Distributed cloud-based security systems and methods
A distributed security system includes a plurality of content processing nodes that are located external to a network edge of an enterprise and located external from one of a computer device and a mobile device associated with a user, and a content processing node is configured to monitor a content item that is sent from or requested by the external system; classify the content item via a plurality of data inspection engines that utilize policy data and threat data; and one of distribute the content item, preclude distribution of the content item, allow distribution of the content item after a cleaning process, or perform threat detection on the content item, based on classification by the plurality of data inspection engines; and an authority node communicatively coupled to the plurality of content processing nodes and configured to provide the policy data and the threat data for threat classification.
1. A distributed security system comprising:
a plurality of content processing nodes that are located external on the Internet to a network edge of an enterprise and located external on the Internet from one of a computer device and a mobile device associated with a user, wherein an external system is any of the enterprise, the computer device, and the mobile device, and wherein a content processing node includes a hardware processor configured to
monitor a content item including a web page, a file, or an e-mail message that is sent from or requested by the external system, wherein communications between the processing nodes and the external system are via a proxy, a tunnel, and redirection;
classify the content item via a plurality of data inspection engines that utilize policy data and threat data;
perform threat detection on the content item when the content item is classified as unknown;
distribute the content item when the content item is classified as clean or after a cleaning process; and
preclude distribution of the content item when the content item is classified as violating; and
an authority node communicatively coupled to the plurality of content processing nodes and configured to provide the policy data for the external system and the threat data for threat classification and configured to monitor each of the processing nodes, that includes monitoring a health of each of the processing nodes, and to perform one or more of redirect and balance traffic between the processing nodes based on the monitoring of each of the processing nodes, and
wherein the content processing nodes are configured to update the authority node based on the threat detection, and wherein the authority node is configured to update the threat data based on the update and to provide updated threat data to the plurality of content processing nodes.
2. The distributed security system of claim 1 , wherein the policy data defines access privileges, content allowability, and restricted domains, and wherein the threat data includes known viruses, malware sites, and spam email domains.
3. The distributed security system of claim 1 , wherein the plurality of content processing nodes are distributed through a geographic region.
4. The distributed security system of claim 1 , wherein all data destined for or received from the Internet, from the external system, is processed through the content processing node.
5. The distributed security system of claim 1 , wherein specific data specified for the external system is processed through the content processing node.
6. The distributed security system of claim 1 , wherein the content item is precluded if any one of the plurality of data inspection engines has a violation.
7. The distributed security system of claim 1 , wherein the content item includes one or more parts C=[c 1 , c 2 , . . . , cm], and the content item is violating if any of the plurality of data inspection engines generates an output that is violating for any part C=[c 1 , c 2 , . . . , cm].
8. The distributed security system of claim 1 , wherein the plurality of data inspection engines include a detection processing filter that is used as a front end to looking at the threat data, to reduce processing time thereof.
9. A content processing node comprising:
a processor for performing instructions and one or more memory devices for storing instructions and data, wherein the content processing node is part of a distributed security system and is located external on the Internet to a network edge of an enterprise and located external on the Internet from one of a computer device and a mobile device associated with a user, wherein an external system is any of the enterprise, the computer device, and the mobile device,
wherein the instructions cause the processor to perform steps of
receive policy data for the external system and threat data threat classification from an authority node in the distributed security system, wherein the authority node is additionally configured to monitor the processing node, that includes monitoring a health of the processing node, and to perform one or more of redirect and balance traffic to the processing node based on the monitoring of the processing node,
monitor a content item including a web page, a file, or an e-mail message that is sent from or requested by the external system, wherein communications between the processing nodes and the external system are via a proxy, a tunnel, and redirection,
classify the content item via a plurality of data inspection engines that utilize the policy data and the threat data,
perform threat detection on the content item when the content item is classified as unknown,
distribute the content item when the content item is classified as clean or after a cleaning process, and
preclude distribution of the content item when the content item is classified as violating, and
wherein the content processing node is configured to update the authority node based on the threat detection, and wherein the authority node is configured to update the threat data based on the update and to provide updated threat data to a plurality of content processing nodes.
10. The content processing node of claim 9 , wherein the policy data defines access privileges, content allowability, and restricted domains, and wherein the threat data includes known viruses, malware sites, and spam email domains.
11. The content processing node of claim 9 , wherein the distributed security system includes a plurality of content processing nodes including the content processing node, and wherein the plurality of content processing nodes are distributed through a geographic region.
12. The content processing node of claim 9 , wherein all data destined for or received from the Internet, from the external system, is processed through the content processing node.
13. The content processing node of claim 9 , wherein specific data specified for the external system is processed through the content processing node.
14. The content processing node of claim 9 , wherein the content item is precluded if any one of the plurality of data inspection engines has a violation.
15. The content processing node of claim 9 , wherein the content item includes one or more parts C=[c 1 , c 2 , . . . , cm], and the content item is violating if any of the plurality of data inspection engines generates an output that is violating for any part C=[c 1 , c 2 , . . . , cm].
16. The content processing node of claim 9 , wherein the plurality of data inspection engines include a detection processing filter that is used as a front end to looking at the threat data, to reduce processing time thereof.