Apparatus and method for acceleration of security applications through pre-filtering

• US 20060174343A1
• Filed: 11/30/2005
• Published: 08/03/2006
• Est. Priority Date: 11/30/2004
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Sensory Networks, Inc. (Intel Corporation)
• Inventors: Williams, Darren, Gould, Stephen, Tan, Teewoon, Duthie, Peter, Barrie, Robert Matthew, Bisroev, Peter
• Application Number:
  US11/291,524
• Publication Number:
  US 20060174343A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A first security processing stage performs a first multitude of tasks and a second security processing stage performs a second multitude of tasks. The first and second multitude of tasks may include common tasks. The first security processing stage is a prefilter to the second security processing stage. The input data received as a data stream is first processed by the first security processing stage, which in response, generates one or more first processed data streams. The first processed data streams may be further processed by the second security processing stage or may bypass the second security processing stage. The first security processing stage operates at a speed greater than the speed of the second security processing stage.

Claims

1. A method for processing information, the method comprising:

receiving a data stream in a first format;

processing the received data stream via a first security processing stage configured to perform a first plurality of tasks at a first processing speed to generate one or more first processed data streams in a second format;

processing the one or more first processed data streams via a second security processing stage configured to perform a second plurality of tasks at a second processing speed to generate one or more second processed data streams in a third format;

said first and second plurality of tasks to include one or more common tasks; and

said first processing speed being greater than said second processing speed.

2. The method of claim 1 wherein said one or more first processed data streams is a first output data stream.

3. The method of claim 1 wherein said one or more second processed data streams is a second output data stream.

4. The method of claim 1 wherein each of said first and second security processing stages is an anti virus processing stage.

5. The method of claim 1 wherein each of said first and second security processing stages is an intrusion detection processing stage.

6. The method of claim 1 wherein each of said first and second security processing stages is an anti spam processing stage.

7. The method of claim 1 wherein each of said first and second security processing stages is an anti spyware processing stage.

8. The method of claim 1 wherein each of said first and second security processing stages is a content processing stage.

9. The method of claim 1 wherein at least one of the first plurality of tasks is performed concurrently with at least one of the second plurality of tasks.

10. The method of claim 1 wherein said first processing stage is further configured to include one or more hardware modules adapted to execute instructions to generate the one or more first processed data streams.

11. The method of claim 1 wherein the one or more first processed data streams are associated with one or more classes of network data each having a different format and each being different from the first format.

12. The method of claim 1 wherein the one or more first processed data streams are associated with one or more classes of network data each having a format different from the first format.

13. The method of claim 1 wherein each of the one or more first processed data streams is directed to a different destination.

14. The method of claim 1 wherein the one or more second processed data streams are associated with one or more classes of network data each having a different format and each being different from the first format.

15. The method of claim 1 wherein the one or more second processed data streams are associated with one or more classes of network data each having a format different from the first format.

16. The method of claim 1 wherein each of the one or more second processed data streams is directed to a different destination.

28. The processing system of claim 1 wherein said first processing stage is further configured to include one or more hardware modules adapted to execute instructions to generate the one or more first processed data streams.

17. A processing system comprising:

a first security processing stage configured to perform a first plurality of tasks on a data stream having a first format and at a first processing speed to generate one or more first processed data streams in a second format;

a second security processing stage configured to perform a second plurality of tasks on the one or more first processed data streams at a second processing speed to generate one or more second processed data streams in a third format;

said first and second plurality of tasks to include one or more overlapping tasks; and

said first processing speed being greater than said second processing speed.

18. The processing system of claim 17 wherein said one or more first processed data streams is a first output data stream.

19. The processing system of claim 17 wherein said one or more second processed data streams is a second output data stream.

20. The processing system of claim 17 wherein each of said first and second security processing stages is an anti virus processing stage.

21. The processing system of claim 17 wherein each of said first and second security processing stages is an intrusion detection processing stage.

22. The processing system of claim 17 wherein each of said first and second security processing stages is an anti spam processing stage.

23. The processing system of claim 17 wherein each of said first and second security processing stages is an anti spyware processing stage.

24. The processing system of claim 17 wherein each of said first and second security processing stages is a content processing stage.

25. The processing system of claim 17 wherein said second format is different from said third format.

26. The processing system of claim 17 wherein said first format is different from said second format.

27. The processing system of claim 17 wherein said second format is different from said third format.

29. The processing system of claim 17 wherein the one or more first processed data streams are associated with one or more classes of network data.

30. The processing system of claim 17 wherein each of the one or more first processed data streams is directed to a different destination.

31. The processing system of claim 17 wherein the one or more second processed data streams are associated with one or more classes of network data.

32. The processing system of claim 17 wherein each of the one or more second processed data streams is directed to a different destination.