Source: https://patents.google.com/patent/US7899849B2/en
Timestamp: 2020-01-26 11:03:45
Document Index: 340669220

Matched Legal Cases: ['§2', '§2', '§2', '§2', '§3', '§4']

US7899849B2 - Distributed security provisioning - Google Patents
Distributed security provisioning Download PDF
US7899849B2
US7899849B2 US12/128,371 US12837108A US7899849B2 US 7899849 B2 US7899849 B2 US 7899849B2 US 12837108 A US12837108 A US 12837108A US 7899849 B2 US7899849 B2 US 7899849B2
US12/128,371
US20090300045A1 (en
Arcady V. Schekochikhin
2008-05-28 Application filed by Zscaler Inc filed Critical Zscaler Inc
2008-05-28 Priority to US12/128,371 priority Critical patent/US7899849B2/en
2008-08-01 Assigned to SAFECHANNEL INC. reassignment SAFECHANNEL INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CHAUDHRY, JAY, KAILASH, KAILASH, DEVARAJAN, SRIKANTH, PAUL, NARINDER, SCHEKOCHIKHIN, ARCADY V.
2009-12-03 Publication of US20090300045A1 publication Critical patent/US20090300045A1/en
2011-03-01 Publication of US7899849B2 publication Critical patent/US7899849B2/en
238000007689 inspection Methods 0 claims description 45
241000700605 Viruses Species 0 description 17
Systems, methods and apparatus for a distributed security that provides security processing external to a network edge. The system can include many distributed processing nodes and one or more authority nodes that provide security policy data, threat data, and other security data to the processing nodes. The processing nodes detect and stop the distribution of malware, spyware and other undesirable content before such content reaches the destination network and computing systems.
Such layered security systems are prone to processing inefficiencies and can require many resources within the enterprise to maintain the systems. For example, a company may have a multi-layered security system deployed within its network. A file received on company computers may be processed by a content filtering system, an intrusion detection system and pass through the company's firewall to each computer that receives the file. Furthermore, each computer may include virus scanning software that may scan the file when it is received. Thus, regardless of the file integrity, each file may potentially be inspected multiple times by multiple processes, causing processing delays. Thus, while the objective of protecting enterprise is met, it is nevertheless met in a relatively inefficient manner.
Additionally, many of these layered defenses operate independently and do not provide feedback to different security layers. For example, the virus scanning software a company uses may not be able to communicate with a company firewall. Thus the firewall may continue to pass the infected file, and each computer that receives the infected file will expend resources performing security operations, and each user of those computers will likewise spend time to perform manual remedial actions in response to the security threat.
Many layered security systems do not implement a distribution infrastructure to communicate and share content intelligence. This results in repeated processing of both good and bad content. For example, information related to a virus outbreak detected in an enterprise location can not be readily propagated to a central office or other branches of the enterprise; uniform resource locators (URLs) found to include malicious software (“malware”) or objectionable content can not be readily propagated to a central office or other branches of the enterprises, etc.
Many layered security systems also cannot readily maintain a central data store of threat data that classifies content items such as files, URLs, e-mails according to security classifications (e.g. virus, malware, spam mail, etc.).
Bandwidth is also a practical limitation in layered security systems implemented in enterprises. Often a threat detection happens at the enterprise perimeter and inside the network edge of the enterprise, after consuming the link bandwidth. For example, an enterprise can stop downloading music content or news feeds by examining the content at an enterprise gateway; however, such monitoring necessarily sacrifices at least the amount of bandwidth required to recognize it as a particular type of content.
Additionally, many computing devices may not have enough resources to run malware or virus detection software, such as cellular phones, internet enabled appliances, and the like. Thus these devices may be vulnerable to attack.
Finally, generating a consolidated security view of the enterprise is a difficult process, as this requires the collecting of data from different locations and user groups and arranging the data in a common time order before abstracting and generating reports. Due to disparity in the security products across locations, there is difficulty in capturing the information into a common format. In addition, the cost of communicating these records in real-time is substantial. For example, an enterprise with 10 small branches and a head office can have a mean transaction rate of 100 requests per second. Each transaction yields a log record of 512 bytes. This results in the usage of 50 Kbytes/sec (400 kilobits per second) of uplink bandwidth. Small locations that are served through DSL links have an uplink bandwidth of 300 Kbits/sec-500K kilobits per second, and thus the transfer of the log records would significantly impact system response time. The bandwidth constraint is only increased for larger enterprises with thousands of users.
