Reputation Based Connection Throttling

• US 20080175226A1
• Filed: 01/24/2007
• Published: 07/24/2008
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Yang, Weilai, Krasser, Sven, Alperovitch, Dmitri, Schneck, Phyllis Adele, Judge, Paul, Trivedi, Aarjav Jyotindra Neeta
• Granted Patent: US 8,179,798 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT

Abstract

Methods and systems for operation upon one or more data processors for throttling connections based upon reputation of the entity requesting connection.

Claims

1. A reputation based connection throttling system for voice over internet protocol communications, the system comprising:

a communications interface operable to receive voice over internet protocol connection requests associated with an external entity prior to a connection being established between the external entity and a protected network associated with the communications interface;

a reputation engine operable to derive a reputation associated with the external entity; and

a connection control engine operable to deny a voice over internet protocol connection request to a protected network based upon the derived reputation of the external entity associated with the voice over protocol connection request.

2. The system of claim 1, wherein the reputation engine derives the reputation of the external entity based upon an aggregation of reputable criteria and non-reputable criteria associated with the external entity.

3. The system of claim 1, wherein the connection control engine prevents non-reputable entities from creating a connection with the protected network.

4. The system of claim 3, wherein the non-reputable entities are operable to attempt to send voice over internet protocol communications to the protected network in an attempt to create a pre-textual voice over internet protocol connection with the protected network and to exploit the pre-textual voice over internet protocol connection for non-legitimate activities.

5. The system of claim 1, wherein the communications interface is further operable to receive short message service connection requests, and the connection control engine is operable to deny the short message service connection request based upon a reputation associated with a short message service entity originating the short message service connection request.

6. The system of claim 1, further comprising a message interrogation engine operable to examine the contents of communications originating from the external entity to determine whether the external entity is exploiting a voice over internet protocol connection.

7. The system of claim 1, wherein the reputation engine is a reputation server operable to receive a reputation query from the connection control engine and to provide the connection control engine with the derived reputation.

8. The system of claim 7, wherein the reputation server derives the reputation of the external entity by aggregating a plurality of local reputations associated with the external entity, the plurality of local reputations being supplied by a plurality of local reputation engines.

9. The system of claim 1, wherein the connection control engine comprises a policy against which the reputation is compared to determine whether to allow the voice over internet protocol connection request.

10. The system of claim 9, wherein the policy defines one or more categories of external entities to which voice over internet protocol requests are allowed.

11. The system of claim 1, wherein the connection control engine is operable to reduce quality of service for any connections received from non-reputable external entities and to maximize quality of service for any connections received from reputable external entities.

12. The method of claim 1, further comprising receiving a plurality of simultaneous connection requests;

correlating the simultaneous connection requests to determine that the requests comprise an attack; and

, updating a reputation associated with one or more entities associated with the simultaneous connection requests so as to cause throttling of the plurality of connection requests.

13. The method of claim 1, further comprising deriving a reputation associated with the external entity, the reputation indicating a reputation of the external entity for participating in denial of service attacks, wherein a reputation for participating in a denial of service attack triggers the connection control engine to immediately throttle a connection based upon input from a handset or a policy.

14. The method of claim 1, wherein the connection is requested to a device on the protected network, the device comprising a mobile, location aware device.

15. A reputation based connection throttling system for short message service communications, the system comprising:

a communications interface operable to receive short message service connection requests associated with an external entity prior to a connection being established between the external entity and a protected network associated with the communications inter-face;

a reputation engine operable to derive a reputation associated with the external entity; and

a connection control engine operable to deny a short message service connection request to a protected network based upon the derived reputation of the external entity associated with the short message service connection request.

16. The system of claim 15, wherein the reputation engine derives the reputation of the external entity based upon an aggregation of reputable criteria and non-reputable criteria associated with the external entity.

17. The system of claim 16, wherein the connection control engine prevents non-reputable entities from creating a connection with the protected network.

18. The system of claim 17, wherein the non-reputable entities are operable to attempt to send short message service communications to the protected network in an attempt to create a pre-textual short message service connection with the protected network and to exploit the pre-textual short message service connection for non-legitimate activities.

19. The system of claim 15, further comprising a message interrogation engine operable to examine the contents of communications originating from the external entity to determine whether the external entity is exploiting a short message service connection.

20. The system of claim 15, wherein the reputation engine is a reputation server operable to receive a reputation query from the connection control engine and to provide the connection control engine with the derived reputation.

21. The system of claim 20, wherein the reputation server derives the reputation of the external entity by aggregating a plurality of local reputations associated with the external entity, the plurality of local reputations being supplied by a plurality of local reputation engines.

22. The system of claim 15, wherein the connection control engine comprises a policy against which the reputation is compared to determine whether to allow the voice over internet protocol connection request.

23. The system of claim 22, wherein the policy defines one or more categories of external entities to which voice over internet protocol requests are allowed.

24. A method for reputation based connection throttling, comprising the steps of:

receiving a voice over internet protocol connection request, the voice over internet protocol connection request being related to an external entity;

querying a reputation engine for a reputation associated with the external entity;

comparing the reputation to a policy associated with a protected enterprise network;

permitting the connection request based upon determining that the reputation of the external entity related to the voice over internet protocol connection request complies with the policy;

throttling the connection request based upon determining that the reputation of the external entity related to the voice over internet protocol connection request does not comply with the policy.

25. A method for reputation based connection throttling, comprising the steps of:

receiving a connection request, the connection request requesting a connection between an external entity and a protected enterprise network;

querying a reputation engine for a reputation associated with the external entity, the reputation comprising an aggregation of the reputable and non-reputable criteria associated with the external entity;

comparing the reputation to a policy associated with the protected enterprise network;

permitting the connection request based upon determining that the reputation of the external entity related to the voice over internet protocol connection request complies with the policy;

throttling the connection request based upon determining that the reputation of the external entity related to the voice over internet protocol connection request does not comply with the policy.

26. A reputation based firewall, comprising:

a firewall operable to receive a data packet directed to a protected network and to determine handling of the data packet based upon a security policy associated with the protected network, the security policy comprising at least one rule based upon a reputation of an external entity associated with the data packet;

a reputation engine operable to determine the external entity associated with the data packet and to provide the reputation to the firewall based upon determination of the external entity; and

wherein handling comprises permitting the data packet entry to the protected network, or denying the data packet entry to the protected network.