Systems And Methods For Adaptive Message Interrogation Through Multiple Queues

• US 20060248156A1
• Filed: 07/11/2006
• Published: 11/02/2006
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Ciphertrust, Incorporated (McAfee, LLC)
• Inventors: Rajan, Guru, Judge, Paul
• Granted Patent: US 7,519,994 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention is directed to systems and methods for enhancing electronic communication security. An electronic communication is received and stored. A plurality of risk assessments are made with respect to the received communication thereby generating a risk profile associated with the communication. The assessments are made in a sequential manner by assigning the stored communication and index and serially placing the index on queue associated with interrogation engines that perform the various assessments. The index is initially placed in a queue associated with an interrogation engine performing the first type of assessment on the communication. The index is placed in a subsequent queue only after the interrogation engine associated with the prior queue in which the index was placed has assessed the communication. This is repeated until all desired assessments have been performed. Each assessment may result in the output of an assessment indicator that indicates the results of the particular assessment.

Claims

1-73. -73. (canceled)

74. A method for secure delivery of electronic communications comprising the steps of:

receiving an electronic communication from a communication source for delivery to a predetermined recipient;

interrogating the communication to determine one or more characteristics associated with the message;

based upon interrogation of the communication, determining whether the communication is to be secured;

where the determination is made that the communication should be secured, selecting one of a plurality of secure delivery mechanisms; and

attempting to deliver the electronic communication to the predetermined recipient via the selected secure deliver mechanism.

75. The method of claim 74, wherein the plurality of secure delivery mechanism comprises:

a base communication mechanism selected from the group consisting of instant messaging, SMTP, HTTP, VoIP, SMS, MMS and FTP; and

at least one security option, wherein the selection of the secure delivery mechanism is based upon the at least one security option associated with each secure delivery mechanism.

76. The method of claim 74, further comprising the steps of:

providing an recipient with an interface for designating a prioritization of the plurality of secure delivery mechanism based upon an order of interrogation; and

receiving the prioritization from the provided interface.

77. The method of claim 74, further comprising the steps of:

providing an administrator with an interface for designating a prioritization of the plurality of secure delivery mechanisms based upon an order of interrogation; and

receiving the prioritization from the provided interface.

78. The method of claim 74, further comprising the steps of:

if delivery fails, performing failure processing, the failure processing comprising;

1) selecting a further secure delivery mechanism from among the plurality of secure delivery mechanisms based upon the prioritization of the plurality of secure delivery mechanisms; and

2) attempting to deliver the electronic communication to the predetermined recipient via the further secure delivery mechanism.

79. The method of claim 78, wherein if the received communication is determined to require secure delivery, further comprising the step of repeating of performing failure processing until the received communication is successfully delivered or until exhaustion of all available secure delivery mechanisms in the plurality.

80. The method of claim 74, wherein each of the plurality of secure delivery mechanisms comprises a base mechanism and at least one security option and wherein each base mechanism is selected from the group consisting of instant messaging, SMTP, HTTP, VoIP, SMS, MMS and FTP.

81. The method of claim 80, wherein the plurality of secure delivery mechanisms employ a message level encryption technique.

82. The method of claim 81, wherein the plurality of secure delivery mechanisms employ a channel level encryption technique.

83. The method of claim 82, wherein each of the plurality of secure delivery mechanisms further employs a message level encryption technique.

84. The method of claim 74, wherein if the received communication is determined to require secure delivery, further comprising the steps of:

providing the communication source with an interface for designating a prioritization of the plurality of delivery mechanisms; and

receiving the prioritization from the provided interface.

85. The method of claim 74, wherein determining whether the received communication is to be secured comprises the steps of:

parsing the received communication for indicia indicating a desire for secure delivery; and

specifying the received communication as requiring secure delivery based upon the parsing.

86. The method of claim 85, wherein the step of specifying the received communication as requiring secure delivery based upon the parsing comprises specifying the received communication as requiring secure delivery if one or more predetermined keywords are parsed from the received communication.

87. The method of claim 86, wherein the parsing step is performed only on a header portion within the received communication and wherein the step of specifying the received communication as requiring secure delivery based upon the parsing comprising specifying the received communication as requiring secure delivery of one or more predetermined keywords are parsed from the header.

88. The method of claim 85, wherein the step of parsing the received communication for indicia indicating secure delivery comprises the step of applying one or more filtering rules to the received communication.

89. The method of claim 88, wherein each of the one or more filtering rules is a content filtering rule, an attachment filtering rule, a source filtering rule or a recipient filtering rule.

90. The method of claim 88, wherein determining whether the received communication requires secure delivery comprises the step of specifying the received communication as requiring secure delivery based upon a configuration specified by an administrator.

91. The method of claim 74, further comprising the step of:

redirecting the electronic communication to a selected encryption engine associated with the selected secure delivery mechanism prior to delivery of the electronic communication, wherein the step of redirecting is based upon determining that the electronic communication is to be encrypted.

92. The method of claim 91, further comprising the steps of:

receiving the encrypted communication from the selected encryption engine; and

forwarding the encrypted communication to a recipient of the communication.

93. The method of claim 91, wherein the encryption engine is configured to forward an encrypted communication to a recipient associated with the communication.

94. The method of claim 93, wherein the encryption engine is located remotely from an interrogation engine configured to perform the interrogating step.

95. Computer readable media including instructions that upon execution by a system processor comprising one or more processing elements cause the one or more processing elements to securely deliver electronic messages by performing steps comprising of:

a) receiving an electronic communication from a communication source for delivery to a predetermined recipient;

b) determining whether the received communication requires secure delivery based upon the received communication, the predetermined recipient, the communication source, default configuration data or combinations thereof; and

c) if the received communication is determined to require secure delivery,

i) determining a plurality of delivery mechanisms based upon the communication source, the predetermined recipient, a default configuration or combinations thereof, wherein each of the plurality of delivery mechanisms comprises a base mechanism and at least one security option and wherein each base mechanism is selected from the group consisting of instant messaging, SMTP, HTTP, FTP, and SMTP notification with HTTP presentment and wherein each security options is a channel level encryption, a message level encryption or a combination thereof;

ii) selecting a delivery mechanism from among the plurality of delivery mechanisms based upon a prioritization;

iii) attempting to deliver the electronic communication to the predetermined recipient via the selected delivery mechanism.