The subject matter described in this specification is directed to distributed security provisioning. Security processing for an enterprise can, for example, be provided external to a network edge of the enterprise. In an implementation, a distributed network security system comprising content processing nodes detects and stops the distribution of malware, spyware and other undesirable content before such content reaches the destination network and computing systems. The system can include many distributed processing nodes and one or more authority nodes that provide security policy data, threat data, and other security data to the processing nodes. The system can, for example, share defense events across processing nodes in near real-time to harden the defense capabilities of the processing nodes in the network. Each processing node can include a collection of data inspection engines, with each engine specialized in detecting specific classes of threats. Multiple engines operate on the data in parallel.
In general, one aspect of the subject matter described in this specification can be embodied in methods that include the following actions in a processing node: providing data communication to a plurality of external systems; storing security policies received from an authority node; monitoring content items requested by or sent from the external systems; threat detecting content items to classify the content items according to threat classifications; and enforcing, external to the network edges of the external systems, the security policies for the plurality of external systems in accordance with the security policies and the classifications of the content items. Other implementations of this aspect include corresponding systems, apparatus, and computer program products.
Another aspect of the subject matter described in this specification can be embodied in methods that include the following actions in an authority node: receiving security policy data defining security policies for each of a plurality of the external systems, threat classification data defining threat classifications for a plurality of content items, and detection processing filtering data defining whether content items have been threat detection processed; distributing the security policy data, the threat classification data, and the detection processing filtering data to a plurality of processing node systems; receiving threat update data from a processing node system, the threat update data for updating the threat classification data and the detection processing filter; updating the threat classification data and the detection processing filtering data based on the threat update data; and distributing the updated threat classification data and the updated detection processing filtering data to the plurality of processing nodes. Other implementations of this aspect include corresponding systems, apparatus, and computer program products.
The subject matter described in this specification also includes other aspects. Additionally, one or more of the following advantages can be realized by implementations of the subject matter described in this specification. The administration, maintenance and upgrading of a security system for a plurality of users (e.g., enterprises) is facilitated through an authority node. Threat detection results can be shared across company locations and across companies without sacrificing privacy of the communication. The requirement for multiple updates of security processes implemented in individual computer devices (e.g., personal computers) is minimized or eliminated. Enterprises with multiple locations need not maintain security protection centers at each of the multiple locations. The system provides a communication infrastructure that automatically propagates threat data regarding defense events to multiple processing nodes reduces protection delays, resource requirements and costs. Additionally, collection of defense logging data can be done external to the network edge of an enterprise, reducing or minimizing the impacts on available bandwidth within the enterprise. Threat detection scales with user accesses and make relevant threat detection data available in fast in memory caches. Mobile users can be provided with same level of protection as accesses from desktops.
FIG. 3 is a block diagram of a multilayer threat detection architecture.
FIG. 4 is a flow diagram of an example process for providing distributed security provisioning.
FIG. 5 is a flow diagram of an example process for handling threats in a distributed security system.
FIG. 6 is a flow diagram of an example process for handling threats in a distributed security system.
FIG. 7 is a flow diagram of an example process for handling threats in a distributed security system.
FIG. 8 is a flow diagram of an example process for handling threats in a distributed security system.
In some implementations, a client access agent 180 a can be included on a client computer 208. The client access agent 180 a can, for example, facilitate security processing by providing a hash index of files on the user computer 208 to a processing node 110 for malware and/or virus detection. Other security operations can also be facilitated by the access agent 180 a.
In some implementations, a server access agent 180 b can facilitate authentication functions with a processing node 110, e.g., by assigning tokens for passwords and sending only the tokens to a processing node 110 so that transmission of passwords beyond the network edge of the enterprise is minimized. Other functions and processes can also be facilitated by the server access agent 180 b.
