Patent Publication Number: US-11663335-B2

Title: Anti-virus chip and anti-virus method

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     This application claims priority of Taiwan Patent Application No. 109113721, filed on Apr. 24, 2020, the entirety of which is incorporated by reference herein. 
     TECHNICAL FIELD 
     The present invention relates to an anti-virus technology, and in particular it relates to an anti-virus chip and an anti-virus method. 
     BACKGROUND 
     In general, when an external device, such as a flash drive, is connected to a connection port of an electronic device, the operating system of the electronic device may connect automatically to the external device and read all files of the external device. However, if a virus exists in the external device, the virus may easily spread to (infect) all the data by following the file system of the electronic device. 
     In addition, since a boot sector of the electronic device is infected by the virus after the electronic device is connected to the external device, an anti-virus software running on the operating system may only notify the user and may not eliminate this boot-type virus. Therefore, general anti-virus software may not prevent an attack by a boot-type virus. 
     SUMMARY 
     An embodiment of the present invention provides an anti-virus chip. The anti-virus chip includes a first connection terminal, a second connection terminal, a detection unit and a processing unit. The first connection terminal is coupled to a connection port of an electronic device. The second connection terminal is coupled to a system circuit of the electronic device. The detection unit detects whether the connection port is connected to an external device via the first connection terminal. When the detection unit detects that the connection port is connected to the external device, the processing unit performs a virus-scan program on the external device to determine whether a virus exists in the external device. When determining that a virus does not exist in the external device, the processing unit establishes a first transmission path between the first connection terminal and the second connection terminal. When determining that a virus exists in the external device, the processing unit does not establish a first transmission path. 
     An embodiment of the present invention provides an anti-virus method suitable for an anti-virus chip. The anti-virus chip is coupled between a connection port of an electronic device and a system circuit of the electronic device. The anti-virus method includes: detecting whether the connection port is connected to an external device; performing a virus-scan program on the external device to determine whether a virus exists in the external device when detecting that the connection port is connected to the external device; establishing a first transmission path between the connection port and the system circuit when determining that a virus does not exist in the external device; and not establishing a first transmission path when determining that a virus exists in the external device. 
     An embodiment of the present invention provides an anti-virus chip. The anti-virus chip includes a first connection terminal, a second connection terminal, a random access memory and a processing unit. The first connection terminal is coupled to a connection port of an electronic device. The second connection terminal is coupled to a system circuit of the electronic device. The processing unit performs a write-test program on the random access memory according to internal data output by the system circuit, and the processing unit determines whether a virus exists in the system circuit according to the test result of the write-test program. When determining that a virus exists in the system circuit, the processing unit does not establish a first transmission path between the first connection terminal and the second connection terminal. When the virus does not exist in the system circuit, the processing unit establishes a first transmission path. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
       The present invention can be more fully understood by reading the subsequent detailed description and examples with references made to the accompanying drawings, wherein: 
         FIG.  1    is a schematic view of an embodiment of an external device connected to an electronic device with an anti-virus chip; 
         FIG.  2    is a block diagram of an embodiment of an anti-virus chip, 
         FIG.  3    is a schematic flowchart of a first embodiment of an anti-virus method; 
         FIG.  4 A  is a schematic flowchart of a second embodiment of an anti-virus method; 
         FIG.  4 B  is a schematic flowchart of a third embodiment of an anti-virus method; and 
         FIG.  5    is a schematic flowchart of a fourth embodiment of an anti-virus method. 
     
    
    
     DETAILED DESCRIPTION OF DISCLOSED EMBODIMENTS 
     In order to make the above objects, features and advantages of the embodiments of the present invention easier to understand, a detailed description is given in the following embodiments with reference to the accompanying drawings. 
     It should be understood that terms “include” or “comprise” used in this specification is used to indicate the existence of specific technical features, values, method steps, operations, elements and/or components, but it is not excluded that more technical features, values, method step, operations, elements, components, or any combination of the above may be added. 
     Terms, such as “first”. “second”, and “third”, are used to modify elements, and not used to indicate priority or antecedent relationship between them, but only to distinguish elements with the same name. 
