Systems and methods for adaptive message interrogation through multiple queues

• US 7,519,994 B2
• Filed: 07/11/2006
• Issued: 04/14/2009
• Est. Priority Date: 03/08/2002
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Judge, Paul, Rajan, Guru
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/456,803
• Publication Number:
  US 20060248156A1
• Time in Patent Office: 1,008 Days
• Field of Search: 726 22- 26, 709/200, 709223-225, 709/229, 713150-153
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention is directed to systems and methods for enhancing electronic communication security. An electronic communication is received and stored. A plurality of risk assessments are made with respect to the received communication thereby generating a risk profile associated with the communication. The assessments are made in a sequential manner by assigning the stored communication and index and serially placing the index on queue associated with interrogation engines that perform the various assessments. The index is initially placed in a queue associated with an interrogation engine performing the first type of assessment on the communication. The index is placed in a subsequent queue only after the interrogation engine associated with the prior queue in which the index was placed has assessed the communication. This is repeated until all desired assessments have been performed. Each assessment may result in the output of an assessment indicator that indicates the results of the particular assessment.

Claims

1. A method for secure delivery of electronic communications comprising the steps of:

receiving an electronic communication from a communication source for delivery to a predetermined recipient;

interrogating the communication to determine one or more characteristics associated with the message;

based upon interrogation of the communication, determining whether the communication is to be secured;

where the determination is made that the communication should be secured, selecting one of a plurality of secure delivery mechanisms; and

attempting to deliver the electronic communication to the predetermined recipient via the selected secure delivery mechanism;

wherein determining whether the received communication is to be secured comprises the steps of;

parsing the received communication for indicia indicating a desire for secure delivery; and

specifying the received communication as requiring secure delivery based upon the parsing if one or more predetermined keywords are parsed from the received communication.

2. The method of claim 1, wherein the plurality of secure delivery mechanisms comprises:

a base communication mechanism selected from the group consisting of instant messaging, SMTP, HTTP, VoIP, SMS, MMS and FTP; and

at least one security option, wherein the selection of the secure delivery mechanism is based upon the at least one security option associated with each secure delivery mechanism.

3. The method of claim 1, further comprising the steps of:

providing an recipient with an interface for designating a prioritization of the plurality of secure delivery mechanisms based upon an order of interrogation; and

receiving the prioritization from the provided interface.

4. The method of claim 1, further comprising the steps of:

providing an administrator with an interface for designating a prioritization of the plurality of secure delivery mechanisms based upon an order of interrogation; and

receiving the prioritization from the provided interface.

5. The method of claim 1, further comprising the step of:

if delivery fails, performing failure processing, the failure processing comprising;

1) selecting a further secure delivery mechanism from among the plurality of secure delivery mechanisms based upon the prioritization of the plurality of secure delivery mechanisms; and

2) attempting to deliver the electronic communication to the predetermined recipient via the further secure delivery mechanism.

6. The method of claim 5, wherein if the received communication is determined to require secure delivery, further comprising the step of repeating step of performing failure processing until the received communication is successfully delivered or until exhaustion of all available secure delivery mechanisms in the plurality.

7. The method of claim 1, wherein each of the plurality of secure delivery mechanisms comprises a base mechanism and at least one security option and wherein each base mechanism is selected from the group consisting of instant messaging, SMTP, HTTP, VoIP, SMS, MMS and FTP.

8. The method of claim 7, wherein the plurality of secure delivery mechanisms employ a message level encryption technique.

9. The method of claim 8, wherein the plurality of secure delivery mechanisms employ a channel level encryption technique.

10. The method of claim 9, wherein each of the plurality of secure delivery mechanisms further employs a message level encryption technique.

11. The method of claim 1, wherein if the received communication is determined to require secure delivery, further comprising the steps of:

providing the communication source with an interface for designating a prioritization of the plurality of delivery mechanisms; and

receiving the prioritization from the provided interface.

12. The method of claim 1, wherein the parsing step is performed only on a header portion within the received communication and wherein the step of specifying the received communication as requiring secure delivery based upon the parsing comprises specifying the received communication as requiring secure delivery if one or more predetermined keywords are parsed from the header.

13. The method of claim 1, wherein the step of parsing the received communication for indicia indicating secure delivery comprises the step of applying one or more filtering rules to the received communication.

14. The method of claim 13, wherein each of the one or more filtering rules is a content filtering rule, an attachment filtering rule, a source filtering rule or a recipient filtering rule.

15. The method of claim 13, wherein determining whether the received communication requires secure delivery comprises the step of specifying the received communication as requiring secure delivery based upon a configuration specified by an administrator.

16. The method of claim 1, further comprising the step of:

redirecting the electronic communication to a selected encryption engine associated with the selected secure delivery mechanism prior to delivery of the electronic communication, wherein the step of redirecting is based upon determining that the electronic communication is to be encrypted.

17. The method of claim 16, further comprising the steps of:

receiving the encrypted communication from the selected encryption engine; and

forwarding the encrypted communication to a recipient of the communication.

18. The method of claim 16, wherein the encryption engine is configured to forward an encrypted communication to a recipient associated with the communication.

19. The method of claim 18, wherein the encryption engine is located remotely from an interrogation engine configured to perform the interrogating step.

20. Software stored in one or more computer readable media and comprising instructions executable by a processing system for secure delivery of messages, upon such execution causing the processing system to perform operations comprising:

receiving an electronic communication from a communication source for delivery to a predetermined recipient;

interrogating the communication to identify one or more characteristics associated with content included in the communication, wherein interrogating the communication includes parsing the communication to identify the content;

determining whether the communication is to be secured based upon the identified characteristics associated with the parsed communication;

where the determination is made that the communication should be secured, selecting one of a plurality of secure delivery mechanisms; and

attempting to deliver the electronic communication to the predetermined recipient via the selected secure delivery mechanism.