New Technologies to Combat New Threats: Kaspersky Lab Obtains 29 Patents in Q1 2015

Woburn, MA – June 19, 2015 –Kaspersky Lab today announced that in the first quarter of 2015, the company obtained 29 patents in the US, the EU, Russia and China. The patents enhance Kaspersky Lab’s technology portfolio to provide its customers with superior protection against cyberthreats.

Some of the patents obtained in Q1 2015 assist companies that have worked increasingly hard on protecting data confidentiality and applying data encryption. To ensure reliable protection, Kaspersky Lab is constantly improving its own encryption technology that is included in Kaspersky Endpoint Security for Business. The United States Patent and Trademark Office granted Kaspersky Lab two patents related to this technology in Q1 of 2015. The first patent, System and method for robust full-drive encryption, makes the Full Disk Encryption (FDE) service more resilient. The patent describes a method to determine the optimum size of the data block and the mask of the encrypted area needed to maintain the resiliency of full disk encryption. The second patent, System and method for controlling user access to encrypted data, describes a technology that simplifies the administration of accounts and regulation of encryption policies. This development can automatically determine the list of active users of each computer and create preloading accounts that require authentication before loading the operating system when using full disk encryption. It also describes an automatic method to apply encryption policies for all active users of the computer.

Kaspersky Lab also received the following patents from the United States Patent and Trademark Office (USPTO):

• Portable security device and methods for secure communication. The patent describes a hardware solution that helps minimize the risks associated with the possible theft of different sorts of authentication data. This information can be stored on a separate device with its own CPU, memory, closed operating system, input and output devices as well as network controllers for connections to an unprotected computer.
• System and method for detection of malware using behavior model scripts of security rating rules. The technology develops the use of rules to determine the security rating of various processes. This approach is used in the System Watcher module, which is part of Kaspersky Lab’s solutions for both home users and businesses. The patented approach allows the creation of special scripts that are based on the same rules of determining the security rating but which use logical operators (OR, AND). This enables evaluation of the threat level for certain sets of rules, taking into account the frequency of their activation. In addition, it is possible to set an extreme value for the threat rating for each set of rules that allows an immediate block on specific patterns of malicious behavior (for example, attempts to steal passwords).
• Flexible fingerprint for detection of malware. This patent describes a system of data conversion that enables generation of the same results from a variety of similar files. That means a slight change in the file does not entail a change in the conversion result. Thus, it will serve as a universal checksum to identify various modifications of the same malicious code, helping to substantially reduce the size of antivirus databases while improving detection.
• System and method for automatically configuring application control rules. The technology helps to eradicate the errors that may occur when using several conflicting application control rules. The patented system can check any rule using the predetermined "network model." The model includes information on all executable files and their categories, on user accounts and their roles in the network, as well as on all existing application control rules. The system makes it possible to adjust the rules if contradictions are detected.
• System and method for detecting malicious software using malware trigger scenarios. This patent describes a method of controlling the operation of a mobile application and simulating possible user action scenarios on the device to analyze the application. This makes it possible to create a controlled environment in which the applications will be studied in different simulated conditions, specifically those where malicious code could execute its payload.
• System and method for linking various protocols for controlling devices with their owners. The technology enables multiple devices with software agents installed to be associated with a particular user. This allows the system administrator to apply policies and issue commands at a user level rather than a device level. This is used in Kaspersky Security Center.
• System and methods of distributing antivirus checking tasks among virtual machines in a virtual network. This patent describes a technology that transfers the load on different virtual machines by dividing the protection system into two levels. The first level of protection, implemented by the light agent working on a virtual machine, can meet challenges that require a quick response to possible actions, and contains such components as the Host-based Intrusion Prevention System. The second level is implemented using a specialized machine, and solves more resource-intensive, less priority-oriented and more lasting tasks, such as antivirus scanning of files. The technology is used in Kaspersky Security for Virtualization.

Several patents have been granted by Rospatent, Russia’s patent agency. These include:

• System and method for adaptive modification of antivirus databases. The patented technology separates the records of the antivirus engine database by different types. It works as follows: when a file signature is added to the base, its file type (for example, .exe or .zip) is analyzed and information about it is stored in the database. Therefore, the next scan starts by determining the file type and comparing it to the corresponding signatures. This significantly reduces scan times. The system is used in solutions for mobile devices.
• System and method for protecting computer resources from unauthorized access using isolated environment. This patent protects the technology that ensures an organization’s data is secured against unauthorized access. The development involves the creation of isolated environments for those applications that work with sensitive data. These environments allow the applications to interact with network resources, storage and devices in strict compliance with the enterprise security policies.

Kaspersky Lab is constantly developing and patenting new IT security technologies. As of June 2015, Kaspersky Lab had 322 patents in the US, the EU, Russia and China. The company has a further 301 patent applications pending in several countries.

About Kaspersky Lab

Kaspersky Lab is the world’s largest privately held vendor of endpoint protection solutions. The company is ranked among the world’s top four vendors of security solutions for endpoint users^*. Throughout its more than 17-year history Kaspersky Lab has remained an innovator in IT security and provides effective digital security solutions for large enterprises, SMBs and consumers. Kaspersky Lab, with its holding company registered in the United Kingdom, currently operates in almost 200 countries and territories across the globe, providing protection for over 400 million users worldwide. Learn more at www.kaspersky.com.

*The company was rated fourth in the IDC rating Worldwide Endpoint Security Revenue by Vendor, 2013. The rating was published in the IDC report Worldwide Endpoint Security 2014–2018 Forecast and 2013 Vendor Shares (IDC #250210, August 2014). The report ranked software vendors according to earnings from sales of endpoint security solutions in 2013.

For the latest in-depth information on security threat issues and trends, please visit:

Securelist | Information about Viruses, Hackers and Spam
Follow @Securelist on Twitter

Threatpost | The First Stop for Security News
Follow @Threatpost on Twitter

Media Contact
Stephen Russell
781.503.1833
stephen.russell@kaspersky.com