# US 12,192,174 B2 · Iterative approaches to data authorization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,174 B2 - Document ID: US12192174B2 - Status: Granted - Kind: B2 - Application number: 17/750,594 - Filed: 2022-05-23 - Published: 2022-09-01 - Granted: 2025-01-07 - Earliest claimed: 2020-03-09 - Assignees: The Western Union Company - Applicants: The Western Union Company - Inventors: Ricardo Ledezma Henry - Web page: https://patentgrep.com/patent/US12192174B2 ## CPC - H04L 63/0245: {Filtering by information in the payload} - H04L 63/101: {Access control lists [ACL]} - H04L 63/0263: {Rule management} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/088: using filters or firewalls - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Embodiments described herein relate generally to network-based threat detection mechanisms. Specifically, embodiments described herein describe a communication mechanism that filters (e.g., allows or blocks) received communications according to an iterative security list. ## Claims ### Claim 1 A method comprising: receiving, by a communications mechanism of a computer system, a plurality of communications; scanning, by the communications mechanism, the plurality of communications; for each communication of the plurality of communications, identifying, by the communications mechanism, one or more attributes of the communication; based at least in part on the identifying, storing, by the communications mechanism, communication information corresponding to attributes of the plurality of communications; based at least in part on the attributes of the plurality of communications, generating, by the communications mechanism, an iterative security list applicable to communications to determine whether to allow or block the communications, the iterative security list comprising a set of iterative rules, where each iterative rule of the set of iterative rules is associated with an iteration value and at least one of the attributes; and providing, by the communications mechanism, the iterative security list to apply with subsequent communications to determine whether to allow or block each communication of the subsequent communications. ### Claim 2 (depends on 1) The method as recited in claim 1, where the plurality of communications are received from a communications database that stores past communications. ### Claim 3 (depends on 1) The method as recited in claim 1, where the one or more attributes of the communication are determined from data within the communication and/or data associated with the communication. ### Claim 4 (depends on 1) The method as recited in claim 1, further comprising: creating, by the communications mechanism, one or more partitions in storage for the one or more attributes; where the storing the communication information corresponding to the attributes of the plurality of communications comprises storing, for each communication, communication information associated with the one or more attributes in the one or more partitions. ### Claim 5 (depends on 1) The method as recited in claim 1, further comprising: applying, by the communications mechanism, the iterative security list to a filtering mechanism of the computer system. ### Claim 6 (depends on 1) The method as recited in claim 1, further comprising: specifying, by the communications mechanism, a particular attribute and variable combination to analyze one or more of the subsequent communications. ### Claim 7 (depends on 1) The method as recited in claim 1, where at least a subset of the subsequent communications is sequentially analyzed according to the iterative security list so that each communication of the subset is analyzed multiple times according to different iterative rules of the iterative security list to determine whether to allow or block the communication. ### Claim 8 A system comprising: one or more processing devices; and memory coupled with the one or more processing devices and configured to store instructions that, when executed by the one or more processing devices, cause the one or more processing devices to perform operations: receiving a plurality of communications; scanning the plurality of communications; for each communication of the plurality of communications, identifying one or more attributes of the communication; based at least in part on the identifying, storing communication information corresponding to attributes of the plurality of communications; based at least in part on the attributes of the plurality of communications, generating an iterative security list applicable to communications to determine whether to allow or block the communications, the iterative security list comprising a set of iterative rules, where each iterative rule of the set of iterative rules is associated with an iteration value and at least one of the attributes; and providing the iterative security list to apply with subsequent communications to determine whether to allow or block each communication of the subsequent communications. ### Claim 9 (depends on 8) The system as recited in claim 8, where the plurality of communications are received from a communications database that stores past communications. ### Claim 10 (depends on 8) The system as recited in claim 8, where the one or more attributes of the communication are determined from data within the communication and/or data associated with the communication. ### Claim 11 (depends on 8) The system as recited in claim 8, the operations further comprising: creating one or more partitions in storage for the one or more attributes; where the storing the communication information corresponding to the attributes of the plurality of communications comprises storing, for each communication, communication information associated with the one or more attributes in the one or more partitions. ### Claim 12 (depends on 8) The system as recited in claim 8, the operations further comprising: applying the iterative security list to a filtering mechanism of computer system. ### Claim 13 (depends on 8) The system as recited in claim 8, the operations further comprising: specifying a particular attribute and variable combination to analyze one or more of the subsequent communications. ### Claim 14 (depends on 8) The system as recited in claim 8, where at least a subset of the subsequent communications is sequentially analyzed according to the iterative security list so that each communication of the subset is analyzed multiple times according to different iterative rules of the iterative security list to determine whether to allow or block the communication. ### Claim 15 One or more non-transitory, computer-readable storage media having instructions stored thereon for causing one or more processing devices to perform operations comprising: receiving a plurality of communications; scanning the plurality of communications; for each communication of the plurality of communications, identifying one or more attributes of the communication; based at least in part on the identifying, storing communication information corresponding to attributes of the plurality of communications; based at least in part on the attributes of the plurality of communications, generating an iterative security list applicable to communications to determine whether to allow or block the communications, the iterative security list comprising a set of iterative rules, where each iterative rule of the set of iterative rules is associated with an iteration value and at least one of the attributes; and providing the iterative security list to apply with subsequent communications to determine whether to allow or block each communication of the subsequent communications. ### Claim 16 (depends on 15) The one or more non-transitory, computer-readable storage media as recited in claim 15, where the plurality of communications are received from a communications database that stores past communications. ### Claim 17 (depends on 15) The one or more non-transitory, computer-readable storage media as recited in claim 15, where the one or more attributes of the communication are determined from data within the communication and/or data associated with the communication. ### Claim 18 (depends on 15) The one or more non-transitory, computer-readable storage media as recited in claim 15, the operations further comprising: creating one or more partitions in storage for the one or more attributes; where the storing the communication information corresponding to the attributes of the plurality of communications comprises storing, for each communication, communication information associated with the one or more attributes in the one or more partitions. ### Claim 19 (depends on 15) The one or more non-transitory, computer-readable storage media as recited in claim 15, the operations further comprising: applying the iterative security list to a filtering mechanism of a computer system. ### Claim 20 (depends on 15) The one or more non-transitory, computer-readable storage media as recited in claim 15, the operations further comprising: specifying a particular attribute and variable combination to analyze one or more of the subsequent communications.