       FIG.  1    is a schematic view of an embodiment of an external device connected to an electronic device with an anti-virus chip. Please refer to  FIG.  1   . The anti-virus chip  100  may be disposed inside the electronic device  200 . The electronic device  200  includes a connection port  210  and a system circuit  220 . The connection port  210  may be used to connect to the external device  300 , and the anti-virus chip  100  is located between the connection port  210  and the system circuit  220 , so as to control whether a transmission path between the connection port  210  and the system circuit  220  is established. In the embodiment, when the external device  300  is connected to the connection port  210  of the electronic device  200 , for example, the user inserts a connection port  310  of the external device  300  into the connection port  210  of the electronic device  200  or connects the external device  300  to the connection port  210  of the electronic device  200  through a connection line, the system circuit  220  of the electronic device  200  may not directly establish a transmission with the external device  300  at this time. Then, the system circuit  220  needs to communicate with the external device  300  via the connection of the anti-virus chip  100  after the anti-virus chip  100  determines that a virus does not exist. 
     In an embodiment, the anti-virus chip  100  may perform an anti-virus method of a first embodiment of the present invention, so that the anti-virus chip  100  may connect the external device  300  to the system circuit  220  after determining that the virus does not exist in the external device  300 , so as to prevent the electronic device  200  from being attacked by the virus. In another embodiment, the anti-virus chip  100  may also perform an anti-virus method of a second embodiment or a third embodiment of the present invention, so that the an anti-virus chip  100  may connect the external device  300  to the system circuit  220  after determining that the virus does not exist in the system circuit  220 , so as to prevent the external device  300  from being attacked by the virus. In yet another embodiment, the anti-virus chip  100  may further perform an anti-virus method of a fourth embodiment of the present invention, so that the anti-virus chip  100  may connect the external device  300  to the system circuit  220  after determining that the virus does not exist in the external device  300  and the virus does not exist in the system circuit  220 , so as to prevent any party from being attacked by the virus. 
     In some embodiments, the electronic device  200  may be various electronic devices, such as a computer, a notebook, a tablet, a mobile phone, a machine, etc. In addition, the transmission interface used by the connection port  210  may be a universal series bus (USB), a series advanced technology attachment (SATA), a parallel advanced technology attachment (PATA), a peripheral controller interface (PCI) or other suitable transmission interfaces. In the embodiment, the connection port  210  is described by using the universal series bus as an example. 
     In some embodiments, the system circuit  220  may be a core circuit of the electronic device  200 , such as a chipset. The chipset may be, for example, a north bridge chip, a south bridge chip, a combination of the north bridge chip and the south bridge chip, an independent chip, etc. The external device  300  may also be various electronic devices suitable for transmission with the electronic device  200 , such as a flash drive, an external hard drive, a mobile phone, etc. Furthermore, the anti-virus chip  100  and the system circuit  220  may be disposed on the same circuit board, but the present invention is not limited thereto. 
       FIG.  2    is a block diagram of an embodiment of an anti-virus chip. Please refer to  FIG.  1    and  FIG.  2   . In an embodiment, the anti-virus chip  100  may include at least two connection terminals (hereinafter referred to as a first connection port  111  and a second connection terminal  112 ), a detection unit  120  and a processing unit  130 . In addition, the anti-virus chip  100  may further include a path control unit  140 . The detection unit  120  is coupled to the first connection terminal  111 , the path control unit  140  is coupled to the first connection terminal  111  and the second connection terminal  112 , and the processing unit  130  is coupled to the detection unit  120  and the path control unit  140 . 
     The first connection terminal  111  is used to couple to the connection port  210  of the electronic device  200 , and the second connection terminal  112  is used to couple to the system circuit  220  of the electronic device  200 . In some embodiments, when the connection port  210  is the universal series bus transmission interface, the first connection terminal  111  may include at least two data pins (hereinafter referred to as a first positive phase data pin D1+ and a first negative phase data pin D1−), and the second connection terminal  112  may also include at least two data pins (hereinafter referred to as a second positive phase data pin D2+ and a second negative phase data pin D2−). 
     The detection unit  120  is coupled to the first positive phase data pin D1+ and the first negative phase data pin D1− of the first connection terminal  111 . In the embodiment, the detection unit  120  may detect whether the connection port  210  is connected to any external device  300  via the first positive phase data pin D1+ and the first negative phase data pin D1− of the first connection terminal  111 . 
     The path control unit  140  is controlled by the processing unit  130 . In the embodiment, the path control unit  140  may control whether a first transmission path P 1  between the first connection terminal  111  and the second connection terminal  112  is established, whether a second transmission path P 2  between the first connection terminal  111  and the processing unit  130  is established, and whether a third transmission path P 3  between the second connection terminal  112  and the processing unit  130  is established. In the embodiment, the path control unit  140  normally disconnects the first transmission path P 1 . Therefore, when the external device  300  is connected to the connection port  210  of the electronic device  200 , the external device  300  may not directly be connected to the system circuit  220 . 
