Virus immunization using prioritized routing

• US 8,863,285 B2
• Filed: 09/22/2006
• Issued: 10/14/2014
• Est. Priority Date: 04/27/2006
• Status: Active Grant

• Current Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Original Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Inventors: Levien, Royce A., Wood, JR., Lowell L., Lord, Robert W., Malamud, Mark A., Rinaldo, Jr., John D., Jung, Edward K. Y.
• Primary Examiner(s): HERZOG, MADHURI R
• Application Number:
  US11/526,213
• Publication Number:
  US 20070271616A1
• Time in Patent Office: 2,944 Days
• Field of Search: 726 22- 26, 726/13, 713/151, 713187-188, 714/4, 709230-244
• US Class Current: 726/24
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/6215 Individual queue per QOS, rate or priority
• CPC Class Codes: H04L 47/624 Altering the ordering of packets in an individual queue
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer

Abstract

An apparatus, device, methods, computer program product, and system are described that determine a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, associate an anti-viral agent with at least one identifier, prioritize transmission of the at least one identifier through the at least one network policy device, relative to the communication data, and provide the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device.

Claims

1. A method comprising:

receiving information associated with a virus via at least one network policy device, the virus associated with communication data on a communications network;

prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data;

outputting the at least one identifier from the at least one network policy device; and

providing access to the anti-viral agent via the communications network based at least partially on the at least one identifier.

2. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data, comprises:

receiving the information associated with the virus, the information associated with the virus including at least a notification of a future need to receive and route the at least one identifier.

3. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data, comprises:

determining a service level agreement associated with an entity and with the identifier; and

prioritizing the transmission based on the service level agreement.

4. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data, comprises:

providing a first transmission channel for data associated with the at least one identifier; and

providing a second transmission channel for the communication data.

5. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data, comprises:

applying preferred routing to a data packet associated with the at least one identifier, relative to a data packet associated with the communication data.

6. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data, comprises:

prioritizing transmission of the anti-viral agent, based on the prioritizing the transmission of the identifier.

7. The method of claim 1, wherein outputting the at least one identifier from the at least one network policy device comprises:

outputting the at least one identifier in association with the anti-viral agent.

8. The method of claim 1, wherein outputting the at least one identifier from the at least one network policy device comprises:

outputting a data packet including at least the at least one identifier and the anti-viral agent.

9. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data, comprises:

prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the communication data via at least one transport layer protocol and routing the at least one identifier via at least one of an internet layer protocol, a network layer protocol, or a datalink layer protocol.

10. The method of claim 1, wherein receiving information associated with a virus via at least one network policy device, the virus associated with communication data on a communications network comprises:

receiving information associated with a virus via at least one network policy device, the at least one network policy device at least one of including or in communication with at least one router.

11. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprises:

prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, through the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data.

12. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprises:

prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, the prioritizing transmission including at least routing the at least one identifier through the at least one network policy device via at least one lower protocol stack layer relative to the communication data.

13. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprises:

prioritizing, by the at least one network policy device, transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, the prioritizing transmission including at least routing the at least one identifier through one or more networks at least partially via at least one lower protocol stack layer relative to the communication data.

14. The method of claim 1, wherein receiving information associated with a virus via at least one network policy device, the virus associated with communication data on a communications network, comprises:

receiving the information associated with at least one of malicious software code, undesired code, or undesired behavior within a computer.

15. The method of claim 1, wherein receiving information associated with a virus via at least one network policy device, the virus associated with communication data on a communications network comprises:

receiving information associated with a virus via at least one network policy device, the at least one network policy device being at least one of separate, overlapping with, or a part of at least one of a router, a bridge, a network switch, a software-based switch, a hardware-based switch, a gateway, a hub, a converter, a repeater, a proxy, a cloud-based system, a service, a server, a network node, a network device, or a firewall.

16. The method of claim 1, wherein prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprises:

prioritizing, by the at least one network policy device, transmission of at least one identifier, including at least routing the at least one identifier via at least one logical network defined by the at least one lower protocol stack layer, the routing between an ingress point to the at least one logical network and an egress point from the at least one logical network.

17. The method of claim 1, wherein providing access to the anti-viral agent via the communications network based at least partially on the at least one identifier comprises:

transmitting the anti-viral agent to at least one network device of the communications network responsive to a request from the at least one network device for the anti-viral agent based at least partially on the at least one identifier.

18. A computer program product comprising:

at least one non-transitory computer readable medium including at least;

one or more instructions for receiving information associated with a virus via at least one network policy device, the virus associated with communication data on a communications network;

one or more instructions for prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data;

one or more instructions for outputting the at least one identifier from the at least one network policy device; and

one or more instructions for providing access to the anti-viral agent via the communications network based at least partially on the at least one identifier.

19. The computer program product of claim 18, wherein at least some of the one or more instructions for prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprise:

one or more instructions for receiving the information associated with the virus, the information associated with the virus including at least a notification of a future need to receive and route the at least one identifier.

20. The computer program product of claim 18, wherein at least some of the one or more instructions for prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprise:

one or more instructions for determining a service level agreement associated with an entity and with the identifier; and

one or more instructions for prioritizing the transmission based on the service level agreement.

21. The computer program product of claim 18, wherein at least some of the one or more instructions for prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprise:

one or more instructions for providing a first transmission channel for data associated with the at least one identifier; and

one or more instructions for providing a second transmission channel for the communication data.

