Cloud-based gateway security scanning
OwnerAleksandr Dubrovsky, Senthilkumar G. Cheetancheri +1inventors
InventorsAleksandr Dubrovsky, Senthilkumar G. Cheetancheri, Boris Yanovsky
Life of this patent
Estimating the term…
Abstract
Some embodiments of cloud-based gateway security scanning have been presented. In one embodiment, some data packets are received sequentially at a gateway device. The data packets constitute at least a part of a file being addressed to a client machine coupled to the gateway device. The gateway device forwards an identification of the file to a remote datacenter in parallel with forwarding the data packets to the client machine. The datacenter performs signature matching on the identification and returns a result of the signature matching to the gateway device. The gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
Claims24
A computer-implemented method comprising:
- receiving a plurality of data packets sequentially at a gateway device, the plurality of data packets are at least part of a file being addressed to a client machine, the gateway device communicatively coupled to a remote datacenter via a network;
- generating, by the gateway device, an identification of the file based on a partial hash of the plurality of data packets received;
- forwarding the identification of the file to a remote datacenter via the network from the gateway device substantially in parallel with forwarding the plurality of data packets to the client machine, wherein the datacenter performs signature matching on the identification;
- receiving a result of the signature matching from the remote datacenter via the network;
- and
- the gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
A computer-implemented method comprising:
- receiving, by a datacenter via a third network, an identification of a file from a gateway device interfacing a first network and a second network, wherein the gateway device generated the identification from a partial hash of a plurality of data packets that are at least part of the file, the file is transmitted from the second network to a client machine in the first network via the gateway device, and the gateway device is communicatively coupled to the datacenter via the third network;
- the datacenter making a determination of whether the file should be blocked from the client machine;
- and the datacenter sending the determination to the gateway device via the third network.
A gateway device, comprising:
- a first network interface to couple to a client machine in a first network;
- a second network interface to couple to a second network to receive a plurality of data packets destined to the client machine, wherein the plurality of data packets constitute at least part of a file;
- and
- a third network interface, communicatively coupled to a datacenter via a third network, to send an identification of the file generated based on a partial hash of the plurality of data packets to the datacenter and to receive a determination from the datacenter on whether the file should be blocked from the client machine.
A datacenter comprising:
- a network interface to communicative couple to a gateway device, said gateway device interfacing a first network and a second network, to receive an identification of a file from the gateway device;
- and
- a signature matching module coupled to the network interface, to compare the identification against one or more of a plurality of predetermined signatures to determine if the gateway device should block the file from the first network, the signature matching module to receive the identification via the network interface, the identification generated from a partial hash of a plurality of data packets that are at least part of the file received by the gateway device.
A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor, will cause the processor to perform operations comprising:
- receiving a plurality of data packets sequentially at a gateway device, the plurality of data packets are at least part of a file being addressed to a client machine, the gateway device communicatively coupled to a remote datacenter via a network;
- generating an identification of the file based on a partial hash of the plurality of data packets received;
- forwarding the identification of the file to a remote datacenter from the gateway device substantially in parallel with forwarding the plurality of data packets to the client machine, wherein the datacenter performs signature matching on the identification and returns;
- receiving a result of the signature matching from the remote datacenter via the network;
- and
- the gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor, will cause the processor to perform operations comprising:
- receiving, by a datacenter via a third network, an identification of a file from a gateway device interfacing a first network and a second network, wherein the gateway device generated the identification from a partial hash of a plurality of data packets that are at least part of the file, and the file is transmitted from the second network to a client machine in the first network via the gateway device and the gateway device is communicatively coupled to the datacenter via the third network;
- the datacenter making a determination of whether the file should be blocked from the client machine;
- and
- the datacenter sending the determination to the gateway device via the third network.
Dependencies are inferred from the claim text.