Network-Based Security Platform

• US 20080077995A1
• Filed: 09/15/2005
• Published: 03/27/2008
• Est. Priority Date: 09/15/2004
• Status: Abandoned Application

• Current Assignee: BAE Systems Plc
• Original Assignee: BAE Systems Plc
• Inventors: Curnyn, Jon
• Application Number:
  US11/662,673
• Publication Number:
  US 20080077995A1
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A content processing architecture-and-method enabling high throughput, low-latency services to be performed on streamed data. A stream controller (300) receives and stores the streamed data, and also coordinates the performance of functions upon the streamed data by a plurality of stream processors (310). The results of the functions are used by one or more service processors (320) to effect decisions as to whether a subscriber should be allowed access to the streamed content. The service processors instruct the stream controller to act in accordance with the decisions.

Claims

1. :

A network-implemented content processing device for controlling the delivery of streamed content to subscribers, comprising;

a stream controller for receiving and storing streamed content;

a plurality of stream processors coupled to the stream controller, each stream processor being adapted to perform one or more predetermined data processing functions on streamed content, thereby providing process output data comprising action data which directs further action to be taken by the stream controller; and

,

one or more service processors that are responsive to service requests from the stream controller to apply a subscriber service and produce a service output which is coupled to the stream controller to regulate subscriber access to streamed content in dependence on a service policy associated with the subscriber service, wherein the service requests are built at the stream controller in dependence on the process output data.

2. :

A device according to claim 1, wherein each stream processor is adapted to transmit streamed content to a further stream processor in dependence on a pipeline command received from the stream controller, wherein the pipeline command depends on the process output data.

3. :

A device according to claim 1, wherein the stream controller is adapted to control the receipt of streamed content in dependence on the data processing function currently being performed by each stream processor.

4. :

A device according to claim 1, wherein the plurality of stream processors is capable of simultaneously performing a plurality of data processing functions on streamed content.

5. :

A device according to claim 1, wherein each data processing function is either a content processing function or a protocol processing function.

6. :

A device according claim 1, adapted to receive code and information updates effective to update one or more of a data processing function and a service policy, without loss of service.

7. :

A device according to claim 1, wherein service output data associated with one subscriber service is effective to update the service policy associated with one or more further subscriber services.

8. :

A device according to claim 1, wherein the streamed content received by the stream controller comprises a subscriber identifier that identifies the subscriber.

9. :

A device according to claim 8, wherein the service policy depends on the subscriber identifier.

10. :

A device according to claim 1, wherein one or more of the stream processors is adapted to identify a data protocol used by the streamed content.

11. :

A device according to claim 10, further comprising a subscriber policy database for storing a subscriber policy, wherein the stream controller is adapted to transmit streamed content to one or more stream processors in dependence on a combination of;

the subscriber identifier, the data protocol, and the subscriber policy.

12. :

A device according to claim 1, comprising a plurality of different types of stream processor, each type being adapted to perform a different set of one or more data processing functions.

13. :

A device according to claim 1, wherein the subscriber service is chosen from a group including the following;

anti-virus services, anti-spam services, anti-phishing services, and content control services.

14. :

A device according to claim 1, wherein one of the data processing functions is effective to calculate a digest on the streamed content, the digest being subsequently stored with associated information, thereby enabling statistical analysis of the content passing over the network.

15. :

A method of controlling the delivery of streamed content to subscribers, comprising the steps of;

receiving and storing streamed content at a stream controller;

transmitting streamed content from the stream controller to one or more of a plurality of stream processors, each stream processor being adapted to perform a data processing function on streamed content, each data processing function producing, and returning to the stream controller process output data that comprises action data which directs further action to be taken by the stream controller;

building, at the stream controller, one or more service requests in dependence on the process output data;

transmitting, in dependence on the action data, one or more service requests from the stream controller to one or more service processors, each service processor being adapted to apply a subscriber service to a service request, each subscriber service producing, and returning to the stream controller, service output data which depends on a service policy associated with the subscriber service; and

,

regulating, at the stream controller subscriber access to streamed content in dependence on the service output data.

16. :

A method according to claim 15, further comprising the step of transmitting streamed content from one stream processor to a further stream processor in dependence on a pipeline command received from the stream controller, wherein the pipeline command depends on the process output data.

17. :

A method according to claim 15, wherein the streamed content is transmitted by the stream controller to the plurality of stream processors in dependence on the data processing function currently being applied by each stream controller.

18. :

A method according to claim 15, wherein the plurality of stream processors simultaneously perform a plurality of data processing functions on streamed content.

19. :

A method according to claim 15, wherein each data processing function is either a content processing function or a protocol processing function.

20. :

A method according to claim 15, further comprising the step of receiving code and information updates effective to update one or more of a data processing function and a service policy, without loss of service.

21. :

A method according to claim 15, wherein service output data associated with one subscriber service is effective to update the service policy associated with one or more further subscriber services.

22. :

A method according to claim 15, wherein the streamed content received by the stream controller comprises a subscriber identifier that identifies the subscriber.

23. :

A method according to claim 22, wherein the service policy depends on the subscriber identifier.

24. :

A method according to claim 15, wherein a preliminary data processing function to be performed on the streamed content identifies a data protocol used by the streamed content.

25. :

A method according to claim 24, wherein the transmission, after the identification of the data protocol, of streamed content to one or more stream processors is dependent on a combination of;

the subscriber identifier, the data protocol, and a subscriber policy stored in a subscriber policy database.

26. :

A method according to claim 15, wherein the plurality of stream processors comprise a plurality of different types of stream processor, each type being adapted to perform a different set of one or more data processing functions.

27. :

A method according to claim 15, wherein each subscriber service is chosen from a group including the following;

anti-virus services, anti-spam services, anti-phishing services, and content control services.

28. :

A method according to claim 15, wherein one of the data processing functions is effective to calculate a digest on the streamed content, the digest being subsequently stored with associated information, thereby enabling statistical analysis of the content passing over the network.