22. The computer program product of claim 18, wherein at least some of the one or more instructions for prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprise:

one or more instructions for applying preferred routing to a data packet associated with the at least one identifier, relative to a data packet associated with the communication data.

23. The computer program product of claim 18, wherein at least some of the one or more instructions for prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprise:

one or more instructions for prioritizing transmission of the anti-viral agent, based on prioritizing the transmission of the identifier.

24. The system computer program product of claim 18, wherein at least some of the one or more instructions for prioritizing transmission of at least one identifier, the at least one identifier being associated with an anti-viral agent, via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data comprise:

one or more instructions for performing label-based switching of a data packet containing the at least one identifier.

25. The computer program product of claim 18, wherein at least some of the one or more instructions for outputting the at least one identifier from the at least one network policy device comprise:

one or more instructions for outputting the at least one identifier in association with the anti-viral agent.

26. The computer program product of claim 18, wherein at least some of the one or more instructions for outputting the at least one identifier from the at least one network policy device comprise:

one or more instructions for outputting a data packet including at least the at least one identifier and the anti-viral agent.

27. The computer program product of claim 18, wherein at least some of the one or more instructions for outputting the at least one identifier from the at least one network policy device comprise:

one or more instructions for outputting the identifier, the identifier being associated with a reference to the anti-viral agent.

28. A network policy device comprising:

a multi-network virus immunization system, the multi-network virus immunization system comprising;

identifier logic operable to receive information associated with a virus at the network policy device, the virus associated with communication data on a communications network, and further operable to associate at least one identifier with an anti-viral agent; and

router logic operable to prioritize transmission of the at least one identifier via the at least one network policy device, the prioritizing transmission including at least routing the at least one identifier via at least one lower protocol stack layer relative to the communication data, and further operable to output the at least one identifier from the at least one network policy device, and further operable to provide access to the anti-viral agent via the communications network based at least partially on the at least one identifier,

wherein at least one of the identifier logic or router logic is at least partially implemented in hardware.

29. The network policy device of claim 28, wherein the multi-network virus immunization system further comprises:

a network monitor operable to implement detection rules for detecting the virus on the communications network, and operable to provide the information associated with the virus to the identifier logic.

30. The network policy device of claim 28, wherein the identifier logic operable to receive information associated with a virus at the network policy device comprises:

router logic operable to associate the identifier based on a service level agreement associated with an entity.

31. The network policy device of claim 28, wherein the routing logic operable to prioritize transmission of the at least one identifier via the at least one network policy device comprises:

router logic operable to route the at least one identifier on a separate transmission channel than the communication data.

32. The network policy device of claim 28, wherein the router logic operable to prioritize transmission of the at least one identifier via the at least one network policy device comprises:

router logic operable to prioritize transmission of the at least one identifier relative to the communication data via at least one of (i) transmission of the at least one identifier on a first physical network and transmission of the communication data on a second physical network, (ii) transmission of the at least one identifier on a first logical network and transmission of the communication data on a second logical network, or (iii) transmission of the at least one identifier using a first layer of a protocol stack and transmission of the communication data using a second layer of a protocol stack.

33. The network policy device of claim 28, wherein the router logic operable to prioritize transmission of the at least one identifier via the at least one network policy device comprises:

router logic operable to at least one of create or update one or more routing tables via logic that is at least one of separate, overlapping with, or a part of conventional routing performed by the at least one network policy device.

34. A system comprising:

circuitry for determining at least one anti-viral packet associated with at least one identifier related to at least one anti-viral agent;

circuitry for enqueuing the at least one anti-viral packet by at least one priority store, the at least one priority store including at least one of one or more queues or one or more buffers;

circuitry for enqueuing at least one other packet by at least one other store, the at least one other packet not being associated with an identifier related to an anti-viral agent;

circuitry for prioritizing the at least one priority store relative to the at least one other store, the prioritizing the at least one priority store including at least allocating at least one of additional processing power or memory to operations associated with the at least one priority store while the at least one anti-viral packet is queued and enabling the at least one anti-viral packet to advance in a prioritized fashion relative to the at least one other packet and prior to the at least one anti-viral packet being dequeued; and

circuitry for dequeuing the at least one anti-viral packet, the dequeuing the at least one anti-viral packet enabling circuitry for transmitting the at least one anti-viral packet to provide the at least one anti-viral packet via at least one network link.

35. A method comprising:

determining at least one anti-viral packet associated with at least one identifier related to at least one anti-viral agent;

enqueuing the at least one anti-viral packet by at least one priority store, the at least one priority store including at least one of one or more queues or one or more buffers;

enqueuing at least one other packet by at least one other store, the at least one other packet not being associated with an identifier related to an anti-viral agent;

prioritizing the at least one priority store relative to the at least one other store, the prioritizing the at least one priority store including at least allocating, at least partially using at least one processing device, at least one of additional processing power or memory to operations associated with the at least one priority store while the at least one anti-viral packet is queued and enabling the at least one anti-viral packet to advance in a prioritized fashion relative to the at least one other packet and prior to the at least one anti-viral packet being dequeued; and

dequeuing the at least one anti-viral packet, the dequeuing the at least one anti-viral packet enabling provision of the at least one anti-viral packet via at least one network link.