System and method for providing data content analysis in a local area network

• US 20050080888A1
• Filed: 10/08/2003
• Published: 04/14/2005
• Est. Priority Date: 10/08/2003
• Status: Active Grant

• Current Assignee: Sbc Knowledge Ventures, L.P.
• Original Assignee: Sbc Knowledge Ventures, L.P.
• Inventors: Walter, Edward A.
• Granted Patent: US 7,971,250 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system and method for providing data content analysis is disclosed. The system includes an intelligent switch in a local area network, where the intelligent switch has content analysis applications stored therein and is configured to apply one or more content analysis applications on a port-by-port basis. The method includes remotely updating one or more content analysis applications at intelligent switches of subscriber networks.

Claims

1. A method for analyzing data content received at a local area network from an external communications network, wherein the method comprises:

receiving unanalyzed content at a local area network;

passing the unanalyzed content to a switch in the local area network;

analyzing the unanalyzed content at the switch and generating analyzed data; and

routing the analyzed data to a device in the local area network in communication with the switch.

2. The method of claim 1, wherein the step of analyzing the unanalyzed content comprises applying a content filtering algorithm to the unanalyzed content upon ingress at a port at the switch.

3. The method of claim 1, wherein the step of analyzing the unanalyzed content comprises applying a content filtering algorithm to the unanalyzed content upon egress at a port at the switch.

4. The method of claim 1 wherein the unanalyzed content is formatted in data packets.

5. The method of claim 4, wherein analyzing the unanalyzed content at the switch comprises the switch applying a content analysis algorithm to each data packet of unanalyzed content.

6. The method of claim 5, wherein the switch applying a content analysis algorithm comprises the switch executing an anti-virus algorithm.

7. The method of claim 5, wherein the switch applying a content analysis algorithm comprises the switch executing an intrusion detection algorithm.

8. The method of claim 1, wherein the switch comprises a plurality of ports, and wherein the switch applying a content analysis algorithm comprises the switch individually scanning the plurality of ports and applying the content analysis algorithm to each port.

9. The method of claim 8, wherein each of the plurality of ports comprises a dedicated processor and each dedicated processor for a respective port independently applies a separate content analysis algorithm to unanalyzed content at the port, whereby each of the plurality of ports individually analyzes content with its respective processor.

10. The method of claim 1, further comprising receiving a content analysis software update at the switch from a managed service provider network via the external communications network.

11. The method of claim 11, further comprising applying the content analysis software update to each port at the switch configured to implement content analysis software contained in the content analysis software update.

12. A method of managing content analysis for a local area network from a managed server provider network, wherein the local area network comprises a switch in communication with an external communications network and at least one device in communication with the switch, wherein the method comprises:

establishing a communication link between the switch of the local area network and the managed service provider network via the external communications network;

transmitting port configuration instructions from the managed service provider network to the switch of the local area network, the port configuration instructions comprising instructions to configure at least one port at the switch to implement at least one content analysis function.

13. The method of claim 12, further comprising:

receiving a content analysis software update at the managed service;

transmitting the content analysis software update to the switch and updating content analysis software at the switch with the content analysis software update.

14. The method of claim 12, further comprising monitoring content analysis activity at the switch from the managed service provider network.

15. A method of providing content analysis policy to a plurality of networks, the method comprising:

establishing a communication link between a switch in each of a plurality of subscriber networks and an application management appliance of a managed service provider network via an external communications network;

transmitting one of instructions and update information for a content analysis application from the application management appliance at the network switch to the switch in each of the plurality of subscriber networks; and

gathering performance metrics of the content analysis application from each of the plurality of subscriber networks.

16. A local area network switch having content analysis capabilities comprising:

a plurality of ports each configured for communication with a respective external device, each of the plurality of ports comprising;

an interface connection adapted for connecting with a communication line of an external device;

a processor in communication with the interface connection with the interface connection;

a memory in communication with the processor;

an application buffer in communication with the processor and the memory, wherein the application buffer contains logic operative on the processor to analyze a content of information passing between the external device and the port; and

a communication bus in communication with each of the ports, the communication bus adapted to carry information between the plurality of ports, wherein the switch is configured to individually analyze the content of information passing through each port.

17. The apparatus of claim 16 further comprising an application buffer administrative interface in communication with the communication bus, wherein the application buffer administrative interface comprises content analysis resources accessible by the application buffer for each port.

18. The apparatus of claim 16, wherein at least one of the application buffers comprises anti-virus filtering logic.

19. The apparatus of claim 16, wherein at least one of the application buffers comprises network security logic.

20. The apparatus of claim 16, wherein at least one of the application buffers comprises content filtering logic.

21. The apparatus of claim 17, wherein the application buffer administrative interface comprises anti-virus definitions adapted for use by anti-virus logic stored on an application buffer at a port.