Virus immunization using prioritized routing

• US 20070256128A1
• Filed: 06/22/2006
• Published: 11/01/2007
• Est. Priority Date: 04/27/2006
• Status: Active Grant

• Current Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Original Assignee: Searete LLC (Intellectual Ventures LLC)
• Inventors: Lord, Robert W., Jung, Edward K.Y., Levien, Royce A., Malamud, Mark A., Rinaldo, John D., Wood, Lowell L.
• Granted Patent: US 8,191,145 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An apparatus, device, methods, computer program product, and system are described that determine a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, associate an anti-viral agent with at least one identifier, prioritize transmission of the at least one identifier through the at least one network policy device, relative to the communication data, and provide the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device.

Claims

1. A method comprising:

determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device;

associating an anti-viral agent with at least one identifier;

prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data; and

providing the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device.

10. The method of claim 1, wherein determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, comprises:

determining the virus associated with the communication data on the communications network, the communications network associated with restricted access thereto.

17. The method of claim 1, wherein determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, comprises:

determining the virus associated with the communication data on the communications network, the communications network associated with the at least one network policy device that is associated with a plurality of network policy devices that are configured to provide at least two classes of network traffic management.

20. The method of claim 1, wherein associating an anti-viral agent with at least one identifier comprises:

determining the anti-viral agent as being configured to prevent and/or inhibit the virus on the communications network; and

associating the anti-viral agent with the at least one identifier.

23. The method of claim 1, wherein associating an anti-viral agent with at least one identifier comprises:

labeling a header of a data packet with the at least one identifier, the data packet including at least a portion of the anti-viral agent as payload of the data packet.

24. The method of claim 1, wherein associating an anti-viral agent with at least one identifier comprises:

associating the anti-viral agent with the at least one identifier, wherein the at least one identifier includes a transmission priority.

25. The method of claim 1, wherein associating an anti-viral agent with at least one identifier comprises:

associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission classification in accordance with a transmission classification scheme of the network policy device.

26. The method of claim 1, wherein associating an anti-viral agent with at least one identifier comprises:

associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission channel of the network policy device.

28. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

determining a transmission priority associated with the at least one identifier.

29. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

determining a forwarding decision of a data packet containing the at least one identifier, based on content of the at least one identifier.

30. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

making a determination of a transmission priority of a data packet containing the at least one identifier, relative to a transmission priority of the communication data; and

prioritizing the transmission of the data packet relative to the communication data, based on the determination.

31. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

replacing the at least one identifier with a replacement identifier.

32. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

associating at least a second identifier with the at least one identifier.

33. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased transmission speed of the at least one identifier, relative to the communication data.

34. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased quality of service associated with at least one data packet containing the at least one identifier, relative to the communication data.

35. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased transmission security of the at least one identifier, relative to the communication data.

36. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased available bandwidth for transmission of the at least one identifier, relative to available bandwidth for transmission of the communication data.

37. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an end-to-end circuit through the network policy device for at least one data packet associated with the at least one identifier, the end-to-end circuit being associated with a specified transmission characteristic.

38. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing prioritized transmission of a class of identifiers, the at least one identifier being associated with the class.

39. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

making a determination that the at least one identifier is associated with an entity; and

prioritizing the transmission of the at least one identifier, based on the determination.

40. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

prioritizing queuing of the at least one identifier within the at least one network policy device, relative to queuing of the communication data.

41. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing the transmission of the at least one identifier, the at least one identifier including at least one label associated with the Multi-Label Switching Protocol (MPLS).

43. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

receiving an indication, from a first entity, of a specified quality of service (QoS) associated with the at least one identifier, at a second entity.

44. The method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

prioritizing the transmission, based on a service level agreement between a first entity and a second entity.

45. The method of claim 1, wherein providing the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device, comprises:

providing the anti-viral agent to at least one network device of the communications network.

2. (canceled)

3. (canceled)

4. (canceled)

5. (canceled)

6. (canceled)

7. (canceled)

8. (canceled)

9. (canceled)

11. (canceled)

12. (canceled)

13. (canceled)

14. (canceled)

15. (canceled)

16. (canceled)

18. (canceled)

19. (canceled)

21. (canceled)

22. (canceled)

27. (canceled)

42. (canceled)

46. (canceled)

47. (canceled)

48. (canceled)

49. (canceled)

50. (canceled)

51. (canceled)

52. (canceled)

53. (canceled)

54. (canceled)

55. (canceled)

56. (canceled)

57. (canceled)

58. (canceled)

59. (canceled)

60. (canceled)

61. (canceled)

62. (canceled)

63. (canceled)

64. (canceled)

65. (canceled)

66. (canceled)

67. (canceled)

68. (canceled)

69. (canceled)

70. (canceled)

71. (canceled)

72. (canceled)

73. (canceled)

74. (canceled)

