Cloud-based gateway security scanning
View Patent ↗Some embodiments of cloud-based gateway security scanning have been presented. In one embodiment, some data packets are received sequentially at a gateway device. The data packets constitute at least a part of a file being addressed to a client machine coupled to the gateway device. The gateway device forwards an identification of the file to a remote datacenter in parallel with forwarding the data packets to the client machine. The datacenter performs signature matching on the identification and returns a result of the signature matching to the gateway device. The gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
1. A computer-implemented method comprising:
receiving a plurality of data packets sequentially at a gateway device, the plurality of data packets are at least part of a file being addressed to a client machine, the gateway device communicatively coupled to a remote datacenter via a network;
generating, by the gateway device, an identification of the file based on a partial hash of the plurality of data packets received;
forwarding the identification of the file to a remote datacenter via the network from the gateway device substantially in parallel with forwarding the plurality of data packets to the client machine, wherein the datacenter performs signature matching on the identification;
receiving a result of the signature matching from the remote datacenter via the network; and
the gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
2. The method of claim 1 , further comprises:
the gateway device performing signature matching on the identification; and
the gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter and a result of the signature matching produced by the gateway device.
3. The method of claim 1 , further comprising:
the gateway device blocking the file from the client machine when the result of the signature matching from the datacenter indicates that the identification matches a signature of malware.
4. The method of claim 1 , further comprising:
the gateway device identifying a type of the file; and
the gateway device determining whether to forward the identification of the plurality of data packets based on the type of the file.
5. The method of claim 1 , further comprising:
sending at least one of a destination server Internet Protocol (IP) address, a hostname, and a Universal Resource Locator (URL) of the file with the identification to the datacenter.
6. A computer-implemented method comprising:
receiving, by a datacenter via a third network, an identification of a file from a gateway device interfacing a first network and a second network, wherein the gateway device generated the identification from a partial hash of a plurality of data packets that are at least part of the file, the file is transmitted from the second network to a client machine in the first network via the gateway device, and the gateway device is communicatively coupled to the datacenter via the third network;
the datacenter making a determination of whether the file should be blocked from the client machine;
and the datacenter sending the determination to the gateway device via the third network.
7. The method of claim 6 , wherein the datacenter making a determination of whether the file should be blocked from the client machine comprises:
the datacenter retrieving one or more predetermined signatures from a database; and
the datacenter performing signature matching on the identification using the one or more predetermined signatures retrieved.
8. The method of claim 7 , wherein the datacenter performing signature matching comprises:
the datacenter performing deep packet inspection on the identification.
9. The method of claim 6 , wherein the datacenter is remote to the gateway device.
10. A gateway device, comprising:
a first network interface to couple to a client machine in a first network; a second network interface to couple to a second network to receive a plurality of data packets destined to the client machine, wherein the plurality of data packets constitute at least part of a file; and
a third network interface, communicatively coupled to a datacenter via a third network, to send an identification of the file generated based on a partial hash of the plurality of data packets to the datacenter and to receive a determination from the datacenter on whether the file should be blocked from the client machine.
11. The gateway device of claim 10 , further comprising:
a processing module to determine a type of the file, wherein the third network interface sends the identification of the file to the datacenter if the type of the file is one of a set of one or more predetermined file types.
12. The gateway device of claim 10 , wherein the third network interface sends at least one of a destination server Internet Protocol (IP) address, a hostname, and a Universal Resource Locator (URL) of the file with the identification to the datacenter.
13. A datacenter comprising:
a network interface to communicative couple to a gateway device, said gateway device interfacing a first network and a second network, to receive an identification of a file from the gateway device; and
a signature matching module coupled to the network interface, to compare the identification against one or more of a plurality of predetermined signatures to determine if the gateway device should block the file from the first network, the signature matching module to receive the identification via the network interface, the identification generated from a partial hash of a plurality of data packets that are at least part of the file received by the gateway device.
14. The datacenter of claim 13 , wherein the signature matching module performs deep packet inspection on the identification.
15. The datacenter of claim 13 , further comprising:
a database coupled to the network interface, to store a plurality of predetermined signatures of malware.
16. A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor, will cause the processor to perform operations comprising:
receiving a plurality of data packets sequentially at a gateway device, the plurality of data packets are at least part of a file being addressed to a client machine, the gateway device communicatively coupled to a remote datacenter via a network;
generating an identification of the file based on a partial hash of the plurality of data packets received;
forwarding the identification of the file to a remote datacenter from the gateway device substantially in parallel with forwarding the plurality of data packets to the client machine, wherein the datacenter performs signature matching on the identification and returns;
receiving a result of the signature matching from the remote datacenter via the network; and
the gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the operations further comprise:
the gateway device performing signature matching on the identification; and
the gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter and a result of the signature matching produced by the gateway device.
18. The non-transitory computer-readable storage medium of claim 16 , wherein the operations further comprise:
the gateway device blocking the file from the client machine when the result of the signature matching from the datacenter indicates that the identification matches a signature of malware.
19. The non-transitory computer-readable storage medium of claim 16 , wherein the operations further comprise:
the gateway device identifying a type of the file; and
the gateway device determining whether to forward the identification of the plurality of data packets based on the type of the file.
20. The non-transitory computer-readable storage medium of claim 16 , wherein the operations further comprise:
sending at least one of a destination server Internet Protocol (IP) address, a hostname, and a Universal Resource Locator (URL) of the file with the identification to the datacenter.
21. A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor, will cause the processor to perform operations comprising:
receiving, by a datacenter via a third network, an identification of a file from a gateway device interfacing a first network and a second network, wherein the gateway device generated the identification from a partial hash of a plurality of data packets that are at least part of the file, and the file is transmitted from the second network to a client machine in the first network via the gateway device and the gateway device is communicatively coupled to the datacenter via the third network;
the datacenter making a determination of whether the file should be blocked from the client machine; and
the datacenter sending the determination to the gateway device via the third network.
22. The non-transitory computer-readable storage medium of claim 21 , wherein the datacenter making a determination of whether the file should be blocked from the client machine comprises:
the datacenter retrieving one or more predetermined signatures from a database; and
the datacenter performing signature matching on the identification using the one or more predetermined signatures retrieved.
23. The non-transitory computer-readable storage medium of claim 22 , wherein the datacenter performing signature matching comprises:
the datacenter performing deep packet inspection on the identification.
24. The non-transitory computer-readable storage medium of claim 21 , wherein the datacenter is remote to the gateway device.