In some implementations, the processing node 110 can utilize a layered threat detection architecture 111. The layered threat detection architecture 111 can utilize a multi-layered feedback scheme that abstracts thread data between each layer. An example layered threat detection architecture 111 is shown and described in FIG. 3. Other threat detection architectures can also be used, however, and such architectures need not be layered.
The processing node 110 and the authority node 120 can be configured according to one or more push and pull processes to manage content items according to security policy data 113 and/or 123, detection process filters 112 and/or 122, and the threat data 114 and/or 124.
§2.3.1 Threat Data Push
In a threat data push implementation, each processing node 110 stores policy data 113 and threat data 114. The processing node manager 118 determines whether a content item requested by or transmitted from an external system is classified by the threat data 114. If the content item is determined to be classified by the threat data 114, then the processing node manager 118 can manage the content item according to the security classification of the content item and the security policy of the external system.
If, however, the content item is determined to not be classified by the threat data 114, then the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification. Once the content item is classified, the processing node manager 118 generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process, and transmits the threat data update to an authority node 120.
The authority node manager 128, in response to receiving the threat data update, updates the master threat data 124 stored in the authority node data store according to the threat data update received from the processing node 110. In some implementations, the authority node manager 128 can automatically transmit the updated threat data to other processing nodes 110. Accordingly, threat data for new threats as the new threats are encountered are automatically distributed to each processing node 110. Upon receiving the new threat data from the authority node 120, each processing node manager 118 can store the updated threat data in the locally stored threat data 114.
§2.3.2 Threat Data Pull And Push
In a threat data pull and push implementation, each processing node 110 stores policy data 113 and threat data 114. The processing node manager 118 determines whether a content item requested by or transmitted from an external system is classified by the threat data 114. If the content item is determined to be classified by the threat data 114, then the processing node manager 118 can manage the content item according to the security classification of the content item and the security policy of the external system.
If, however, the content item is determined to not be classified by the threat data, then the processing node manager 118 can request responsive threat data for the content item from the authority node 120. Because processing a content item may consume valuable resource and time, in some implementations the processing node 110 can first check with the authority node 120 for threat data 114 before committing such processing resources.
The authority node manager 128 can receive the responsive threat data request from the processing node 110 and can determine if the responsive threat data is stored in the authority node data store. If responsive threat data is stored in the master threat data 124, then the authority node manager 128 provide a reply that includes the responsive threat data to the processing node 110 so that the processing node manager 118 can manage the content item in accordance with the security policy data 112 and the classification of the content item.
Conversely, if the authority node manager 128 determines that responsive threat data is not stored in the master threat data 124, then the authority node manager 128 can provide a reply that does not include the responsive threat data to the processing node 110. In response, the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification. Once the content item is classified, the processing node manager 118 generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process, and transmits the threat data update to an authority node 120. The authority node manager 128 can then update the master threat data 124. Thereafter, any future requests related to responsive threat data for the content item from other processing nodes 110 can be readily served with responsive threat data.
§2.3.3 Detection Process Filter and Threat Data Push
In a detection process filter and threat data push implementation, each processing node 110 stores a detection process filter 112, policy data 113, and threat data 114. The processing node manager 118 accesses the detection process filter 112 to determine whether the content item has been processed.
If the processing node manager 118 determines that the content item has been processed, it can determine if the content item is classified by the threat data 114. Because the detection process filter 112 has the potential for a false positive, a lookup in the threat data 114 can be implemented to ensure that a false positive has not occurred. The initial check of the detection process filter 112, however, can eliminate many null queries to the threat data 114, which, in turn, conserves system resources and increases efficiency.
If the content item is classified by the threat data 114, then the processing node manager 118 can manage the content item in accordance with the security policy data 113 and the classification of the content item.
Conversely, if the processing node manager 118 determines that the content item is not classified by the threat data 114, or if the processing node manager 118 initially determines through the detection process filter 112 that the content item is not classified by the threat data 114, then the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification. Once the content item is classified, the processing node manager 118 generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process, and transmits the threat data update to an authority node 120.
