an antivirus classification can be located outside of the quarantine network  100 . It should be noted that the terms “antivirus scanner” and “antivirus service” can refer to devices and services which address malicious objects besides viruses, such as worms and other items. The antivirus classification for the antivirus scanner  130  is based upon a signature and a quarantine/forward decision as discussed below.  
         [0022]     A gateway  140  or integrated services network (ISN) provides or supports a range of different telecommunications services. The gateway  140  has policy-based routing or a redirection function to steer traffic to the appropriate location or domain. An antivirus control module  150  signals the subset of viruses that must be scanned from an IP flow. The antivirus control module  150  also requests the terminal type from an IPSC  160 . The IPSC  160  fetches subscriber data from a subscriber database  170  and transmits the subscriber data to the gateway  140 . The subscriber database  170  stores the user&#39;s terminal type, as well as the terminal&#39;s potential subscription to the antivirus service  120 . Each terminal may run its own antivirus scanner or sofftware or subscribe to the antivirus service  120  of the quarantine network  100 . The terminal or user equipment is represented at  180  in  FIG. 4 . A remediation server  190  can provide support to terminals that are in need of repairs or updates in order to comply with particular admission requirements.  
         [0023]      FIG. 5  shows the process for implementing one particular embodiment of the present invention. At step  500 , the antivirus service  120  transmits the appropriate virus signatures to the antivirus scanner  130 . The signatures are available to the antivirus scanner  130  as terminal specific subsets ((such as subset id, signature lists, etc.) The antivirus scanner  130  can also “pull” signatures from the antivirus service  120  as well, such as during a restart of the terminal, in one embodiment of the invention. At this point, the antivirus scanner  130  within the quarantine network  100  has been updated with the correct virus signatures.  
         [0024]     At step  505 , the terminal or user equipment  180  accesses the network. If the terminal  180  has its own antivirus software, then the terminal  180  should indicate the version of the software and the terminal type. This is represented at step  510 . If the user has subscribed to the antivirus service  120 , the terminal  180  also provides the antivirus service  120  with information about the terminal at step  515  in order to avoid scanning for all of the viruses in the world. Information such as the terminal&#39;s operating system, software packages, and other information can help to restrict the necessary scope of scanning, as the devices that may be at risk to a particular virus will vary by operating system, etc.  
         [0025]     At step  520 , the gateway  140  forwards messaging packets (for example, an HTTP message) to the antivirus scanner  130  based upon the subscriber&#39;s service set. The gateway also informs the antivirus scanner  130  of the signatures that should be checked for based upon the terminal type, version and other information that may be available concerning the terminal  180 .  
         [0026]     When a terminal  180  is suspected of being an infected terminal, the antivirus scanner  130  informs the antivirus control module  150  at step  525 . The gateway  140  will then route and/or quarantine the traffic from the terminal  180  to the quarantine network  100  at step  530 . The gateway can also degrade the quality of service of the infected terminal&#39;s traffic based on pre-set policies. This is represented at step  535 .  
         [0027]     If the quarantine network  100 , particularly the antivirus service  120 , determines that traffic from the terminal  180  poses no substantial virus or worm risk or is lower than the terminal&#39;s quality of service, then it forwards the traffic to the Internet or other public data network  110  at step  540 .  
         [0028]     The antivirus service  120  or other quarantine network component can perform a variety of actions. For example, for a downlink message from the terminal  180  to another device, the antivirus service  120  can inform the intended recipient where the message will be available at step  545 . In this case, the malicious portion, such as a message attachment, is removed from the message in order to avoid spreading it to the recipient device and beyond. This is represented at step  550 . The remainder of the message can be fetched from a web page in one embodiment of the invention. In the case where there is an uplink message, the antivirus service  120  analyzes and continues to forward such packets which are considered as normal.  
         [0029]     In the event that the terminal  180  is infected, the remediation server  190  notifies the terminal  180  of the infection at step  555 . The user of the terminal  180  can then download antivirus software at step  555 , obtain more help from the remediation server  190  at step  560 , and/or perform a variety of other tasks depending upon the particular system characteristics.  
         [0030]     The present invention is described in the general context of method steps, which may be implemented in one embodiment by a program product including computer-executable instructions, such as program code, executed by computers in networked environments. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of program code for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps.  
         [0031]     Software and web implementations of the present invention could be accomplished with standard programming techniques with rule based logic and other logic to accomplish the various database searching steps, correlation steps, comparison steps and decision steps. It should also be noted that the words “component” and “module,” as used herein and in the claims, is intended to encompass implementations using one or more lines of software code, and/or hardware implementations, and/or equipment for receiving manual inputs.  
         [0032]     The foregoing description of embodiments of the present invention have been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the present invention to the precise form disclosed, and modifications and variations are possible in light of the above teachings or may be acquired from practice of the present invention. The embodiments were chosen and described in order to explain the principles of the present invention and its practical application to enable one skilled in the art to utilize the present invention in various embodiments and with various modifications as are suited to the particular use contemplated.