Cloud-based gateway security scanning
View Patent ↗Some embodiments of cloud-based gateway security scanning have been presented. In one embodiment, some data packets are received sequentially at a gateway device. The data packets constitute at least a part of a file being addressed to a client machine coupled to the gateway device. The gateway device forwards an identification of the file to a remote datacenter in parallel with forwarding the data packets to the client machine. The datacenter performs signature matching on the identification and returns a result of the signature matching to the gateway device. The gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
1. A method for providing cloud-based security scanning, the method comprising:
storing a plurality of signatures of previously received files in memory of a datacenter, each signature based on at least a partial hash of less than all data packets of an associated previously received file, wherein the associated file is associated with a content rating indicative of a category of content;
receiving an identification of less than all data packets of a file sent by one or more gateways over a communication network to the datacenter, the identification based on at least a partial hash of the packets comprising less than all data packets of the file before all data packets of the file are received;
executing instructions stored in memory of the datacenter, wherein execution of the instructions by a processor of the datacenter determines that the identification matches a signature associated with one of the previously received files; and
sending information over the communication network to the gateway regarding the file associated with the matching signature, the information including the associated content rating, wherein the gateway blocks the file based on the associated content rating indicating a prohibited category of content before all data packets of the file are received.
2. The method of claim 1 , wherein the stored signatures comprise signatures of known malware files.
3. The method of claim 1 , wherein the stored signatures comprise signatures of known webpages.
4. The method of claim 1 , wherein the received identification identifies a type of the file, and wherein the identification is forwarded based on the identified type.
5. The method of claim 1 , further comprising receiving at least one of a destination server Internet Protocol (IP) address, a hostname, and a Universal Resource Locator (URL) of the file with the identification at the datacenter.
6. A system for providing cloud-based security scanning, the system comprising:
one or more gateways; and
a datacenter comprising:
memory for storing a plurality of signatures of previously received files in memory of a datacenter, each signature based on at least a partial hash of less than all data packets of an associated previously received file, wherein the associated file is associated with a content rating indicative of a category of content,
a communication interface for receiving an identification of less than all data packets of a file sent by one of the gateways over a communication network to the datacenter, the identification based on at least a partial hash of the packets comprising less than all data packets of the file before all data packets of the file are received, and
a processor for executing instructions stored in memory of the datacenter, wherein execution of the instructions by the processor determines that the identification matches a signature associated with one of the previously received files, wherein information is sent over the communication network to the gateway regarding the file associated with the matching signature, the information including the associated content rating, and
wherein the gateway blocks the file based on the associated content rating indicating a prohibited category of content before all data packets of the file are received.
7. The system of claim 6 , wherein the stored signatures comprise signatures of known malware files.
8. The system of claim 6 , wherein the stored signatures comprise signatures of known webpages.
9. The system of claim 6 , wherein the received identification identifies a type of the file, and wherein the identification is forwarded based on the identified type.
10. The system of claim 6 , further comprising receiving at least one of a destination server Internet Protocol (IP) address, a hostname, and a Universal Resource Locator (URL) of the file with the identification at the datacenter.
11. The system of claim 6 , further comprising a client device, wherein the gateway transmits the file to the client device when a content rating indicates that an associated file is not from a prohibited category of content.
12. The system of claim 6 , wherein the datacenter is remote to the gateway device.
13. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for performing a method for providing cloud-based security scanning, the method comprising:
storing a plurality of signatures of previously received files, each signature based on at least a partial hash of less than all data packets of an associated previously received file, wherein the associated file is associated with a content rating indicative of a category of content;
receiving an identification of less than all data packets of a file, the identification based on at least a partial hash of the packets comprising less than all data packets of the file before all data packets of the file are received;
determining that the identification matches a signature associated with one of the previously received files; and
sending information a gateway regarding the file associated with the matching signature, the information including the associated content rating, wherein the gateway blocks the file based on the associated content rating indicating a prohibited category of content before all data packets of the file are received.