High-performance computer security gateway for cloud computing platform

1. A computer-implemented method of implementing a computer security gateway via deep content inspection, comprising:

receiving, by a first hardware portion comprising programmable hardware, an item in a transport layer from a second hardware portion through a communication bus, wherein the item is derived from original data received by the second hardware portion from a source computer device; and

applying, by the first hardware portion, processing in a presentation layer, a session layer, and an application layer to the item to obtain processed data in the application layer, wherein the applying comprises:

identifying a payload in the item;

determining whether the item includes a security attack based on the payload, the original data, and additional data received from the source computer device before or after the original data was received; and

transmitting the processed data, including a result of the determining, to the second hardware portion.

2. The computer-implemented method of claim 1 , wherein the applying further comprises:

decrypting the item or a derivative of the item to generate decrypted data;

decompressing the decrypted data or a derivative of the decrypted data to generate decompressed data; and

identifying the payload from the decompressed data.

3. The computer-implemented method of claim 1 , wherein:

the original data is destined for a destination computer device, and

the determining further comprises evaluating whether additional data received before the original data is related to a query of an API provided by the destination computer device or whether additional data received after the original data is related to a transfer of data obtained from the destination computer device to a data repository.

4. The computer-implemented method of claim 1 , wherein the second hardware portion comprises a general-purpose processor.

5. The computer-implemented method of claim 1 ,

wherein the item leads to an HTTP request associated with a first session, and

wherein the additional data includes an HTTP request associated with a second session different from the first session.

6. The computer-implemented method of claim 1 , further comprising:

receiving, from the second hardware portion, a first item in a higher communication layer than the transport layer,

wherein the first item is derived from first original data received by the second hardware portion from the source computer device, and the first original data includes handshake information for further communication;

decoding the first item to generate decoded data; and

transmitting the decoded data to the second hardware portion.

7. The computer-implemented method of claim 1 ,

wherein the original data is destined for a destination computer device,

wherein the first hardware portion and the second hardware portion cooperate to form a security gateway system for a cloud computing platform, and

wherein one of the source computer device and the destination computer device resides inside the cloud computing platform, while the other of the source computer device and the destination computer device resides outside the cloud computing platform.

8. One or more integrated circuits for implementing a network firewall for a cloud computing platform, comprising:

special-purpose hardware;

a memory storing instructions which when executed cause the special-purpose hardware configured to perform:

receiving an item in a transport layer from a second hardware portion through a communication bus,

wherein the item is derived from original data received by the second hardware portion from a source computer device; and

applying processing in a presentation layer, a session layer, and an application layer to the item to obtain processed data in an application layer, wherein the applying comprises:

identifying a payload in the item;

determining whether the item includes a security attack based on the payload, the original data, and additional data received from the source computer device before or after the original data was received; and

transmitting the processed data, including a result of the determining, to the second hardware portion.

9. The one or more integrated circuits of claim 8 , wherein the special-purpose hardware comprises a commodity FPGA.

10. The one or more integrated circuits of claim 8 , wherein the special-purpose hardware comprises a commodity processor configured to execute microcode, which when executed performs at least a portion of the determining.

11. The one or more integrated circuits of claim 8 , further comprising the second hardware portion, the second hardware portion comprising a general-purpose processor.

12. The one or more integrated circuits of claim 11 , wherein the second hardware portion is configured to further perform:

transforming the processed data as a proxy server to generate proxy data;

applying processing in increasingly lower layers to the proxy data to generate final data in the lowest level; and

transmitting the final data to a destination computer device.

13. The one or more integrated circuits of claim 11 ,

wherein the original data is destined for a destination computer device,

wherein one of the source computer device and the destination computer device resides inside the cloud computing platform, and

wherein the other of the source computer device and the destination computer device resides outside the cloud computing platform.

14. The one or more integrated circuits of claim 8 ,

wherein the original data is destined for a destination computer device, and

wherein the determining further comprises evaluating whether additional data received before the original data is related to a query of an API provided by the destination computer device or whether additional data received after the original data is related to a transfer of data obtained from the destination computer device to a data repository.

15. The one or more integrated circuits of claim 8 , wherein the special-purpose hardware is configured to further perform:

receiving, from the second hardware portion, a first item in a higher communication layer than the transport layer,

wherein the first item is derived from first original data received by the second hardware portion from the source computer device, and the first original data includes handshake information for further communication;

decoding the first item to generate decoded data; and

transmitting the decoded data to second hardware portion.

16. The one or more integrated circuits of claim 8 , wherein the instructions is executable by a virtual machine hosted on the special-purpose hardware.