System and method for providing a multi-tiered hierarchical transient message store accessed using multiply hashed unique filenames

• US 6,745,192 B1
• Filed: 12/10/2001
• Issued: 06/01/2004
• Est. Priority Date: 08/03/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Libenzi, Davide
• Primary Examiner(s): Amsbury, Wayne
• Assistant Examiner(s): Nguyen, Cindy
• Application Number:
  US10/016,501
• Time in Patent Office: 904 Days
• Field of Search: 707/1, 707/3, 707/100, 709/206
• US Class Current: 1/1
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

A system and method for providing a multi-tiered hierarchical transient message store accessed using multiply hashed unique filenames is described. A hierarchical message store is maintained. The hierarchical message store is logically structured with a plurality of storage nodes. Each storage node is dependently linked to one of a plurality of index nodes. Each index node is dependently linked to a root node. An incoming message is intercepted at a network domain boundary and assigning a unique filename. An index hash of the unique filename, corresponding to one such index node, and a storage hash of the unique filename, corresponding to one such storage node, are generated. The message is stored in the hierarchical message store at the one such index node and the one such storage node.

Claims

1. A system for storing transient message packets in a hierarchical message store for use in a distributed computing environment, comprising:

a unique filename module generating a unique filename identifying an incoming message packet intercepted entering a bounded network domain;

a checksum module calculating an index checksum from the unique filename using a seed value associated with an index level in a hierarchical message store and calculating a storage checksum from the unique filename using a seed value associated with a storage level in the hierarchical message store; and

a message receiver storing the incoming message packet in an index node in the index level and a storage node in the storage level and dependent on the index node, each respectively indexed by the index checksum and the storage checksum, wherein the index checksum is calculated according to the equation;

2. A system according to claim 1, further comprising:

a table mapping each unique filename to the index checksum and the storage checksum respectively calculated therefrom.

3. A system according to claim 2, further comprising:

a retrieval module obtaining the index checksum and the storage checksum for the incoming message packet from the table, and retrieving the incoming message packet from the hierarchical message store using the index checksum and the storage checksum to respectively locate the index node and the storage node.

4. A system according to claim 1, wherein the storage checksum is calculated according to the equation:

5. A system according to claim 1, wherein a number of at least one of the index nodes in the index level and the storage nodes in the storage level is set to a prime number.

6. A system according to claim 1, wherein the unique filename comprises at least one of a time stamp, process identifier, and hostname.

7. A system according to claim 1, wherein the distributed computing environment is TCP/IP-compliant and each such message packet is SMTP-compliant.

10. A method according to claim 1, further comprising:

maintaining a table mapping each unique filename to the index checksum and the storage checksum respectively calculated therefrom.

11. A method according to claim 10, further comprising:

calculating the storage checksum according to the equation;

12. A method according to claim 10, further comprising:

setting a number of at least one of the index nodes in the index level and the storage nodes in the storage level to a prime number.

13. A method according to claim 10, further comprising:

creating the unique filename comprising at least one of a time stamp, process identifier, and hostname.

14. A method according to claim 10,

wherein the distributed computing environment is TCP/IP-compliant and each such message packet is SMTP-compliant.

15. A computer-readable storage medium holding code for performing the method according to claim 8, 9, 10, 11, 12, 13, or 14.

8. A method for storing transient message packets in a hierarchical message store for use in a distributed computing environment, comprising:

generating a unique filename identifying an incoming message packet intercepted entering a bounded network domain;

calculating an index checksum from the unique filename using a seed value associated with an index level in a hierarchical message store;

calculating a storage checksum from the unique filename using a seed value associated with a storage level in the hierarchical message store;

storing the incoming message packet in an index node in the index level and a storage node in the storage level and dependent on the index node, each respectively indexed by the index checksum and the storage checksum; and

calculating the index checksum according to the equation;

9. A method according to claim 8, further comprising:

obtaining the index checksum and the storage checksum for the incoming message packet from the table; and

retrieving the incoming message packet from the hierarchical message store using the index checksum and the storage checksum to respectively locate the index node and the storage node.