Distributed traffic scanning through data stream security tagging

1. A method for data security scanning in a network, comprising:

acquiring a security policy of a network for network traffic transmitted from outside the network to a destination network device;

ascertaining, based on the security policy, mandatory security technologies required to be applied to the network traffic;

determining, based on a security marker associated with the network traffic, mandatory security technologies that are not yet applied to the network traffic;

applying, by a security device on the network, at least one mandatory security technology of the not yet applied mandatory security technologies, based on a determination that the at least one mandatory technology are available to the security device; and

indicating with a security marker in the network traffic the at least one mandatory security technology applied to the network traffic.

2. The method of claim 1 , wherein acquiring comprises acquiring a security policy of a network by a perimeter security device on the perimeter of the network.

3. The method of claim 1 , wherein ascertaining further comprises:

verifying the integrity of the security policy.

4. The method of claim 1 , wherein ascertaining further comprises:

verifying the authenticity of the security policy.

5. The method of claim 1 , wherein determining comprises receiving a digitally signed security marker.

6. The method of claim 5 , wherein determining comprises:

verifying the integrity of the security marker.

7. The method of claim 6 , wherein determining comprises:

verifying the authenticity of the digital signature associated with the security marker.

8. A system for data security scanning in a network, comprising:

means for acquiring a security policy of a network for network traffic transmitted from outside the network to a destination network device;

means for ascertaining, based on the security policy, mandatory security technologies required to be applied to the network traffic;

means for determining, based on a security marker associated with the network traffic, mandatory security technologies that are not yet applied to the network traffic;

means for applying, by a security device on the network, at least one mandatory security technology of the not yet applied mandatory security technologies, based on a determination that the at least one mandatory technology are available to the security device; and

means for indicating with a security marker in the network traffic the at least one mandatory security technology applied to the network traffic.

9. The system of claim 8 , wherein the means for acquiring comprises means for acquiring a security policy of a network by a perimeter security device on the perimeter of the network.

10. The system of claim 8 , wherein the means for ascertaining further comprises:

means for verifying the integrity of the security policy.

11. The system of claim 8 , wherein the means for ascertaining further comprises:

means for verifying the authenticity of the security policy.

12. The system of claim 8 , wherein the means for determining comprises means for receiving a digitally signed security marker.

13. The system of claim 12 , wherein the means for determining comprises:

means for verifying the integrity of the security marker.

14. The system of claim 13 , wherein the means for determining comprises:

means for verifying the authenticity of the digital signature associated with the security marker.

15. A system for data security scanning in a network, comprising:

a first network device for acquiring a security policy of a network for network traffic transmitted from outside the network to a destination network device;

a second network device for ascertaining, based on the security policy, mandatory security technologies required to be applied to the network traffic;

a third network device for determining, based on a security marker associated with the network traffic, mandatory security technologies that are not yet applied to the network traffic; and

a security device for applying at least one mandatory security technology of the not yet applied mandatory security technologies, based on a determination that the at least one mandatory technology are available to the security device, wherein the security device indicates with a security marker in the network traffic the at least one mandatory security technology applied to the network traffic.

16. The system of claim 15 , wherein the first network device comprises a perimeter security device for acquiring a security policy of a network.

17. The system of claim 15 , wherein the second network device further comprises:

a processor for verifying the integrity of the security policy.

18. The system of claim 15 , wherein the means for ascertaining further comprises:

a processor for verifying the authenticity of the security policy.

19. The system of claim 15 , wherein the third network device comprises a processor for receiving a digitally signed security marker.

20. The system of claim 19 , wherein the third network device comprises:

a processor for verifying the integrity of the security marker.

21. The system of claim 20 , wherein the third network device comprises:

a processor for verifying the authenticity of the digital signature associated with the security marker.

22. A system for data security scanning in a network, comprising:

a processor; and

a memory,

wherein the processor and the memory are configured to perform a method comprising:

acquiring a security policy of a network for network traffic transmitted from outside the network to a destination network device;

ascertaining, based on the security policy, mandatory security technologies required to be applied to the network traffic;

determining, based on a security marker associated with the network traffic, mandatory security technologies that are not yet applied to the network traffic;

applying at least one mandatory security technology of the not yet applied mandatory security technologies, based on a determination that the at least one mandatory technology are available to the processor; and

indicating with a security marker in the network traffic the at least one mandatory security technology applied to the network traffic.

