Data scanning network security technique

• US 7,010,700 B1
• Filed: 08/13/2001
• Issued: 03/07/2006
• Est. Priority Date: 10/31/1997
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wu, Johnson, Lowe, Ricky K., Foss, Andrew L.
• Primary Examiner(s): Elisca, Pierre E.
• Application Number:
  US09/929,809
• Time in Patent Office: 1,667 Days
• Field of Search: 713/200, 713/201, 713/202, 380/3, 380/4, 380/25, 709/206, 709/229
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A system and method are disclosed for providing enhanced computer network security by scanning data, specifically electronic mail messages, sent to the network before the data is received and transmitted by the network'"'"'s mail server. An e-mail message is received by a computer network configured to receive data and is checked as the data is received and before it is transmitted to a node on the computer network. The method includes determining whether an external source is attempting to establish a mail connection with the computer network configured to include a data scanning device that recognizes one or more data transfer protocols. Once the data is received the data scanning device begins evaluating the data by first determining whether the data is formatted according to one of the recognized protocols. The data scanning device begins scanning the data for acceptable content and format according to a rule set established by one of the recognized protocols. This is done at the same time as the data is received by the data scanning device. It is then determined whether the data should be sent to its destination on the computer network. If necessary, the data is translated before being passed to its destination on the computer network.

Claims

1. A data security apparatus for use in a computer network for checking data received from an external source, comprising:

a multiprotocol rule set data scanner capable of scanning the data received for acceptable content and format as determined by a rule set established by a recognized protocol, such that the data is scanned in subdivisions set by the recognized protocol as the data is received;

a data translator for translating the data;

a data network transmitter for transmitting the translated data to a destination node on the computer network;

a mail connection detector for detecting if an external source is attempting to establish a mail connection with the computer network wherein the computer network is receptive to one or more recognized protocols; and

a data receiver for receiving data from the external source.

2. A data security apparatus as recited in claim 1 further comprising:

means for determining whether the data should be transmitted to the destination node on the computer network.

3. A data security apparatus as recited in claim 1 further comprising:

a protocol evaluator for evaluating a protocol used by the external source in sending the data; and

a protocol format analyzer for determining whether the data from the external source is formatted based on one or more recognized protocols.

4. A data security apparatus as recited in claim 1 wherein the data translator for translating the data includes a data intake component for data intake that translates the data as the data is received by the data translator.

5. A data security apparatus as recited in claim 1 further comprising a data rejector for rejecting the data if the data is not formatted according to a recognized protocol.

6. A data security apparatus as recited in claim 1 further comprising a data separator for separating the data into portions wherein a portion of the data includes message-data or a plurality of commands.

7. A data security apparatus as recited in claim 1 further comprising a data scan controllor for pausing the scan when a message-data portion is detected and resuming the scan when a command portion is detected.

8. A data security apparatus as recited in claim 1 further comprising a string comparator for comparing character strings.

9. A data security apparatus for use in a computer network for checking data received from an external source, comprising:

means for scanning the data received for acceptable content and format as determined by a rule set established by a recognized protocol, such that the data is scanned in subdivisions set by the recognized protocol as the data is received;

means for translating the data;

means for transmitting the translated data to a destination node on the computer network;

means for detecting if an external source is attempting to establish a mail connection with the computer network wherein the computer network is receptive to one or more recognized protocols; and

means for receiving data from the external source.

10. A data security apparatus for use in a computer network for checking data received from an external source, comprising:

a processor; and

a memory, at least one of the processor and the memory being adapted for;

scanning the data received for acceptable content and format as determined by a rule set established by a recognized protocol, such that the data is scanned in subdivisions set by the recognized protocol as the data is received;

translating the data;

transmitting the translated data to a destination node on the computer network;

detecting if an external source is attempting to establish a mail connection with the computer network wherein the computer network is receptive to one or more recognized protocols; and

receiving data from the external source.

11. A method for implementing a data security system for use in a computer network for checking data received from an external source, comprising:

scanning the data received for acceptable content and format as determined by a rule set established by a recognized protocol, such that the data is scanned in subdivisions set by the recognized protocol as the data is received;

translating the data;

transmitting the translated data to a destination node on the computer network;

detecting if an external source is attempting to establish a mail connection with the computer network wherein the computer network is receptive to one or more recognized protocols; and

receiving data from the external source.

12. A computer-readable medium storing thereon computer-readable instructions for implementing a data security system for use in a computer network for checking data received from an external source, comprising:

instructions for scanning the data received for acceptable content and format as determined by a rule set established by a recognized protocol, such that the data is scanned in subdivisions set by the recognized protocol as the data is received;

instructions for translating the data;

instructions for transmitting the translated data to a destination node on the computer network;

instructions for detecting if an external source is attempting to establish a mail connection with the computer network wherein the computer network is receptive to one or more recognized protocols; and

instructions for receiving data from the external source.