     The processing unit  130  controls the path control unit  140  to perform the corresponding process according to the detection result of the detection unit  120 . In some embodiment, the processing unit  130  may be implemented by a central processing unit (CPU), a micro-processor, a digital signal processor (DSP), a programmable controller, an application specific integrated circuit (ASIC), a programmable logic device or other similar circuit elements, but the present invention is not limited thereto. 
       FIG.  3    is a schematic flowchart of a first embodiment of an anti-virus method. Please refer to  FIG.  1    to  FIG.  3   . In the first embodiment of the anti-virus method, the anti-virus chip  100  may use the detection unit  120  to detect whether the connection port  210  is connected to the external device  300  via the first connection terminal  111  (step S 11 ). When the detection unit  120  detects that the connection port  210  is connected to the external device  300 , the anti-virus chip  100  may use the processing unit  130  to perform a virus-scan program on the external device  300  to determine whether a virus exists in the external device  300  (step S 12 ). When the processing unit  130  determines that the virus does not exist in the external device  300  in step S 12 , the anti-virus chip  100  may establish a first transmission path P 1  between the first connection terminal  111  and the second connection terminal  112  (i.e., between the connection port  210  and the system circuit  220 ) (step S 13 ), so that the electronic device  200  and the external device  300  may perform an unidirectional transmission or a bidirectional transmission. For example, the system circuit  220  of the electronic device  200  may write the data to the external device  300  via the first transmission path P 1 , or read the data from the external device  300  via the first transmission path P 1 . Otherwise, when the processing unit  130  determines that the virus exists in the external device  300  in step S 12 , the anti-virus chip  100  may not establish the first transmission path P 1 , so as to prevent the virus from entering the electronic device  200  from the external device  300  (step S 14 ). Therefore, in the embodiment, after determining that the virus does not exist in the external device  300 , the processing unit  130  may cause the path control unit  140  to connect the external device  300  to the system circuit  220 , thereby preventing the virus in the external device  300  from infecting (spreading) to the system circuit  220 . 
     In an embodiment of step S 1 , the detection unit  120  may determine whether the external device  300  is connected to the connection port  210  according to whether a level on the first positive phase data pin D1+ or the first negative phase data pin D1− of the first connection terminal  111  is changed to a predetermined level. For example, when detecting that the level on the first positive phase data pin D1+ or the first negative phase data pin D1− is pulled up to a high level, the detection unit  120  may determine that the connection port  210  is connected to the external device  300 , and output an link signal A 1  to the processing unit  130 . Otherwise, if it is detected that the level on the first positive phase data pin D1+ or the first negative phase data pin D1− are continuously maintained at a low level, the detection unit  120  may determine that the connection port  210  is not connected to the external device  300 , and does not output the link signal A 1  to the processing unit  130 . Therefore, in some embodiments, the processing unit  130  may know whether the external device  300  is connected to the connection port  210  according to whether the link signal A 1  is received. In some embodiments, whether the link signal A 1  is received may be determined according to the level of the link signal A 1 . For example, when the processing unit  130  determines that the level of the link signal A 1  is at a high level, for example, logic “1”, it indicates that the link signal A 1  is received. Otherwise, when the processing unit  130  determines that the level of the link signal A 1  is at a low level, for example, logic “0”, it indicates that the link signal A 1  is not received. 
     After the link signal A 1  is received, the processing unit  130  may continue to perform step S 12 . Otherwise, the processing unit  130  returns to perform step S 11 , so as to continuously use the detection unit  120  to perform detection. 
     In some embodiment, the second transmission path P 2  located between the first connection terminal  111  and the processing unit  130  is normally disconnected. Therefore, in an embodiment of step S 12 , the processing unit  130  may first cause the path control unit  140  to establish the second transmission path P 2 , so as to perform the virus-scan program on the external device  300  via the second transmission path P 2 , but the present invention is not limited thereto. In other embodiments, the path control unit  140  may also normally establish the second transmission path P 2  and disconnect the first transmission path P 1  and the third transmission path P 3 , so that the processing unit  130  may perform the virus-scan program on the external device  300  directly via the second transmission path P 2  in the embodiment of step S 12 . 
