Patent ID: 7496750

Claim:
A method of performing security functions on a message payload in a network element, the method comprising the computer-implemented steps of: intercepting, at the network element, one or more data packets comprising network layer or transport layer headers having a destination address that differs from an address of the network element; determining whether the headers of the data packets match a particular set of criteria; in response to determining that the headers of the data packets do not match the particular set of criteria, forwarding the data packets to the destination address without performing one or more security functions; and in response to determining that the headers of the data packets match the particular set of criteria, determining whether to perform the one or more security functions relative to at least a portion of an application layer message by performing, at the network element: assembling payloads of the data packets into at least a portion of an application layer message; determining whether the portion of the application layer message satisfies second criteria associated with a known message classification; in response to determining that the portion of the application layer message does not satisfy the second criteria, forwarding the data packets to the destination address without performing the one or more security functions; and in response to determining that the portion of the application layer message satisfies the second criteria, performing the one or more security functions on at least the portion of the application layer message; wherein each of the one or more security functions is any of an encryption function, a decryption function, a digest function, an authentication function, an authorization function, or an auditing function.