US 7,891,001 B1 · Methods and apparatus providing security within a network · patentgrep

Loading patent…

Abstract

An in-network security provider applies security event identification, analysis and processing to a customer's data communications traffic in the form of a “security in the cloud” solution. This method of network defense is achieved when customers pass all of their outbound data communications traffic through the security provider before that data communications traffic reaches the public Internet. Additionally, all inbound data communications traffic is passed through the security provider before it is delivered to the customer. The security provider receives the inbound and outbound sequence of data packets and segregates the sequence of data packets into respective packet flows based on data packet types (HTML, SMTP, FTP, etc.). For individual respective packet flows, the system applies security processing that is appropriate to those packet flows based on that packet flow's data packet type.

Claims23

Dependent claims

A method for applying security processing to data communications traffic, the method including operations comprising:

receiving a sequence of data packets;
classifying each of the data packets by data packet type;
segregating the sequence of data packets into multiple respective packet flows based on data packet types;
for a respective packet flow of the multiple respective packet flows, applying security processing that is appropriate to the respective packet flow based on a data packet type of data packets in the respective packet flow;
and
forwarding the data packets of the respective packet flow to a destination in response to detecting that security processing specific to the data packet type of the respective packet flow passes security testing;
the method further comprising:
retrieving a given data packet from the sequence;
utilizing an address in the given data packet to identify a customer to which the given data packet pertains;
obtaining a security profile for the customer, the security profile indicating security processing to be applied to communications associated with the customer;
identifying an original port number in the given data packet, the original port number indicating a next hop node in which to forward the given data packet;
replacing the original port number in the given data packet with a replacement port number, the replacement port number specifying a particular processing node of multiple processing nodes in which to forward the given data packet, the particular processing node designated to provide security processing for data packets of a same type as the given data packet;
and
forwarding, based on the replacement port number, the given data packet to the particular processing node.

11 more elements

A method for applying security processing to data communications traffic, the method including operations comprising:

receiving a sequence of data packets:
classifying each of the data packets by data packet type;
segregating the sequence of data packets into multiple respective packet flows based on data packet types;
for a respective packet flow of the multiple respective packet flows, applying security processing that is appropriate to the respective packet flow based on a data packet type of data packets in the respective packet flow;
and
forwarding the data packets of the respective packet flow to a destination in response to detecting that security processing specific to the data packet type of the respective packet flow passes security testing;
wherein segregating the sequence of data packets into multiple respective packet flows based on data packet types comprises:
detecting that at least one data packet in the sequence of data packets is an electronic mail message and in response, directing the electronic mail message to a session manager for application of electronic mail security processing techniques provided by a sequence of electronic mail-specific security processing nodes;
and
wherein applying security processing comprises:
obtaining a security profile associated with a security customer to which the electronic mail message is associated, the security profile identifying subscribed-to electronic mail security processing services for that security customer;
routing individual electronic mail messages through a sequence of security processing nodes that each provide specific electronic mail security processing services, the selection of security processing nodes in the sequence determined by the security services subscribed to by the security customer associated with each electronic mail message as specified in the security profile for that security customer, the electronic mail security processing services available for subscription by a security customer and for application by respective security processing nodes including:
i) virus checking;
ii) electronic mail spam filtering;
iii) user validation of at least one on of a sender and a recipient of an electronic mail message associated with the security customer;
iv) black hole validation;
v) content leakage detection to detect unauthorized transmission of content to and from the security customer within electronic mail;
and
vi) electronic mail encryption and decryption operations.

16 more elements

A method for applying security processing to data communications traffic, the method including operations comprising:

receiving a sequence of data packets;
classifying each of the data packets by data packet type;
segregating the sequence of data packets into multiple respective packet flows based on data packet types;
for a respective packet flow of the multiple respective packet flows, applying security processing that is appropriate to the respective packet flow based on a data packet type of data packets in the respective packet flow;
forwarding the data packets of the respective packet flow to a destination in response to detecting that security processing specific to the data packet type of the respective packet flow passes security testing;
and
wherein segregating the sequence of data packets into multiple respective packet flows based on data packet types comprises:
detecting that at least one data packet in the sequence of data packets includes World Wide Web traffic and in response, directing the World Wide Web traffic to a session manager for application of World Wide Web traffic security processing techniques provided by a sequence of World Wide Web traffic-specific security processing nodes;
and
wherein applying security processing comprises:
obtaining a security profile associated with a security customer to which the World Wide Web traffic is associated, the security profile identifying subscribed-to World Wide Web traffic security processing services for that security customer;
populating a security matrix indicating security processing nodes to be applied based on characteristics of the World Wide Web traffic specific to that customer, the security matrix allowing rapid invocation of specific security processing nodes upon the World Wide Web traffic without requiring a security profile lookup for that security customer for each portion of World Wide Web traffic received;
identifying the World Wide Web traffic to a sequence of security processing nodes that each provide specific World Wide Web traffic security processing services, the selection of security processing nodes in the sequence determined by the security services subscribed to by the security customer associated with each electronic mail message, World Wide Web traffic processing services available for subscription by a security customer and for application by respective security processing nodes including:
i) virus checking;
ii) content filtering;
iii) uniform resource locator information validation;
and
iv) World Wide Web protocol validation.