     In some embodiments, the processing unit  130  may include a transmission circuit  131  and a processing circuit  132 . The transmission circuit  131  is coupled to the path control unit  140 . The processing circuit  132  is coupled to the transmission circuit  131 , the path control unit  140  and the detection circuit  120 . In the embodiment, after the second transmission path P 2  is established, the processing circuit  132  may use the transmission circuit  131  to communicate with the external device  300 . In some embodiments, the transmission circuit  131  may be a transmission circuit that conforms to the communication standard of the connection port  210 . For example, when the connection port  210  is the universal series bus transmission interface, the transmission circuit  131  may be a master transmission device (USB Host), a slave transmission device (USB Slave) or a master/slave transmission device (USB Host/Slave) that uses the communication standard of the universal series bus. 
     In some embodiments, the processing circuit  132  may execute step S 12  to perform the virus-scan program on the external device  300  when the detection unit  120  detects that the connection port  210  is connected to the external device and the system circuit  220  intends to read the external data of the external device  300 , but the present invention is not limited thereto. 
     In an embodiment of step S 12 , in the virus-scan program, the processing circuit  132  may perform a virus-scan on the external device  300  through the transmission circuit  131  according to a plurality of virus codes V 1 -Vn in a virus database L 1  (step S 121 ). 
     In some embodiments, the virus database L 1  may be stored in a flash memory  160 . In some embodiments, the flash memory  160  may be built in the anti-virus chip  100 , and the processing circuit  132  may read the virus database L 1  in the flash memory  160  through a flash memory controller  170 . In other embodiments, as shown in  FIG.  2   , the flash memory  160  may also be connected to an external pin  113  of the anti-virus chip  100 , and the processing circuit  132  may read the virus database L 1  in the flash memory  160  via the external pin  113  through the flash memory controller  170 , but the present invention is not limited thereto. In yet other embodiments, the flash memory  160  is further connected to the system circuit  220 , and the processing circuit  132  may load the virus database L 1  through the system circuit  220 . In some embodiments, the external pin  113  may be a serial peripheral interface (SPI). 
     When the processing circuit  132  discovers that a certain virus exists in the external device  300  according to the virus codes V 1 -Vn in step S 121 , the processing circuit  132  may determines that the virus exists in the external device  300  (step S 122 ), and cause the path control unit  140  not to establish the first transmission path (step S 14 ), so as to prevent the virus in the external device  300  from attacking the system circuit  220 . In the embodiment, how to search for the virus in the external device  300  according to the virus codes V 1 -Vn is already well known to those skilled in the art, and the description thereof is not repeated herein. 
     In an embodiment of step S 14 , the processing circuit  132  not only causes the path control unit  140  not to establish the first transmission path P 1 , but also the processing circuit  132  may further perform a security protection program. In an embodiment of the security protection program, the processing circuit  132  may cause the external device  300  to exclude the virus-infected files through the transmission circuit  131 , for example, isolating the virus-infected files, formatting the external device  300 , etc. In addition, the processing circuit  132  may also generate a warning to notify the user that the external device contains the virus. For example, the processing circuit  132  may upload an interrupt and a data to the system circuit  220  through an enhanced serial peripheral interface (eSPI), and the system circuit  220  may notify the user by displaying a warning message, a warning sound and/or a warning light. Alternatively, the processing circuit  132  may also drive a light emitting element, such as a power light on a computer case, to generate a red flash directly through a general-purpose input/output pin (GPIO pin). Furthermore, the processing circuit  132  may further cause the path control unit  140  to disconnect the second transmission path P 2 , so as to disconnect the anti-virus chip  100  from the external device  300 . 
     In some embodiments, the program code of the security protection program may be stored in the flash memory  160 , and the processing circuit  132  may perform the security protection program by reading the program code. 
     In some embodiments, in order to further improve the anti-virus capability of the anti-virus chip  100 , when the processing circuit  132  does not discover that virus exists in the external device  300  according to the virus codes V 1 -Vn in step S 121 , in the virus-scan program, the processing circuit  132  further try to induce the virus to attack a planned virus-induced area  150 A thereof (step S 123 ) and then the processing circuit  132  determines whether the virus exists in the external device  300  according to a virus-induced result of step S 123  (step S 124 ). 
     In some embodiments, the anti-virus chip  100  may further include the random access memory  150 , and the random access memory  150  is coupled to the processing circuit  132 . The processing circuit  132  may plan a virus-induced area  150 A in the random access memory  150 . In the embodiment, the virus-induced area  150 A may include a plurality of simulation-file system files, so as to simulate a computer system disk to test or induce the virus to attack the virus-induced area  150 A. In some embodiments, the simulation-file system file may include a boot sector used to indicate boot information and required files, a root directory used to indicate a file name, a location or attribute, a file allocation table, a file area, etc. In some embodiments, the random access memory  150  may be an internal memory of the processing circuit  132 . 
     In an embodiment of step S 124 , when the virus-induced result in step S 123  indicates that the virus-induced area  150 A is attacked by the virus, the processing circuit  132  may determine that the virus exists in the external device  300  (step S 125 ), and cause the path control unit  140  not to establish the first transmission path P 1  (step S 14 ). In an embodiment of step S 14 , the processing circuit  132  causes the path control unit  140  not to establish the first transmission path P 1 , and the processing circuit  130  may further perform the security protection program. In an embodiment of the security protection program, the processing circuit  132  disconnects the anti-virus chip  100  from the external device  300  and/or generates the warning to notify the user, the processing circuit  132  may also use a reset mechanism to reset the random access memory  150 , reload the firmware from the flash memory  160 , etc., so as to return the anti-virus chip  100  to an initial security state. In some embodiments, the reset mechanism may include a power reset, a watchdog timer reset or another suitable reset method. 
     When the virus-induced result indicates that the virus-induced area  150 A is not attacked by the virus, the processing circuit  132  may determine that the virus does not exist in the external device  300  (step S 126 ), and cause the path control unit  140  to establish the first transmission path P 1  (step S 13 ), so as to connect the external device  300  to the system circuit  220 . In some embodiments, the path control unit  140  may disconnect the second transmission path P 2  between the first connection terminal  111  and the processing unit  130  when establishing the first transmission path P 1 . 
     In some embodiments, after the first transmission path P 1  is established, the anti-virus chip  100  may continuously use the detection unit  120  to detect whether the connection port  210  is still connected to the external device  300  via the first connection terminal  111  (step S 15 ). In addition, when the detection unit  120  does not detect that the connection port  210  is connected to the external device  300 , the processing circuit  132  may further cause the path control unit  140  to disconnect the first transmission path P 1  (step S 16 ), so as to avoid that a person uses another external device with the virus to replace the external device that has passed the detection of the anti-virus chip  100 . 
       FIG.  4 A  is a schematic flowchart of a second embodiment of an anti-virus method. Please refer to  FIG.  1   ,  FIG.  2    and  FIG.  4 A . In the second embodiment of the anti-virus method, the anti-virus chip  100  may use the processing circuit  132  of the processing unit  130  to perform a write-test program on the random access memory  150  according to internal data output by the system circuit  220  (step S 22 ), and the processing circuit  132  may determine whether the virus exists in the system circuit  220  according to the test result of the write-test program (step S 23 ). When the processing unit  130  determines that the virus exists in the system circuit  220  in step S 23 , the anti-virus chip  100  may not cause the path control unit  140  to establish the first transmission path P 1  (step S 24 ), so as to prevent the virus from entering the external device  300  from the electronic device  200  when the electronic device  200  is connected to the external device  300 . Otherwise, when the processing circuit  132  determines that the virus does not exist in the system circuit  220  in step S 23 , the anti-virus chip  100  may use the detection unit  120  to detect whether the connection port  210  is connected to the external device  300  via the first connection terminal  111  (step S 21 ). When the detection unit  120  detects that the connection port  210  is connected to the external device  300 , the anti-virus chip  100  may cause the path control unit  140  to establish the first transmission path P 1  between the first connection terminal  111  and the second connection terminal  112  (i.e., between the connection port  210  and the system circuit  220 ) (step S 25 ), so that the electronic device  200  and the external device  300  may perform the unidirectional transmission or the bidirectional transmission. Therefore, in the embodiment, after determining that the virus does not exist in the electronic device  200 , the processing circuit  132  may cause the path control unit  140  to connect the external device  300  to the system circuit  220 , thereby preventing the virus in the electronic device  200  from infecting (spreading) to the external device  300 . 
     In the embodiment, step S 21  is substantially the same as step S 11 , and the description thereof is not limited herein. In the embodiment, the processing circuit  132  may continue to perform step S 25  after the link signal A 1  of detection unit  120  is received. Otherwise, the processing circuit  132  returns to perform step S 21 , so as to continuously use the detection unit  120  to perform detection. 
