US 10,834,099 B2Granted

Identifying a file using metadata and determining a security classification of the file before completing receipt of the file

AssigneeJuniper Networks, Inc.

InventorsYuly N. Becerra Tenorio, Wei Han Kao, Daniel J. Quinlan, Volodymyr Kuznetsov, Yuriy Voynalovych

Life of this patent

Estimating the term…

Loading patent…

Abstract

A security platform may determine, during receipt of a file, metadata associated with the file. The file may be intended for a client device. The security platform may compute, based on the metadata and during the receipt of the file, a hash associated with the file. The security platform may identify, during the receipt of the file, a stored hash that matches the hash associated with the file. The security platform may determine a security classification of the file based on information associated with a security classification corresponding to the stored hash. The security classification of the file may be determined before the receipt of the file is complete. The security platform may selectively permit, based on the security classification of the file, the client device to complete a receipt of the file.

Claims20

Dependent claims

A security platform, comprising:

a memory;
and
one or more processors to:
determine, during a receipt of a file, metadata associated with the file,
the file being intended for a client device;
compute, based on the metadata and during the receipt of the file, a hash associated with the file,
the metadata including information from a header field of a response associated with the file;
identify, during the receipt of the file, a stored hash,
the stored hash being associated with a previously received file and corresponding to a security classification of the previously received file;
compare the computed hash, associated with the file, with the stored hash associated with the previously received file;
determine a security classification of the file based on comparing the computed hash, associated with the file, with the stored hash associated with the previously received file,
the security classification of the file being determined before the security platform completes the receipt of the file;
and
selectively permit or not permit, based on the security classification of the file, the client device to complete the receipt of the file,
the security platform being separate from the client device.

12 more elements

A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors of a security platform, cause the one or more processors to:
compute, during a receipt of a file and based on metadata associated with the file, a hash associated with the file,
the file being intended for a client device;
identify, during the receipt of the file, a stored hash,
the stored hash being associated with a previously received file and corresponding to a security classification of the previously received file;
compare the computed hash, associated with the file, with the stored hash associated with the previously received file;
determine, before the security platform completes the receipt of the file, a security classification of the file based on comparing the computed hash, associated with the file, with the stored hash associated with the previously received file;
and
selectively permit or not permit, based on the security classification of the file, the client device to complete the receipt of the file,
the security platform being separate from the client device.

7 more elements

A method, comprising:

determining, by a device and during a receipt of a file, metadata associated with the file,
the file being intended for a client device;
computing, by the device and during the receipt of the file, at least one hash associated with the file,
the at least one hash being computed based on the metadata;
identifying, by the device and during the receipt of the file, a stored hash,
the stored hash being associated with a previously received file and corresponding to a security classification of the previously received file;
comparing, by the device, the at least one hash, associated with the file, with the stored hash associated with the previously received file;
determining, by the device, a security classification of the file based on comparing the at least one hash, associated with the file, with the stored hash associated with the previously received file,
the security classification of the file being determined before the device completes the receipt of the file;
and
selectively causing or not causing, by the device and based on the security classification of the file, an entirety of the file to be provided to the client device,
the device being separate from the client device.

9 more elements

Dependencies are inferred from the claim text.