Cloud-based gateway security scanning
View Patent ↗Some embodiments of cloud-based gateway security scanning have been presented. In one embodiment, some data packets are received sequentially at a gateway device. The data packets constitute at least a part of a file being addressed to a client machine coupled to the gateway device. The gateway device forwards an identification of the file to a remote datacenter in parallel with forwarding the data packets to the client machine. The datacenter performs signature matching on the identification and returns a result of the signature matching to the gateway device. The gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.
1. A method for providing cloud-based security scanning, the method comprising:
receiving an identification of less than all data packets of a file sent by one or more gateways over a communication network to a datacenter, the identification based on at least a partial hash of the packets comprising less than all data packets of the file before all data packets of the file are received;
executing instructions stored in memory of the datacenter, wherein execution of the instructions by a processor of the datacenter determines that the identification matches a signature associated with a previously received file; and
sending information over the communication network from the datacenter to the gateway regarding the file associated with the matching signature, wherein the gateway blocks or allows the file based on the matching signature before all data packets of the file are received.
2. The method of claim 1 , further comprising storing a plurality of signatures in a signature database in memory of the datacenter, each signature based on a partial hash of packets comprising less than all data packets associated with a file.
3. The method of claim 1 , further comprising receiving a path associated with the file over the communication network.
4. The method of claim 3 , wherein the path is a uniform resource locator (URL).
5. The method of claim 3 , further comprising determining a content rating for the file based on the received path.
6. The method of claim 5 , further comprising storing a content rating database in memory of the datacenter, wherein determining the content rating comprises searching the content rating database.
7. The method of claim 5 , wherein the content rating indicates a prohibited category of content.
8. The method of claim 1 , further comprising receiving information regarding a type of the file, wherein the type of file is one of a predetermined set of types of files.
9. An apparatus for providing cloud-based security scanning, the apparatus comprising:
a communication interface that receives an identification of less than all data packets of a file sent by one or more gateways over a communication network to a datacenter, the identification based on at least a partial hash of the packets comprising less than all data packets of the file before all data packets of the file are received; and
a processor that executes instructions stored in memory of the datacenter, wherein execution of the instructions by the processor determines that the identification matches a signature associated with a previously received file;
wherein the communication interface sends information from the datacenter over the communication network to the gateway regarding the file associated with the matching signature, wherein the gateway blocks or allows the file based on the matching signature before all data packets of the file are received.
10. The apparatus of claim 9 , further comprising memory that stores a plurality of signatures in a signature database, each signature based on a partial hash of packets comprising less than all data packets associated with a file.
11. The apparatus of claim 9 , wherein the communication interface receives a path associated with the file over the communication network.
12. The apparatus of claim 11 , wherein the path is a uniform resource locator (URL).
13. The apparatus of claim 11 , wherein further execution of instructions by the processor determines a content rating for the file based on the received path.
14. The apparatus of claim 13 , further comprising memory that stores a content rating database in memory of the datacenter, wherein further execution of instructions by the processor determines the content rating by searching the content rating database.
15. The apparatus of claim 13 , wherein the content rating indicates a prohibited category of content.
16. The apparatus of claim 9 , wherein the communication interface receives information regarding a type of the file, wherein the type of file is one of a predetermined set of types of files.
17. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor for performing a method for providing cloud-based security scanning, the method comprising:
receiving an identification of less than all data packets of a file sent by one or more gateways over a communication network to a datacenter, the identification based on at least a partial hash of the packets comprising less than all data packets of the file before all data packets of the file are received;
determining that the identification matches a signature associated with a previously received file; and
sending information over the communication network from the datacenter to the gateway regarding the file associated with the matching signature, wherein the gateway blocks or allows the file based on the matching signature before all data packets of the file are received.