15 more elements

A method for applying security processing to data communications traffic, the method including operations comprising:

receiving a sequence of data packets;
classifying each of the data packets by data packet type;
segregating the sequence of data packets into multiple respective packet flows based on data packet types;
for a respective packet flow of the multiple respective packet flows, at a processing node in a network, applying security processing that is appropriate to the respective packet flow based on a data packet type of data packets in the respective packet flow;
and
forwarding the data packets of the respective packet flow to a destination in response to detecting that security processing specific to the data packet type of the respective packet flow passes security testing;
the method further comprising:
storing a security profile for each of multiple customers;
receiving a first data packet;
receiving a second data packet;
in response to identifying that the first data packet is of a first data packet type, storing the first data packet in a first packet flow;
in response to identifying that the second data packet is of a second data packet type, storing the second data packet in a second packet flow;
based on an address associated with the first data packet, identifying that the first data packet is associated with a first customer;
obtaining a first security profile, the first security profile indicating security processing to be applied to communications associated with the first customer;
applying security processing to the first data packet in accordance with the first security profile;
based on an address associated with the second data packet, identifying that the second data packet is associated with a second customer;
obtaining a second security profile, the second security profile indicating security processing to be applied to communications associated with the second customer;
and
applying security processing to the second data packet in accordance with the second security profile.

16 more elements

A method for applying security processing to data communications traffic, the method including operations comprising:

receiving a sequence of data packets;
classifying each of the data packets by data packet type;
segregating the sequence of data packets into multiple respective packet flows based on data packet types;
for a respective packet flow of the multiple respective packet flows, applying security processing that is appropriate to the respective packet flow based on a data packet type of data packets in the respective packet flow;
forwarding the data packets of the respective packet flow to a destination in response to detecting that security processing specific to the data packet type of the respective packet flow passes security testing;
the method further comprising:
retrieving a given data packet from the sequence;
utilizing an address in the given data packet to identify a customer to which the given data packet pertains;
obtaining a security profile for the customer, the security profile indicating multiple different types of security processing to be applied to communications associated with the customer;
identifying an original port number in the given data packet, the original port number indicating a next hop node in which to forward the given data packet towards a destination node to which the given data packet is being transmitted;
replacing the original port number in the given data packet with a first replacement port number, the first replacement port number specifying a first processing node of multiple processing nodes in which to forward and test the given data packet, the first processing node designated to apply a first type of security processing to the given data packet;
forwarding the given data packet to the first processing node based on the first replacement port number in the given data packet;
subsequent to applying the first type of security processing to the given data packet at the first processing node, replacing the first replacement port number in the given data packet with a second replacement port number, the second processing node designated to apply a second type of security processing to the given data packet;
forwarding the given data packet to the second processing node based on the second replacement port number in the given data packet;
subsequent to applying the second type of security processing to the given data packet at the second processing node, replacing the second replacement port number in the given data packet with the original port number;
and
forwarding the given data packet from the second processing node to the next hop node towards the destination node as specified by the original port number.

14 more elements

A method for applying security processing to data communications traffic, the method including operations comprising:

receiving a sequence of data packets;
classifying each of the data packets by data packet type;
segregating the sequence of data packets into multiple respective packet flows based on data packet types;
for a respective packet flow of the multiple respective packet flows, applying security processing that is appropriate to the respective packet flow based on a data packet type of data packets in the respective packet flow;
forwarding the data packets of the respective packet flow to a destination in response to detecting that security processing specific to the data packet type of the respective packet flow passes security testing;
receiving custom security information from each of multiple customers;
utilizing the custom security information to create multiple customer profiles, the multiple customer profiles specifying types of security testing to be applied to different types communications transmitted in a network for the multiple customers;
storing the customer profiles, each respective customer profile specifying how to test different types of data packets;
wherein classifying each of the data packets by data packet type includes classifying a group of data packets in the sequence as being of a particular data packet type, the method further comprising:
applying a first security test to a first data packet in the group in accordance with a first customer profile of the multiple customer profiles;
and
applying a second security test to a second data packet in the group in accordance with a second customer profile of the multiple customer profiles.

9 more elements

Dependencies are inferred from the claim text.