     In some embodiments, the third transmission path P 3  located between the second connection terminal  112  and the processing circuit  132  is normally disconnected. Therefore, in an embodiment of step S 22 , the processing circuit  132  may first cause the path control unit  140  to establish the third transmission path P 3 , the processing circuit  132  then use the transmission circuit  131  to receive the internal data output by the system circuit  220 , and the processing circuit  132  performs the write-test program on the random access memory  150  according to the received internal data, but the present invention is not limited thereto. In other embodiments, the path control unit  140  may also normally establish the third transmission path P 3  and disconnect the first transmission path P 1  and the second transmission path P 2 , so that the processing circuit  132  may directly use the transmission circuit  131  to receive the internal data output by the system circuit  220 , and the processing circuit  132  performs the write-test program on the random access memory  150  according to the received internal data. 
     In some embodiments, the internal data output by the system circuit  220  is the data that the user intends to copy from the electronic device  200  to the external device  300 . In the write-test program of step S 22 , the anti-virus chip  100  may be simulated as a storage device through a virtual disk simulation technology, so that the writing operation that the system circuit  220  originally intended to perform on the external device  300  may be first performed on the random access memory  150  of the anti-virus chip  100 . That is, the processing unit  130  may simulate the random access memory  150  as a storage device, so that the processing circuit  132  of the processing unit  130  performs the write-test program on the random access memory  150  according to the internal data output by the system circuit  220 , so as to drive the system circuit  220  to perform a virus test on the above storage device, thereby determining whether the virus exists in the system circuit  220 . 
     In an embodiment of step S 23 , the processing circuit  132  may determine whether the virus exists in the system circuit  220  according to whether the random access memory  150  occurs a virus inflection phenomenon after the write-test program in step S 22 . 
     In an embodiment of step S 24 , the processing circuit  132  not only causes the path control unit  140  not to establish the first transmission path P 1 , but also the processing circuit  132  may further perform the corresponding security protection program. In an embodiment of the security protection program, the processing circuit  132  may a warning to notify the user. Furthermore, the processing circuit  132  may also use a reset mechanism to reset the random access memory  150 , reload the firmware from the flash memory  160 , etc., so as to return the anti-virus chip  100  to an initial security state. 
     In an embodiment of step S 25 , the path control unit  140  may disconnect the third transmission path P 3  between the second connection terminal  112  and the processing unit  130  when establishing the first transmission path P 1 . 
     In some embodiments, after the first transmission path P 1  is established, the anti-virus chip  100  may continuously use the detection unit  120  to detect whether the connection port  210  is still connected to the external device  300  via the first connection terminal  111  (step S 26 ). In addition, when the detection unit  120  does not detect that the connection port  210  is connected to the external device  300 , the processing circuit  132  further cause the path control unit  140  to disconnect the first transmission path P 1  (step S 27 ). 
       FIG.  4 B  is a schematic flowchart of a third embodiment of an anti-virus method. The third embodiment of the anti-virus method of  FIG.  4 B  is substantially similar to the second embodiment of the anti-virus method of  FIG.  4 A . The difference between  FIG.  4 B  and  FIG.  4 A  is the performing order of step S 21 . That is, step S 21  of  FIG.  4 A  is performed after determining that the virus does not exist in the system circuit  220  in step S 23 . Step S 21  of  FIG.  4 B  is performed before step S 22 . Steps S 21  in  FIG.  4 A  and  FIG.  4 B  are performed before step S 25 . In addition, in the third embodiment of the anti-virus method of  FIG.  4 B , the processing circuit  132  may continue to perform step S 22  after the link signal A 1  of the detection unit  120  is received. Otherwise, the processing circuit  132  returns to perform step S 21 , so as to continuously use the detection unit  120  to perform detection. In addition, the third embodiment of  FIG.  4 B  may refer to the description of the second embodiment of  FIG.  4 A , and the same effect may be also achieved. 
       FIG.  5    is a schematic flowchart of a fourth embodiment of an anti-virus method. Please refer to  FIG.  1   ,  FIG.  2    and  FIG.  5   . In the fourth embodiment of the anti-virus method, the anti-virus chip  100  may use the detection unit  120  to detect whether the connection port  210  is connected to the external device  300  via the first connection terminal  111  (step S 31 ). When the detection unit  120  detects that the connection port  210  is connected to the external device  300 , the anti-virus chip  100  may use the processing circuit  132  to perform a virus-scan program on the external device  300  to determine whether a virus exists in the external device  300  (step S 32 ). In addition, the anti-virus chip  100  may use the processing circuit  132  to perform a write-test program on the random access memory  150  according to internal data output by the system circuit  220  (step S 33 ), and the processing circuit  132  may determine whether the virus exists in the system circuit  220  according to the test result of the write-test program (step S 34 ). 
