Prioritizing Network Traffic

• US 20090254663A1
• Filed: 04/02/2009
• Published: 10/08/2009
• Est. Priority Date: 04/04/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Torrez, Jonathan, Krasser, Sven, Alperovitch, Dmitri, Schneck, Phyllis Adele, Greve, Paula
• Granted Patent: US 8,589,503 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/125 based on throughput or bandwidth
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements

Abstract

Methods and systems for operation upon one or more data processors for prioritizing transmission of communications associated with an entity based upon reputation information associated with the entity.

Claims

1. A computer implemented network traffic prioritization method comprising:

receiving communications, the communications comprising data being communicated from a sending device to a destination device through a network;

parsing the communications based upon one or more transmission protocol associated with the communications, the parsing being operable to identify one or more originating entities and one or more destination entities;

identifying a reputation associated with the one or more originating entities and the one or more destination entities;

applying a prioritization policy to the communications, the prioritization policy being operable to prioritize transmissions based upon the reputation associated with the one or more originating entities and the reputation associated with the one or more destination entities; and

transmitting the communications based upon the applied prioritization policy.

2. The computer-implemented method of claim 1, wherein identifying a reputation associated with the one or more originating entities and the one or more destination entities comprises:

querying a reputation system for a reputation associated with the one or more originating entities; and

querying a reputation system for a reputation associated with the one or more destination entities.

3. The computer-implemented method of claim 1, wherein identifying a reputation associated with the one or more originating entities and the one or more destination entities comprises:

retrieving reputation for the one or more originating entities from a local reputation store; and

retrieving reputation for the one or more destination entities from the local reputation store.

4. The computer-implemented method of claim 3, wherein if the retrieval of the one or more originating entities from the local data store is unsuccessful, the method further comprises querying a reputation system for a reputation of the one or more originating entities;

and, wherein if the retrieval of the one or more destination entities from the local data store is unsuccessful, the method further comprises querying a reputation system for a reputation of the one or more destination entities.

5. The computer-implemented method of claim 1, wherein applying the prioritization policy comprises prioritizing communications associated with entities having a specified reputation.

6. The computer-implemented method of claim 1, wherein the prioritization policy is operable to prioritize communications associated with reputable entities over communications associated with non-reputable entities.

7. The computer-implemented method of claim 6, wherein the non-reputable reputations comprise spamming entities, phishing entities, spyware entities or malware entities.

8. The computer-implemented method of claim 1, further comprising:

determining whether the network is in a bandwidth limited situation; and

wherein identifying the reputation associated with the entity and applying a prioritization policy to the communications is based upon a determination that the network is in a bandwidth limited situation.

9. A computer-implemented method, comprising:

managing a plurality of existing network connections, the plurality of connections being associated with assigned priorities;

receiving a new connection request;

determining that the new connection request cannot be processed because of a bandwidth limitation based on the plurality of existing network connections;

identifying reputations for entities associated with the new connection request;

identifying a new connection priority for the new connection request based upon application of a prioritization policy to the identified reputations;

identifying an existing connection having a lowest assigned priority;

if the lowest assigned priority is lower than the new connection priority, dropping the existing connection having the lowest assigned priority; and

if a connection is dropped, connecting the new connection request.

10. The computer-implemented method of claim 9, wherein identifying reputations for entities associated with the new connection request comprises parsing the connection request to identify entities associated with the new connection request, the entities comprising one or more originating entities and one or more destination entities associated with the new connection request.

11. The computer-implemented method of claim 10, wherein identifying reputation for the entities associated with the new connection request further comprises retrieving reputation information associated with the one or more originating entities and the one or more destination entities from a local reputation store.

12. The computer-implemented method of claim 11, wherein identifying reputation information for the entities associated with the new connection request further comprises querying a reputation system for reputation information if retrieval of reputation information from the local reputation store fails.

13. The computer-implemented method of claim 9, wherein the lowest assigned reputation is one or more of a spamming reputation, a malware reputation, a spyware reputation, or a phishing reputation.

14. The computer-implemented method of claim 9, wherein connections associated with entities identified as non-reputable are disconnected in favor of new connections associated with entities identified as reputable.

15. A system, comprising:

a route processing module operable to receive communications from an originating entity and to route communications to a destination entity based on a prioritization associated with the communications;

a reputation retrieval module operable to retrieve reputation information associated with the originating entity and the destination entity; and

a prioritization module operable to receive a prioritization policy from an administrator and identify the prioritization of the communications based upon the prioritization policy, the prioritization policy specifying policy based upon identifying a bandwidth limited network situation and based upon the retrieved reputation associated with the originating entity or the destination entity.

16. The system of claim 15, wherein the reputation retrieval module comprises a local reputation data store, and the reputation retrieval module is operable to retrieve reputation information associated with the originating entity and the destination entity from the local reputation data store.

17. The system of claim 16, wherein the reputation retrieval module is operable to determine that reputation information associated with the originating entity or the destination entity is not included in the local reputation store, the reputation retrieval module being operable to retrieve reputation information not included in the local reputation store from an external reputation system.

18. The system of claim 15, wherein the reputation retrieval module is operable to send a query to a reputation system for retrieval of reputation information from a reputation data store.

19. The system of claim 15, wherein the route processing module is operable to manage a plurality of existing network connections and to receive a new connection request, and the prioritization module is operable to determine whether the new connection request is associated with a high priority communication based upon reputation information associated with the new connection request, the prioritization module being operable to instruct the route processing module to drop any low priority connections from among the existing network connections and to connect the new connection request.

20. The system of claim 19, wherein the low priority connections comprise those connections associated with an entity having a reputation for spamming, phishing, spyware or malware.

21. A system, comprising:

a routing module operable to manage an existing low priority connection associated with a non-reputable entity and to receive a new connection request from an originating entity directed to a destination entity, the routing module being operable to determine that the new connection request cannot be handled based on a bandwidth limitation of the system;

a reputation retrieval module operable to retrieve reputation information associated with the originating entity and the destination entity in response to the routing module determining that the new connection request cannot be routed; and

a connection control module operable to identify whether the new connection request is high priority based upon the retrieved reputation information and application of a prioritization policy, the connection control module being operable to instruct the routing module to drop the existing low priority connection request and to connect the new connection request based upon identifying that the new connection request is high priority.