75. (canceled)

76. (canceled)

77. (canceled)

78. (canceled)

79. (canceled)

80. (canceled)

81. (canceled)

82. (canceled)

83. (canceled)

84. (canceled)

85. (canceled)

86. (canceled)

87. (canceled)

88. (canceled)

89. (canceled)

90. (canceled)

91. (canceled)

92. (canceled)

93. (canceled)

94. (canceled)

95. (canceled)

96. (canceled)

97. (canceled)

98. (canceled)

99. (canceled)

100. (canceled)

101. A device comprising:

a multi-network virus immunization system, the multi-network virus immunization system comprising;

(a) a network monitor operable to determine a virus associated with communication data on a communications network, the communications network associated with at least one network policy device;

(b) identifier logic operable to associate an anti-viral agent with at least one identifier; and

(d) routing logic operable to prioritize transmission of the at least one identifier through the at least one network policy device, relative to the communication data, and further operable to provide the anti-viral agent on the communications network.

104. The device of claim 101 wherein the identifier logic is operable to select the at least one identifier based on one or more of identifier data, the anti-viral agent, and/or a service level agreement associated with an entity.

105. The device of claim 101 wherein the routing logic is operable to perform priority queue scheduling of the at least one identifier.

102. (canceled)

103. (canceled)

106. (canceled)

107. (canceled)

108. (canceled)

109. (canceled)

110. (canceled)

111. (canceled)

112. (canceled)

113. (canceled)

114. (canceled)

115. (canceled)

116. (canceled)

117. (canceled)

118. (canceled)

119. (canceled)

120. (canceled)

121. (canceled)

122. (canceled)

123. (canceled)

124. (canceled)

125. (canceled)

126. (canceled)

127. (canceled)

128. (canceled)

129. (canceled)

130. (canceled)

131. (canceled)

132. (canceled)

133. (canceled)

134. (canceled)

135. (canceled)

136. (canceled)

137. (canceled)

138. (canceled)

139. (canceled)

140. (canceled)

141. (canceled)

142. (canceled)

143. (canceled)

144. (canceled)

145. (canceled)

146. (canceled)

147. (canceled)

148. (canceled)

149. (canceled)

150. A system comprising:

means for determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device;

means for associating an anti-viral agent with at least one identifier;

means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data; and

means for providing the anti-viral agent on the communications network, said means for providing responsive to the means for prioritizing transmission of the at least one identifier through the at least one network policy device.

151. The system of claim 150, wherein means for associating an anti-viral agent with at least one identifier comprises:

means for labeling a header of a data packet with the at least one identifier, the data packet including at least a portion of the anti-viral agent as payload of the data packet.

152. The system of claim 150, wherein means for associating an anti-viral agent with at least one identifier comprises:

means for associating the anti-viral agent with the at least one identifier, wherein the at least one identifier includes a transmission priority.

153. The system of claim 150, wherein means for associating an anti-viral agent with at least one identifier comprises:

means for associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission classification in accordance with a transmission classification scheme of the network policy device.

154. The system of claim 150, wherein means for associating an anti-viral agent with at least one identifier comprises:

means for associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission channel of the network policy device.

155. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for determining a transmission priority associated with the at least one identifier.

156. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for making a determination of a transmission priority of a data packet containing the at least one identifier, relative to a transmission priority of the communication data; and

means for prioritizing the transmission of the data packet relative to the communication data, based on the determination.

157. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for providing an increased transmission speed of the at least one identifier, relative to the communication data.

158. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for providing an increased quality of service associated with at least one data packet containing the at least one identifier, relative to the communication data.

159. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for providing an increased transmission security of the at least one identifier, relative to the communication data.

160. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for providing an increased available bandwidth for transmission of the at least one identifier, relative to available bandwidth for transmission of the communication data.

161. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for making a determination that the at least one identifier is associated with an entity; and

means for prioritizing the transmission of the at least one identifier, based on the determination.

162. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for prioritizing queuing of the at least one identifier within the at least one network policy device, relative to queuing of the communication data.

163. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for providing the transmission of the at least one identifier, the at least one identifier including at least one label associated with the Multi-Label Switching Protocol (MPLS).

164. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for receiving an indication, from a first entity, of a specified quality of service (QoS) associated with the at least one identifier, at a second entity.

165. The system of claim 150, wherein means for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

means for prioritizing the transmission, based on a service level agreement between a first entity and a second entity.

166. The system of claim 150, wherein means for providing the anti-viral agent on the communications network comprises:

providing the anti-viral agent to at least one network device of the communications network.

167. A system comprising:

circuitry for determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device;

circuitry for associating an anti-viral agent with at least one identifier;

circuitry for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data; and

circuitry for providing the anti-viral agent on the communications network, said circuitry for providing responsive to the circuitry for prioritizing transmission of the at least one identifier through the at least one network policy device.