     In some embodiments, the anti-virus chip  100  may use the processing circuit  132  to first cause the path control unit  140  to establish the second transmission path P 2 , so as to perform step S 32  to determine whether the virus exists in the external device  300 . Then, the anti-virus chip  100  may use the processing circuit  132  to cause the path control unit  140  to disconnect the second transmission path P 2  and establish the third transmission path P 3 , so as to perform step S 33  and step S 34  to determine whether the virus exists in the system circuit  220 . However, the present invention is not limited thereto. In other embodiments, the anti-virus chip  100  may also first cause the path control unit  140  to establish the third transmission path P 3 , so as to perform step S 33  and step S 34  to determine whether the virus exists in the system circuit  220 . Afterward, the anti-virus chip  100  may use the processing circuit  132  to cause the path control unit  140  to disconnect the third transmission path P 3  and establish the second transmission path P 2 , so as to perform step S 32  to determine whether the virus exists in the external device  300 . 
     When the processing circuit  132  determines that the virus exists in the external device  300  in step S 32  or determines that the virus exists in the system circuit  220  in step S 34 , the anti-virus chip  100  does not establish the first transmission path P 1  (step S 35 ). Otherwise, when the processing circuit  132  determines that the virus does not exist in the external device  300  in step S 32  and determines that the virus does not exist in the system circuit  220  in step S 34 , the anti-virus chip  100  may establish the first transmission path P 1  (step S 36 ), so that the electronic device  200  and the external device  300  may perform the unidirectional transmission or the bidirectional transmission. Therefore, in the embodiment, after determining that the virus does not exist in the external device  300  and determining that the virus does not exist in the electronic device  200 , the processing unit  130  may cause the path control unit  140  to connect the external device  300  to the system circuit  220 , thereby preventing any party from being attacked by the virus. 
     In some embodiments, after the first transmission path P 1  is established, the anti-virus chip  100  may continuously use the detection unit  120  to detect whether the connection port  210  is still connected to the external device  300  via the first connection terminal  111  (step S 37 ). In addition, when the detection unit  120  does not detect that the connection port  210  is connected to the external device  300 , the processing circuit  132  may further cause the path control unit  140  to disconnect the first transmission path P 1  (step S 38 ). 
     In the embodiment, step S 31  is substantially the same as step S 11  and step S 21 . Step S 32  is substantially the same as step S 12 . Step S 33  is substantially the same as step S 22 . Step S 34  is substantially the same as step S 23 . Step S 35  is substantially the same as step S 14  and step S 24 . In addition, step S 36  is substantially the same as step S 13  and step S 25 . Therefore, the detailed embodiment is not repeated herein. 
     It is worth noting that since the firmware (stored in the flash memory  160 ) of the anti-virus chip  100  and the performing memory (i.e., the random access memory  150 ) are hardware separated, the flash memory  160  may not be infected by the virus, and therefore the anti-virus chip  100  is not worried about being attacked by the virus. In particular, since there is no so-called boot sector in the anti-virus chip  100 , it does not need to worry about being attacked by the boot virus. Furthermore, even if the data of the random access memory  150  is damaged by virus tempering, the anti-virus chip  100  may be restored to the initial security state as long as the power is re-turned on. 
     In summary, according to the anti-virus chip and the anti-virus method disclosed by the embodiment of the present invention, the anti-virus chip coupled between the connection port and the system circuit of the electronic device is used to block the external device from directly connecting to the system circuit through the connection port, and only after determining that the virus does not exist in the external device and/or determining that the virus does not exist in the system circuit, the external device is connected to the electronic device, so that the electronic device and/or the external device may benefit from virus protection. 
     While the present invention has been described by way of example and in terms of the preferred embodiments, it should be understood that the present invention is not limited to the disclosed embodiments. On the contrary, it is intended to cover various modifications and similar arrangements (as would be apparent to those skilled in the art). Therefore, the scope of the appended claims should be accorded the broadest interpretation to encompass all such modifications and similar arrangements.