23. The system of claim 22 , wherein ascertaining further comprises:

verifying the integrity of the security policy.

24. The system of claim 22 , wherein ascertaining further comprises:

verifying the authenticity of the security policy.

25. The system of claim 22 , wherein determining comprises receiving a digitally signed security marker.

26. The system of claim 25 , wherein determining comprises:

verifying the integrity of the security marker.

27. The system of claim 26 , wherein determining comprises:

verifying the authenticity of the digital signature associated with the security marker.

28. A computer-readable medium containing instructions for performing a method for data security scanning in a network, the method comprising:

acquiring a security policy of a network for network traffic transmitted from outside the network to a destination network device;

ascertaining, based on the security policy, mandatory security technologies required to be applied to the network traffic;

determining, based on a security marker associated with the network traffic, mandatory security technologies that are not yet applied to the network traffic;

applying, by a security device on the network, at least one mandatory security technology of the not yet applied mandatory security technologies, based on a determination that the at least one mandatory technology are available to the security device; and

indicating with a security marker in the network traffic the at least one mandatory security technology applied to the network traffic.

29. The computer-readable medium of claim 28 , wherein acquiring comprises acquiring a security policy of a network by a perimeter security device on the perimeter of the network.

30. The computer-readable medium of claim 28 , wherein ascertaining further comprises:

verifying the integrity of the security policy.

31. The computer-readable medium of claim 28 , wherein ascertaining further comprises:

verifying the authenticity of the security policy.

32. The computer-readable medium of claim 28 , wherein determining comprises receiving a digitally signed security marker.

33. The computer-readable medium of claim 32 , wherein determining comprises:

verifying the integrity of the security marker.

34. The computer-readable medium of claim 33 , wherein determining comprises:

verifying the authenticity of the digital signature associated with the security marker.

35. A method for data security scanning in a network, comprising:

receiving a request from a destination network device for network traffic from outside a network;

acquiring a security policy of the network for network traffic being transmitted from outside the network to the destination network device;

ascertaining, based on the security policy, mandatory security technologies that are required to be applied to the network traffic; and

sending a query to at least one network device located on an intended path of the network traffic to the destination network device, the query soliciting an assistance offer from the at least one network device for assistance in applying the mandatory security technologies.

36. The method of claim 35 , further comprising:

transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination from the assistance offer that at least one network device has volunteered to apply the mandatory security technologies.

37. The method of claim 35 , further comprising:

transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination that the destination network device is configured to reject unsecured network traffic, wherein the unsecured network traffic is network traffic that has not been scanned with the mandatory security technologies.

38. The method of claim 35 , wherein sending comprises sending the query based on a determination of the size of the network traffic.

39. The method of claim 35 , wherein receiving comprises receiving by a perimeter security device on the perimeter of the network.

40. The method of claim 35 , wherein ascertaining further comprises:

verifying the integrity of the security policy.

41. The method of claim 35 , wherein ascertaining further comprises:

verifying the authenticity of the security policy.

42. The method of claim 36 , wherein the at least one network device digitally signs the assistance offer.

43. The method of claim 42 , wherein transmitting further comprises:

verifying the integrity of the assistance offer.

44. The method of claim 43 , wherein transmitting further comprises:

verifying the authenticity of one or more digital signatures associated with the assistance offer.

45. A system for data security scanning in a network, comprising:

means for receiving a request from a destination network device for network traffic from outside a network;

means for acquiring a security policy of the network for network traffic being transmitted from outside the network to the destination network device;

means for ascertaining, based on the security policy, mandatory security technologies that are required to be applied to the network traffic; and

means for sending a query to at least one network device located on an intended path of the network traffic to the destination network device, the query soliciting an assistance offer from the at least one network device for assistance in applying the mandatory security technologies.

46. The system of claim 45 , further comprising:

means for transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination from the assistance offer that at least one network device has volunteered to apply the mandatory security technologies.

47. The system of claim 45 , further comprising:

means for transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination that the destination network device is configured to reject unsecured network traffic, wherein the unsecured network traffic is network traffic that has not been scanned with the mandatory security technologies.

