[Patents] EPO patent on virus trapping

[PILCH Hartmut phm@a2e.de]

EP0769170
COMPUTER VIRUS TRAP 
QUANTUM LEAP INNOVATIONS INC (US)


   Claims
   
   What is claimed is:

   1. A computer virus trapping device comprising:
   link adapter means connected to a source of data input for converting
   external protocols into a data format understood by said trapping
   device;
   emulation means connected to said link adapter means for accepting
   said
   data stream from said link adapter means; said emulation means
   providing an environment isolated from a protected computer
   system that simulates the architecture of said protected computer
   system whereby a computer virus is coaxed into performing its
   intended activity; and
   detection means for monitoring said emulation means and determining
   when said computer virus either has performed or is performing its
   said intended activity.

Creating an emulated computer environment and testint a data stream within
that environment before accepting it into the real computer environment is
a useful and difficult thing to do.  Anyone who endeavors to do it will
have to beg for a licens from "Quantum Leap Technologies".

   2. The device of claim 1, whereby said emulation means comprises
   processing means suitably programmed to create a virtual world for
   said computer virus that simulates said protected computer system.
   3. The device of claim 2, whereby said processing means comprises a
   microcomputer circuit, temporary and permanent data storage and an I/O
   interface.
   4. A computer virus trapping device comprising:
   link adapter means connected to a source of data input for converting
   external protocols into a data format understood by said trapping
   device;
   emulation means connected to said link adapter means for accepting
   said
   data stream from said link adapter means; said emulation means
   providing an environment isolated from a protected computer
   system that simulates the architecture of said protected computer
   system whereby a computer virus is coaxed into performing its
   intended activity;
   detection means for monitoring said emulation means and determining
   when said computer virus either has performed or is performing its
   said intended activity; and
   response means responsive to said detection means to take action
   according to preset user instructions upon said detection means
   determining said computer virus exists.
   5. A computer virus trapping device comprising:
   link adapter means connected to a source of data input for
   bidirectionally
   converting external protocols into a converted data format
   understood by said trapping device;
   emulation means connected to said link adapter means for accepting
   said
   data stream from said link adapter means; said emulation means
   providing an environment isolated from a protected computer
   system and simulating the architecture of said protected computer
   system so as to coax a computer virus into performing its intended
   activity;
   detection means for monitoring said emulation means and determining
   when said computer virus either has performed or is performing its
   said intended activity;
   response means responsive to said detection means to take action
   according to preset user instructions upon said detection means
   determisaid computer virus exists; and
   I/O buffer means for reassembling said converted data back into said
   external data stream protocol and delivering said data stream to
   said protected computer system.
   6. The device of claim 5, whereby said emulation means comprises
   microprocessor means programmed to simulate the environment of said
   protected computer system.
     _________________________________________________________________
   
   Data supplied from the esp@cenet database - l2