US 2003/0172301 A1Published application

Systems and methods for adaptive message interrogation through multiple queues

AssigneeCipherTrust, Inc.

InventorsPaul Judge, Guru Rajan

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present invention is directed to systems and methods for enhancing electronic communication security. An electronic communication is received and stored. A plurality of risk assessments are made with respect to the received communication thereby generating a risk profile associated with the communication. The assessments are made in a sequential manner by assigning the stored communication and index and serially placing the index on queue associated with interrogation engines that perform the various assessments. The index is initially placed in a queue associated with an interrogation engine performing the first type of assessment on the communication. The index is placed in a subsequent queue only after the interrogation engine associated with the prior queue in which the index was placed has assessed the communication. This is repeated until all desired assessments have been performed. Each assessment may result in the output of an assessment indicator that indicates the results of the particular assessment.

Claims53

Dependent claims

A security system for interrogation of a communication transmitted over a communication network, the system comprising:

a) a communication interface communicatively coupling the system to a communication network;
b) a system data store comprising:
i) a message data store capable of storing a communication;
and
ii) a queue data store capable of storing a plurality of index queues;
and
c) a system processor in communication with the communication interface and the system data store, wherein the system processor comprises one or more processing elements and wherein the system processor:
i) receives a communication via the communication interface;
ii) stores the received message in the message data store;
iii) assigns a selected index to the stored communication;
iv) executes a plurality of interrogation engines, wherein each of the interrogation engines has a test type and has an index queue in the queue data store associated with it, and wherein each of the interrogation engines:
1) monitors its associated index queue for a placed index;
2) retrieves the communication associated with the placed index from the message data store;
3) assesses the retrieved communication against a set of one or more criteria related to the interrogation engine's test type;
and
4) outputs an assessment indicator indicating results of assessing the retrieved communication with respect to the set of one or more criteria;
and
v) places the selected index into the index queue associated with a first interrogation engine, wherein the first interrogation engine has a first test type;
and
vi) responsive to the assessment indicator output by the first interrogation engine, places the selected index into the index queue associated with a second interrogation engine, wherein the second interrogation engine has a second test type that differs from the first test type.

17 more elements

A method for interrogation of a communication transmitted over a communication network, the method comprising the steps of:

a) receiving a communication transmitted over a communication network;
b) assigning a selected index to the received communication;
c) executing a plurality of interrogation engines, wherein each of the interrogation engines has a test type and has an index queue associated with it, and wherein each of the interrogation engines performs the steps comprising of:
i) monitoring its associated index queue for a placed index;
ii) assessing the communication associated with the placed index against a set of one or more criteria related to the interrogation engine's type;
and
iii) outputting an assessment indicator indicating results of assessing the communication associated with the placed index with respect to the set of one or more criteria;
d) placing the selected index into the index queue associated with a first interrogation engine, wherein the first interrogation engines has a first test type;
and
e) responsive to the assessment indicator output by the first interrogation engine, placing the selected index into the index queue associated with a second interrogation engine, wherein the second interrogation engine has a second test type that differs from the first test type.

7 more elements

Computer readable storage media storing instructions that upon execution by a system processor cause the system processor to interrogate a communication transmitted over a communication network, the media having stored instruction that cause the system processor to perform the steps comprising of:

a) receiving a communication transmitted over a communication network;
b) assigning a selected index to the received communication;
c) executing a plurality of interrogation engines, wherein each of the interrogation engines has a test type and has an index queue associated with it, and wherein each of the interrogation engines performs the steps comprising of:
i) monitoring its associated index queue for a placed index;
ii) assessing the communication associated with the placed index against a set of one or more criteria related to the interrogation engine's type;
and
iii) outputting an assessment indicator indicating results of assessing the communication associated with the placed index with respect to the set of one or more criteria;
d) placing the selected index into the index queue associated with a first interrogation engine, wherein the first interrogation engines has a first test type;
and
e) responsive to the assessment indicator output by the first interrogation engine, placing the selected index into the index queue associated with a second interrogation engine, wherein the second interrogation engine has a second test type that differs from the first test type.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 10/093,553Filed 8 Mar 2002
Published: 11 Sep 2003
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 21/55
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: detecting local…
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L 63/102
For controlling access to devices or network resources: entity profiles
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection