Virus immunization using prioritized routing

• US 8,191,145 B2
• Filed: 06/22/2006
• Issued: 05/29/2012
• Est. Priority Date: 04/27/2006
• Status: Active Grant

• Current Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Original Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Inventors: Malamud, Mark A., Rinaldo, Jr., John D., Wood, JR., Lowell L., Jung, Edward K. Y., Levien, Royce A., Lord, Robert W.
• Primary Examiner(s): Parthasarathy, Pramila
• Application Number:
  US11/474,523
• Publication Number:
  US 20070256128A1
• Time in Patent Office: 2,168 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An apparatus, device, methods, computer program product, and system are described that determine a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, associate an anti-viral agent with at least one identifier, prioritize transmission of the at least one identifier through the at least one network policy device, relative to the communication data, and provide the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device.

Claims

1. A computer-implemented method comprising:

implementing on a processor, computer-executable instructions configured to;

determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device;

associating an anti-viral agent with at least one identifier located in a data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network;

prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data; and

providing the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device.

2. The computer-implemented method of claim 1, wherein determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, comprises:

determining the virus associated with the communication data on the communications network, the communications network associated with restricted access thereto.

3. The computer-implemented method of claim 1, wherein determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, comprises:

determining the virus associated with the communication data on the communications network, the communications network associated with the at least one network policy device that is associated with a plurality of network policy devices that are configured to provide at least two classes of network traffic management.

4. The computer-implemented method of claim 1, wherein associating an anti-viral agent with at least one identifier located in data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network, comprises:

determining the anti-viral agent as being configured to prevent and/or inhibit the virus on the communications network; and

associating the anti-viral agent with the at least one identifier.

5. The computer-implemented method of claim 1, wherein associating an anti-viral agent with at least one identifier located in data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network, comprises:

labeling a header of a data packet with the at least one identifier, the data packet including at least a portion of the anti-viral agent as payload of the data packet.

6. The computer-implemented method of claim 1, wherein associating an anti-viral agent with at least one identifier located in data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network, comprises:

associating the anti-viral agent with the at least one identifier, wherein the at least one identifier includes a transmission priority.

7. The computer-implemented method of claim 1, wherein associating an anti-viral agent with at least one identifier located in data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network, comprises:

associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission classification in accordance with a transmission classification scheme of the network policy device.

8. The computer-implemented method of claim 1, wherein associating an anti-viral agent with at least one identifier located in data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network, comprises:

associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission channel of the network policy device.

9. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

determining a transmission priority associated with the at least one identifier.

10. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

determining a forwarding decision of a data packet containing the at least one identifier, based on content of the at least one identifier.

11. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

making a determination of a transmission priority of a data packet containing the at least one identifier, relative to a transmission priority of the communication data; and

prioritizing the transmission of the data packet relative to the communication data, based on the determination.

12. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

replacing the at least one identifier with a replacement identifier.

13. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

associating at least a second identifier with the at least one identifier.

14. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased transmission speed of the at least one identifier, relative to the communication data.

15. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased quality of service associated with at least one data packet containing the at least one identifier, relative to the communication data.

16. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased transmission security of the at least one identifier, relative to the communication data.

17. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an increased available bandwidth for transmission of the at least one identifier, relative to available bandwidth for transmission of the communication data.

18. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing an end-to-end circuit through the network policy device for at least one data packet associated with the at least one identifier, the end-to-end circuit being associated with a specified transmission characteristic.

19. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing prioritized transmission of a class of identifiers, the at least one identifier being associated with the class.

20. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

making a determination that the at least one identifier is associated with an entity; and

prioritizing the transmission of the at least one identifier, based on the determination.

21. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

prioritizing queuing of the at least one identifier within the at least one network policy device, relative to queuing of the communication data.

22. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

providing the transmission of the at least one identifier, the at least one identifier including at least one label associated with the Multi-Label Switching Protocol (MPLS).

23. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

receiving an indication, from a first entity, of a specified quality of service (QoS) associated with the at least one identifier, at a second entity.

24. The computer-implemented method of claim 1, wherein prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data, comprises:

prioritizing the transmission, based on a service level agreement between a first entity and a second entity.

25. The computer-implemented method of claim 1, wherein providing the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device, comprises:

providing the anti-viral agent to at least one network device of the communications network.

26. A device comprising:

a multi-network virus immunization system, the multi-network virus immunization system comprising;

(a) a network monitor operable to determine a virus associated with communication data on a communications network, the communications network associated with at least one network policy device;

(b) identifier logic operable to associate an anti-viral agent with at least one identifier, the at least one identifier located in a data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network; and

(c) routing logic operable to prioritize transmission of the at least one identifier through the at least one network policy device, relative to the communication data, and further operable to provide the anti-viral agent on the communications network.

27. The device of claim 26 wherein the identifier logic is operable to select the at least one identifier based on one or more of identifier data, the anti-viral agent, and/or a service level agreement associated with an entity.

28. The device of claim 26 wherein the routing logic is operable to perform priority queue scheduling of the at least one identifier.

29. A system comprising:

circuitry for determining a virus associated with communication data on a communications network, the communications network associated with at least one network policy device;

circuitry for associating an anti-viral agent with at least one identifier located in a data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network;

circuitry for prioritizing transmission of the at least one identifier through the at least one network policy device, relative to the communication data; and

circuitry for providing the anti-viral agent on the communications network, said circuitry for providing responsive to the circuitry for prioritizing transmission of the at least one identifier through the at least one network policy device.