Security message processing

1. A network security system, comprising:

a plurality of processing nodes communicatively coupled to an authority node via a network, each of the plurality of processing nodes and the authority node are separately connected to the network, wherein the plurality of processing nodes and the authority node comprising a distributed security system, and the authority node is configured to store and distribute policy data to each of the plurality of processing nodes, each processing node comprising a processing node manager configured to perform operations comprising:

identifying a content item;

generating a security request for the content item, the security request comprising one or more time constraints based on security data information value over time;

determining whether a first security operation for the security request can be performed within the one or more time constraints; and

transmitting the security request to the authority node if the processing node determines that the first security operation can be performed within the one or more time constraints;

performing a second security operation on the content item at the processing node if the processing node manager determines that the first security operation can not be performed within the one or more time constraints.

2. The network security system of claim 1 , wherein each processing node manager is further configured to perform operations comprising:

determining if the first security operation is not performed within the one or more time constraints after the security request is transmitted; and performing the second security operation on the content item at the processing node if the processing node manager determines that first security operation is not performed within the one or more time constraints.

3. The network security system of claim 1 , wherein: the one or more time constraints comprise a maximum time; and the operation of determining whether the first security operation for the security request can be performed within the one or more time constraints comprises determining whether the first security operation can be performed before the occurrence of the maximum time.

4. The network security system of claim 1 , wherein: the one or more time constraints comprise a minimum time; and the processing node manager is further configured to perform operations comprising transmitting the security request only after the occurrence of the minimum time.

5. The network security system of claim 4 , wherein:

the one or more time constraints comprise a maximum time; and

the operation of determining whether the first security operation for the security request can be performed within the one or more time constraints comprises determining whether the first security operation can be performed before the occurrence of the maximum time.

6. The network security system of claim 1 , wherein the first security operation comprises receiving a reply to the security request at the processing node that includes security data responsive to the security request.

7. The network security system of claim 1 , wherein the processing node further comprises:

a plurality of data inspection engines, each data inspection engine configured to perform operations comprising a threat detection process to classify content items according to a threat classification for a corresponding threat;

wherein:

the security request comprises a request for responsive threat data;

the first security operation comprises receiving a reply to the security request at the processing node for responsive threat data; and

a second security operation comprises performing a threat detection process with the data inspection engines on the content item to generate the responsive threat data.

8. The network security system of claim 1 , wherein:

the content item data transmission comprises a login request;

the security request comprises a request for login credentials;

the first security operation comprises receiving a reply to the request for the login credentials; and

a second security operation comprises denying a login request.

9. A network security system, comprising:

an authority node communicatively coupled to a processing node via a network, each of the processing node and the authority node are separately connected to the network, wherein the authority node and the processing node comprising a distributed security system, the authority node is configured to store and distribute policy data to the processing node, and the authority node comprising an authority node manager configured to perform operations comprising:

receiving a request for a first security operation from the processing node, the security request defining one or more time constraints based on security data information value over time;

determining whether the first security operation can be performed within the one or more time constraints; and

initiating performance of the first security operation only if the authority node manager determines that the first security operation can be performed within the one or more time constraints;

performing a second security operation on the content item at the processing node if the authority node manager determines that the first security operation can not be performed within the one or more time constraints.

10. The network security system of claim 9 , wherein initiating performance of the first security operation comprises generating a reply responsive to the security request and transmitting the reply from the authority node to a processing node that issued the request.

11. The network security system of claim 10 , wherein the one or more time constraints comprise a maximum time; and

the operation of determining whether the first security operation can be performed within the one or more time constraints comprises determining whether the reply can be received at the processing node before the occurrence of the maximum time.

12. The network security system of claim 11 , wherein the reply comprises a security digest.

13. The network security system of claim 9 , wherein initiating performance of the first security operation comprises storing security data in an authority node data store.

14. The network security system of claim 13 , wherein:

the one or more time constraints comprise a maximum time; and

the operation of determining whether the first security operation for the first security instance can be performed within the one or more time constraints comprises determining whether the security data can be stored before the occurrence of the maximum time.

15. The network security system of claim 13 , wherein the security data comprises threat data.

16. The network security system of claim 13 , wherein the security data comprises a threat data update.

17. The network security system of claim 13 , wherein the security data comprises a process filter update.

18. The network security system of claim 9 , further comprising:

receiving requests for other first security operations, each of the security requests defining one or more time constraints;

prioritizing the requests based in part on the time constraints; and

initiating performance of the requested first security operations according to the prioritization of the requests.

19. A computer-implemented method for handling security requests, comprising:

generating a security request at a processing node, the security request comprising one or more time constraints based on security data information value over time;

determining whether a first security operation for the security request can be performed within the one or more time constraints;

transmitting the security request from the processing node to an authority node if it is determined that the first security operation can be performed within the one or more time constraints, each of the processing node and the authority node are separately connected to a network, wherein the authority node and the processing node comprising a distributed security system, and the authority node is configured to store and distribute policy data to the processing node; and

performing a second security operation at the processing node if it is determined that the first security operation can not be performed within the one or more time constraints.

20. The computer-implemented method of claim 19 , further comprising:

determining if the first security operation is not performed within the one or more time constraints after the security request is transmitted; and

performing the second security operation at the processing node if it is determined that the first security operation is not performed within the one or more time constraints.

21. The computer-implemented method of claim 19 , wherein:

the one or more time constraints comprise a maximum time; and

determining whether the first security operation for the security request can be performed within the one or more time constraints comprises determining whether the first security operation can be performed before the occurrence of the maximum time.

22. The computer-implemented method of claim 19 , wherein:

the one or more time constraints comprise a minimum time; and

further comprising transmitting the security request only after the occurrence of the minimum time.

23. The computer-implemented method of claim 22 , wherein:

the one or more time constraints comprise a maximum time; and

determining whether the first security operation for the security request can be performed within the one or more time constraints comprises determining whether the first security operation can be performed before the occurrence of the maximum time.

24. The computer-implemented method of claim 19 , wherein the first security operation comprises receiving at the processing node a reply to the security request that includes security data responsive to the security request.

25. The computer-implemented method of claim 19 , wherein:

the security request comprises a request for responsive threat data;

the first security operation comprises receiving at the processing node a reply to the request for responsive threat data; and

the second security operation comprises initiating at the processing node a threat detection process to generate the responsive threat data.

26. A computer-implemented method for handling security requests, comprising:

receiving at an authority node a request for a first security operation, the security request defining one or more time constraints based on security data information value over time;

determining whether the first security operation can be performed at a processing node that issued the request within the one or more time constraints, each of the processing node and the authority node are separately connected to a network, wherein the authority node and the processing node comprising a distributed security system, and the authority node is configured to store and distribute policy data to the processing node; and

initiating performance of the first security operation only if it is determined that the first security operation can be performed within the one or more time constraints;

performing a second security operation on the content item at the processing node if the authority node manager determines that the first security operation can not be performed within the one or more time constraints.

27. The computer-implemented method of claim 26 , wherein initiating performance of the first security operation comprises generating a reply responsive to the security request and transmitting the reply to the processing node that issued the request for reception by the processing node.

28. The computer-implemented method of claim 26 , wherein:

the one or more time constraints comprise a maximum time; and

determining whether the first security operation can be performed within the one or more time constraints comprises determining whether the reply can be received at the processing node before the occurrence of the maximum time.

29. The computer-implemented method of claim 26 , wherein initiating performance of the first security operation comprises storing security data in an authority node data store.

30. The computer-implemented method of claim 26 , wherein the digest comprises threat data.