Messaging security device

• US 8,484,733 B2
• Filed: 11/28/2006
• Issued: 07/09/2013
• Est. Priority Date: 11/28/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Pirzada, Shamim, Rao, Anup, Thomas, Michael, Fenton, James L., Szeto, Bailey G., Pol, Sanjay, Ramaswami, Ashok
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US11/563,730
• Publication Number:
  US 20080127295A1
• Time in Patent Office: 2,415 Days
• Field of Search: 726/11, 726 13- 15, 726 22- 25, 709223-225
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

In one embodiment, a system can comprise an interface that receives data related to a communication session and a messaging security device component that evaluates the data and enables a security measure for preventative monitoring of a threat based on the evaluation, the security measure can be universally applied to two or more messaging formats.

Claims

1. A system, comprising:

an interface component of a computer processor for receiving data related to a communication session; and

a messaging security device (MSD) component of the computer processor for dynamically evaluating the data related to a first and a second communication session involving electronic messages, each communication session corresponding to a disparate messaging protocol, identifies a first user identifier corresponding to the first communication session and a second user identifier corresponding to the second communication session in a messaging protocol different than the first communication session, determines that the first user identifier and the second user identifier correspond to two personas of a single user, enables a security measure for preventative monitoring of the single user, and universally applies the security measure to the disparate messaging protocols of the single user.

2. The system of claim 1, the messaging protocol is at least one of email, instant messaging, web-browsing, web mail, Internet Protocol (IP) telephony, audio communications, video communications, voice mail, video mail, and facsimile.

3. The system of claim 1, the first communication session relates to at least one device suitable for transmission of the data, the device is at least one of a gaming device, a portable media device, a computer, a machine, a laptop, a portable digital assistant (PDA), a staartphone, a mobile communication device, a cellular phone, a messaging device, a wireless device, a server, and a network.

4. The system of claim 1, wherein a threat is isolated based on at least one of a user identity and a device identity.

5. The system of claim 1, wherein a threat is isolated based upon a messaging protocol that initially contained the threat.

6. The system of claim 1, further comprising a policy engine that implements the security measure independent of messaging protocol.

7. The system of claim 1, further comprising a scanning engine that evaluates data associated with the first and second communication sessions utilizing at least one of the following types of filters:

an anti-spam filter, an AV (Anti-Virus) filter, a URL (Universal Resource Locator) filter, a URI (Unifbrm Resource Identifier) filter, a content analysis, a compliance filter, and an authentication filter.

8. The system of claim 1, further comprising a common data store that stores data related to at least one of an active communication session and a past communication session.

9. The system of claim 8, the common data store includes an identity involved in the first communication session including at least one of an email address, an IP address, an instant messaging handle, and a URI (Uniform Resource Identifier) including a SIP (Session Initiation Protocol) type URI.

10. The system of claim 8, the MSD component utilizes the active communication session data to employ dynamic evaluation and implementation of the security measure to at least one messaging protocol.

11. The system of claim 8, the MSD component utilizes the past communication session data to employ the security measure to at least one messaging protocol.

12. The system of claim 1, the MSD component identifies a source of wherein a threat, the source is at least one of a device, a user, a gaming device, a computer, a machine, a laptop, a portable digital assistant (PDA), a smartphone, a mobile communication device, a cellular phone, a messaging device, an IP address, a website, an attachment associated with an email, a wireless device, a server, a portable media device, a person, an identity, a persona, a characteristic of the threat, a type of the threat, and a network.

13. The system of claim 12, the MSD component further identifies the persona corresponding to the source and associated with a messaging protocol, the persona is at least one of an email address, an IP telephony number, an instant messaging handle, an Internet Protocol (IP) address, a URI (Uniform Resource Identifier) including a SIP (Session Initiation Protocol) URI, a web mail address, and a facsimile number.

14. The system of claim 1, further comprising a repair component that initiates a mechanism that corrects an infected entity that becomes infected as a function of a threat.

15. The system of claim 14, the repair component utilizes a messaging protocol that is disparate in comparison with the infected messaging protocol to notify the infected entity wherein the notification includes the mechanism that corrects the infected entity.

21. The system of claim 1, wherein the identifying includes examining user identifications specified in Simple Mail Transfer Protocol (SMTP) to tie data to an owner of a machine or device.

22. The system of claim 1, wherein the identifying includes examining user identifications specified in Post Office Protocol (POP) to tie data to an owner of a machine or device.

23. The system of claim 1, wherein the identifying includes examining user identifications specified in Internet Message Access Protocol (IMAP) to tie data to an owner of a machine or device.

24. The system of claim 1, wherein the identifying includes examining user identifications specified in Messaging Application Programming Interface (MAPI) to tie data to an owner of a machine or device.

25. The system of claim 1, wherein the dynamically evaluating includes deriving a reputation score for the user.

26. The system of claim 1, wherein the dynamically evaluating includes sniffing public instant messaging traffic.

27. The system of claim 1, wherein the messaging protocol of the first communication session is a protocol of a first company and the messaging protocol of the second communication session is a protocol of a second company different than the first company.

28. The system of claim 1, wherein the dynamically evaluating includes obtaining user identifications associated with the first communication session and the second communication session and querying a directory using the user identifications to determine that the user identifications are both associated with a single user.

29. The system of claim 1, wherein the dynamically evaluating includes monitoring log-in information to a service provider and matching user identifications associated with the first communication session and the second communication session with the same log-in information, the log-in information being log-in information for the single user.

16. A method, comprising:

analyzing data related to a first and a second communication session involving electronic messages, each communication session corresponding to a disparate messaging protocol;

identifying, using a computer processor, a first user identifier corresponding to the first communication session and a second user identifier corresponding to the second communication session, wherein the second communication session is in a messaging protocol different than the first communication session;

determining that the first user identifier and the second user identifier correspond to two personas of a single user; and

enforcing a security policy on the single user to at least two or more messaging protocols based on an evaluation of the two personas.

17. The method of claim 16, the first communication session relates to a device, the device is at least one of a computer, a machine, a laptop, a portable digital assistant (PDA), a smartphone, a mobile communication device, a cellular phone, a gaming device, a portable media device, a messaging device, a wireless device, a server, and a network.

18. The method of claim 16, further comprising:

identifying a source of a threat;

generating a security policy as a function of the threat; and

enforcing the security policy to at least two or more messaging protocols.

19. The method of claim 16, further comprising:

utilizing a messaging protocol to communicate repair data related to a threat;

analyzing at least one of a past and an active communication session; and

implementing the security policy to at least two messaging protocols based on the analysis of the past and the active communication session.

20. A router, comprising:

an interface of a computer processor for receiving data related to a communication session; and

a messaging security device (MSD) component of the computer processor for dynamically evaluating the data related to a first and a second communication session involving electronic messages, each communication session corresponding to a disparate messaging protocol, identifies a first user identifier corresponding to the first communication session and a second user identifier corresponding to the second communication session, wherein the messaging protocol of the second communication session is different than the messaging protocol of the first communication session, determines that the first user identifier and the second user identifier correspond to two personas of a single user, enables a security measure for preventative monitoring of the single user, and universally applies the security measure to the disparate messaging protocols of the single user.