Login / Signup

Accelerated Antivirus Solution Platform from Freescale & Kaspersky

  • user warning: Table './devemc/sessions' is marked as crashed and last (automatic?) repair failed query: SELECT COUNT(sid) AS count FROM sessions WHERE timestamp >= 1422698079 AND uid = 0 in /home/devemc/public_html/dev/includes/session.inc on line 157.
  • user warning: Table './devemc/sessions' is marked as crashed and last (automatic?) repair failed query: SELECT COUNT(DISTINCT s.uid) FROM sessions s WHERE s.timestamp >= 1422698079 AND s.uid > 0 in /home/devemc/public_html/dev/modules/user/user.module on line 790.
For all OEM Vendors - Accelerated Antivirus Solution Platform from Freescale & Kaspersky

Accelerated AV (Accelerated Antivirus) is a high-performance network antivirus solution platform offered by Freescale Semiconductor and Kaspersky Lab to OEM vendors. Accelerated Antivirus is based on Freescale's MPC8572E PowerQUICC III processor built on Power Architecture technology and Kaspersky's SafeStream signatures database.

[If you want to know more about this Freescale product, please submit your request to Arrow Italy using this form (this form is valid ONLY for Companies or Customers based in Italy and working in the Italian area)]

The platform enables the rapid development of competitive, high-performance, cost-effective network AV devices that are highly effective in the mitigation of the impact of dangerous and widespread malware (viruses, worms and trojans) and malware outbreaks.

Network Antivirus Landscape and Trends
The damage caused by computer malware is very significant. Today, most computers in enterprises are protected by antivirus software to minimize the damage potentially caused by malicious programs. The graph illustrates the speed of infection of major malware outbreaks in recent years.


Speed of infection Accelerated Antivirus Solution Platform


Unfortunately, it may take days, if not weeks, to apply software patches and malware signature updates to all PCs and servers in a large enterprise to defend against a new malware. A network-based solution is inherently more effective than a host-based solution to control malware propagation—applying updates to the much fewer number of network AV devices takes less time (and consumes less network bandwidth). A suitably positioned network-based AV device stops malware before it gets to the host computers. Most enterprises are therefore using network-based AV solutions to mitigate the impact of malware outbreaks to complement a host-based AV solution for in-depth defense.

Traditional network AV is proxy based. In a typical deployment scenario, the mail relay receives the complete e-mail, invokes the antivirus function and forwards the e-mail on to the mail server if it is checked out to be clean. This is a store-and-forward operation. Real time is not a primary concern. Only e-mail traffic—a fraction of the total traffic going into or out of the enterprise network—goes through the mail relay. If there is a delay of a few seconds or even a few minutes, the end-user does not notice.

Traditional Network AV Deployment


Traditional Network AV Deployment


Design Challenges
OEM vendors are faced with a number of design challenges in order to develop and support an effective product to win in the network-based antivirus marketplace. These include:

    • Cost effectiveness
    • High performance
    • Guaranteed, continual, timely availability of accurate malware signatures coupled with fast, in-service, incremental updates of signatures
    • High accuracy

To compete successfully in the market, the network AV device has to be cost effective. A device built from several discrete processors and hardware components may achieve the performance and accuracy required, but the bill of materials and development costs will likely become too high for the marketplace.

Accelerated AV Solution Platform

The solution platform consists of components from Freescale and Kaspersky.

Freescale Components

Software includes drivers and board support packages that are typical of Freescale processors. In addition, specific to the MPC8572E and other future processors with a built-in Pattern Matcher, it also includes Pattern Matcher-specific software for Linux:

    • Pattern management software:
      o RegEx compiler
      o Stateful rule compiler
      o Linker loader
      o Sample Pattern Matcher management application

    • Pattern Matcher driver
    • Sample Pattern Matcher data scan application

With these, the OEM will be able to develop its product hardware and software.

Kaspersky Components
The solution platform components available through Kaspersky are:

    • Kaspersky SafeStream signatures database in binary Freescale Pattern Matcher format
    • Regular daily updates and urgent (in case of malware outbreaks) updates of Kaspersky SafeStream
    signatures database, also in binary Freescale Pattern Matcher format

In other words, before delivery to the OEM, native Kaspersky SafeStream signatures are:

    • Pre-converted to Freescale format
    • Pre-compiled to Freescale binary format
    • Verified to work with Freescale's Pattern Matcher

OEM Responsibility
It is the responsibility of the OEM to develop the following:

    • Proprietary system hardware powered by the MPC8572E PowerQUICC III
    • Proprietary management and scanning software utilizing the Pattern Matcher
    • Mechanism to deliver the signatures in Freescale binary format to its customers, who will link and load the signatures into the network AV device. It is the OEM's choice whether to incorporate the linking and loading of signatures into its security policy management framework.

The OEM may choose to use products and services from other ODMs to develop the complete solution.

Designing Network-Based AV with the Accelerated AV Platform

In order to understand what an ideal network AV platform looks like, let's examine the key operations performed in a typical network AV device. Note that while SMTP is used in the example, other application protocols carrying the file/object to be inspected are also applicable. The Accelerated AV solution is independent of the application protocol.

Typical Network AV Operation

The key data path operations in a typical network AV device are as follows:

    • Allow traffic not of interest to flow through transparently
    • Reassemble (with or without transparent TCP termination) traffic of interest—SMTP is used in the
    above diagram, but other traffic such as HTTP and FTP are also applicable
    • Observe end-to-end SMTP protocol exchange and capture e-mails on the fly
    • MIME decode, separate e-mail into component parts, e. g. attachments
    • Additional unpacking/decompression (for example, unzipping) processing of message

Read the Italian version: Piattaforma Accelerated Antivirus da Freescale & Kaspersky

If you want to know more about this Freescale product, please submit your request to Arrow Italy using this form.

NOTE: this form is valid ONLY for Companies or Customers based in Italy and working in the Italian area.

Who's online

There are currently users and guests online.

Recent comments