Apparatus and methods for reputation-based filtering on a communication network

• US 7,818,343 B1
• Filed: 03/29/2007
• Issued: 10/19/2010
• Est. Priority Date: 03/29/2007
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Kodukula, Narasimham, Sekhar, Bharath Kumar Chandra
• Primary Examiner(s): Ali; Mohammad
• Assistant Examiner(s): Ruiz; Angelica
• Application Number:
  US11/693,582
• Time in Patent Office: 1,300 Days
• Field of Search: 707/9, 707/104.1, 709/225, 709/229
• US Class Current: 707/781
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A method for providing reputation information concerning a domain is disclosed. The domain may include one or more devices on a network. The method may include retrieving a first reputation pertaining to a first function of the domain. The method may also include generating a message containing information pertaining to the first reputation and at least a second reputation, wherein the second reputation pertains to a second function of the domain.

Claims

1. A method for providing reputation information concerning a domain, the domain including one or more devices on a network, the method comprising:

storing reputation information in a cache of a server hardware device such that states of storage elements in the cache of the server hardware device are physically transformed;

retrieving, from the cache of the server hardware device, a first reputation pertaining specifically to a first function of the domain, the first function of the domain being performed by a first device of the domain, the domain including at least the first device and a second device, the first device performing the first function, the second device performing a second function different from the first function, the first function being related to providing a first service, the second function being related to providing a second service different from the first service;

receiving at the server hardware a reputation request sent from a gateway hardware device, the reputation request pertaining to the first reputation without directly pertaining to a second reputation, the second reputation pertaining specifically to the second function of the domain, the second function of the domain being performed by the second device of the domain;

retrieving the second reputation from a second server hardware device;

generating, using the server hardware device, a message in response to the reputation request, the message containing at least both information pertaining to the first reputation and information pertaining to the second reputation for controlling access to at least one of the first function of the domain and a the second function of the domain; and

providing the message to the gateway hardware device.

2. The method of claim 1 wherein the first reputation and the second reputation represent at least two of a web reputation, a web server reputation, a mail server reputation, a fax server reputation, a messaging server reputation, and a VoIP server reputation.

3. The method of claim 1 further comprising encoding at least one of the first reputation and the second reputation in the message using a graphical grading scheme.

4. The method of claim 1 further comprising encoding at least one of the first reputation and the second reputation in the message using a color grading scheme.

5. The method of claim 1 wherein at least one of the first reputation and the second reputation includes data pertaining to one or more of a frequency of updates, a number of hits, a number of complaints, a location, and an age of the domain.

6. The method of claim 1 further comprising determining the second reputation based on the first reputation.

7. The method of claim 1 further comprising retrieving the second reputation based on one or more of at least one URL and at least one IP address.

8. The method of claim 1 wherein the first reputation is retrieved from a first database, and the second reputation is retrieved from a second database.

9. The method of claim 1 further comprising using at least one of the server hardware device and the gateway hardware device to include at least one of reputation lifespan information, reputation expiration date information, and reputation expiration time information for at least one of the first reputation and the second reputation contained in the message.

10. The method of claim 1 further comprising encoding at least one of the first reputation and the second reputation using one or more grading schemes.

11. The method of claim 10 wherein the one o1 more grading schemes pertain to one or more of fuzzy logic, a numerical grading scheme, an alphabetical grading scheme, an alphanumerical grading scheme, a graphical grading scheme, and a color grading scheme.

12. A method for filtering communication with a domain, the communication pertaining to at least one function of the domain, the domain including one or more devices on a network, the method comprising:

receiving, using a gateway hardware device, a message containing information pertaining to a plurality of reputations;

storing the information pertaining to the plurality of reputations in a data store of the gateway hardware device such that states of storage elements in the data store of the gateway hardware device are physically transformed, the information pertaining to the plurality of reputations including at least reputation information pertaining to the at least one function, the communication involving interaction with at least a first device of the one or more devices, the at least one function being at least partially performed by the first device;

providing at least one of reputation lifespan information, a reputation expiration date information, and a reputation expiration time information for the reputation information pertaining to the at least one function stored in the data store of the gateway hardware device;

determining whether the reputation information pertaining to the at least one function stored in the data store of the gateway hardware device has expired;

sending, using the gateway hardware device, a reputation request for requesting current reputation information pertaining to the at east one function if the reputation information pertaining to the at least one function stored in the data store of the gateway hardware device is determined to be expired after the determining; and

filtering, using the gateway hardware device, the communication-using the reputation information pertaining to the at least one function stored in the data store of the gateway hardware device if the reputation information pertaining to the at least one function stored in the data store of the gateway hardware device is determined to be not expired after the determining,

wherein the plurality of reputations pertains to a plurality of functions of the domain, the plurality of functions of the domain includes the at least one function of the domain performed by a first device of the domain,

the plurality of functions of the domain includes at least a function, performed by a

second device of the domain, other than the at least one function, and

the information pertaining to the plurality of reputations includes the reputation information pertaining to the at least one function.

13. The method of claim 12 wherein the reputation information pertaining to the at least one function has at least one of a lifespan, an expiration date, and an expiration time.

14. The method of claim 12 wherein the plurality of reputations includes at least two of a web reputation, a web server reputation, a mail server reputation, a fax server reputation, a messaging server reputation, and a VoIP server reputation.

15. An apparatus for providing reputation information concerning a domain, the domain including one or more devices on a network, the apparatus comprising:

a data storage of a server hardware device for storing reputation information;

first logic configured to retrieve from the data storage of the server hardware device a first reputation pertaining specifically to a first function of the domain, the first function of the domain being performed by a first device of the domain, the domain including at least the first device and a second device, the first device performing the first function, the second device performing a second function different from the first function, the first function being related to providing a first service, the second function being related to providing a second service different from the first service;

second logic for receiving at the server hardware a reputation request sent from a gateway hardware device, the reputation request pertaining to the first reputation without directly pertaining to a second reputation, the second reputation pertaining specifically to the second function of the domain, the second function of the domain being performed by the second device of the domain;

third logic configured to retrieve the second reputation from a second server hardware device;

fourth logic configured to generate a message in response to the reputation request, the message containing at least both information pertaining to the first reputation and information pertaining to the second reputation for controlling access to at least one of the first function of the domain and the second function of the domain;

fifth logic configured to provide the message to the gateway hardware device; and

circuits implementing the first logic, the second logic, the third logic, the fourth logic, and the fifth logic.

16. The apparatus of claim 15 wherein the first reputation and the second reputation represent at least two of a web reputation, a web server reputation, a mail server reputation, a fax server reputation, a messaging server reputation, and a VoIP server reputation.

17. The apparatus of claim 15 further comprising sixth logic configured to encode the first reputation and the second reputation in the message using at least one of a graphical grading scheme and a color grading scheme.

18. The apparatus of claim 15 further comprising sixth logic configured to determine the second reputation based on the first reputation.

19. The apparatus of claim 15 wherein the third logic is configured to retrieve the second reputation based on at least one of the at least one URL and the at least one IP address, wherein the first reputation is retrieved from a first database, and the second reputation is retrieved from a second database.

20. The apparatus of claim 15 further comprising:

a datastore configured to store the first reputation and the second reputation; and

sixth logic configured to encode at least one of the first reputation and the second reputation.