48. The system of claim 45 , wherein the means for sending comprises means for sending the query based on a determination of the size of the network traffic.

49. The system of claim 45 , wherein the means for receiving comprises means for receiving by a perimeter security device on the perimeter of the network.

50. The system of claim 45 , wherein the means for ascertaining further comprises:

means for verifying the integrity of the security policy.

51. The system of claim 45 , wherein the means for ascertaining further comprises:

means for verifying the authenticity of the security policy.

52. The system of claim 46 , wherein the at least one network device digitally signs the assistance offer.

53. The system of claim 52 , wherein the means for transmitting further comprises:

means for verifying the integrity of the assistance offer.

54. The system of claim 53 , wherein the means for transmitting further comprises:

means for verifying the authenticity of one or more digital signatures associated with the assistance offer.

55. A system for data security scanning in a network, comprising:

a processor; and

a memory,

wherein the processor and the memory are configured to perform a method comprising:

receiving a request from a destination network device for network traffic from outside a network;

acquiring a security policy of the network for network traffic being transmitted from outside the network to the destination network device;

ascertaining, based on the security policy, mandatory security technologies that are required to be applied to the network traffic; and

sending a query to at least one network device located on an intended path of the network traffic to the destination network device, the query soliciting an assistance offer from the at least one network device for assistance in applying the mandatory security technologies.

56. The system of claim 55 , wherein the processor and the memory are further configured to perform the method comprising:

transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination from the assistance offer that at least one network device has volunteered to apply the mandatory security technologies.

57. The system of claim 55 , wherein the processor and the memory are further configured to perform the method comprising:

transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination that the destination network device is configured to reject unsecured network traffic, wherein the unsecured network traffic is network traffic that has not been scanned with the mandatory security technologies.

58. The system of claim 55 , wherein sending comprises sending the query based on a determination of the size of the network traffic.

59. The system of claim 55 , wherein ascertaining further comprises:

verifying the integrity of the security policy.

60. The system of claim 55 , wherein ascertaining further comprises:

verifying the authenticity of the security policy.

61. The system of claim 56 , wherein the at least one network device digitally signs the assistance offer.

62. The system of claim 61 , wherein transmitting further comprises:

verifying the integrity of the assistance offer.

63. The system of claim 62 , wherein transmitting further comprises:

verifying the authenticity of one or more digital signatures associated with the assistance offer.

64. A computer-readable medium containing instructions for performing a method for data security scanning in a network, the method comprising:

receiving a request from a destination network device for network traffic from outside a network;

acquiring a security policy of the network for network traffic being transmitted from outside the network to the destination network device;

ascertaining, based on the security policy, mandatory security technologies that are required to be applied to the network traffic; and

sending a query to at least one network device located on an intended path of the network traffic to the destination network device, the query soliciting an assistance offer from the at least one network device for assistance in applying the mandatory security technologies.

65. The computer-readable medium of claim 64 , wherein the method further comprises:

transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination from the assistance offer that at least one network device has volunteered to apply the mandatory security technologies.

66. The computer-readable medium of claim 64 , wherein the method further comprises:

transmitting the network traffic, without applying security technologies, along the intended path of the network traffic to the destination device, based on a determination that the destination network device is configured to reject unsecured network traffic, wherein the unsecured network traffic is network traffic that has not been scanned with the mandatory security technologies.

67. The computer-readable medium of claim 64 , wherein sending comprises sending the query based on a determination of the size of the network traffic.

68. The computer-readable medium of claim 64 , wherein receiving comprises receiving by a perimeter security device on the perimeter of the network.

69. The computer-readable medium of claim 64 , wherein ascertaining further comprises:

verifying the integrity of the security policy.

70. The computer-readable medium of claim 64 , wherein ascertaining further comprises:

verifying the authenticity of the security policy.

71. The computer-readable medium of claim 65 , wherein the at least one network device digitally signs the assistance offer.

72. The computer-readable medium of claim 71 , wherein transmitting further comprises:

verifying the integrity of the assistance offer.

73. The computer-readable medium of claim 72 , wherein transmitting further comprises:

verifying the authenticity of one or more digital signatures associated with the assistance offer.