The authority node manager 128, in turn, can update the master threat data 124 and the master detection process filter 122 stored in the authority node data store according to the threat data update received from the processing node 110. In some implementations, the authority node manager 128 can automatically transmit the updated threat data and detection processing filter to other processing nodes 110. Accordingly, threat data and the detection processing filter for new threats as the new threats are encountered are automatically distributed to each processing node 110, and each processing node 110 can update its local copy of the detection processing filter 112 and threat data 114.
§2.3.4 Detection Process Filter and Threat Data Pull and Push
In a detection process filter and threat data pull and push implementation, each processing node 110 stores a detection process filter 112, policy data 113, and threat data 114. The processing node manager 118 accesses the detection process filter 112 to determine whether the content item has been processed.
If the processing node manager 118 determines that the content item has not been processed, it can request responsive threat data for the content item from the authority node 120. Because processing a content item may consume valuable resource and time, in some implementations the processing node 110 can first check with the authority node 120 for threat data 114 before committing such processing resources.
The authority node manager 128 can receive the responsive threat data request from the processing node 110 and can determine if the responsive threat data is stored in the authority node data store. If responsive threat data is stored in the master threat data 124, then the authority node manager 128 provides a reply that includes the responsive threat data to the processing node 110 so that the processing node manager 118 can manage the content item in accordance with the security policy data 112 and the classification of the content item, and further update the local detection processing filter 112.
Conversely, if the authority node manager 128 determines that responsive threat data is not stored in the master threat data 124, then the authority node manager 128 can provide a reply that does not include the responsive threat data to the processing node 110. In response, the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification. Once the content item is classified, the processing node manager 118 generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process, and transmits the threat data update to an authority node 120. The authority node manager 128 can then update the master threat data 124. Thereafter, any future requests for related to responsive threat data for the content item from other processing nodes 110 can be readily served with responsive threat data.
The various push and pull data exchange processes provided above are example processes for which the threat data and/or detection process filters can be updated in the system 100 of FIGS. 1 and 2. Other update processes, however, can also be used.
The data inspection engines 116, processing node manager 118, authority node manager 128, user interface manager 132, logging node manager 148, and authority agent 180 can be realized by instructions that upon execution cause one or more processing devices to carry out the processes and functions described above. Such instructions can, for example, comprise interpreted instructions, such as script instructions, e.g., JavaScript or ECMAScript instructions, or executable code, or other instructions stored in a computer readable medium. Other processing architectures can also be used, e.g., a combination of specially designed hardware and software, for example.
§3.0 Layered Threat Detection
FIG. 3 is a block diagram of a multilayer threat detection architecture. In some implementations, each processing node 110 can analyze the requests and responses 300 according to the multilayer threat detection architecture that includes one or more data inspection layers 302, 304, 306 and 308 include one or more detection processes that operate in parallel. Example layers can include a user layer 302, a network layer 304, an object layer 306 and a content layer 308. Other layers and architectures can also be used.
The user layer 302 can include one or more user layer inspection engines 302A, 302B and 302C configured to perform user layer processes. Example user layer processes include login authentications, session time outs, token validations, etc.
The network layer 304 can include one or more user layer inspection engines 304A, 304B and 304C configured to perform network layer processes. Example network layer processes include internet protocol address checking, allowing or disallowing a content item associated with an internet protocol address, etc.
The object layer 306 can include one or more object layer inspection engines 306A, 306B and 306C configured to perform object layer processes. Example object layer processes include identifying a hypertext transfer protocol header associated with a content item and allowing or disallowing the content item based on the identified hypertext transfer protocol header, metadata filtering, etc.
The content layer 308 can include one or more content layer inspection engines 308A, 308B and 308C configured to perform content layer processes. Example content layer processes include virus scanning a content item and allowing or disallowing the content item based on the virus scanning; rejecting files base on a file type, etc.
In some implementations, each layer 302, 304, 306 and 308 can provide threat classification feedback to an upper layer. In one implementation, each layer has a set of decision systems that feeds back the findings to the upper layer for abstracting the threat findings. For example, after a virus scan, the content layer 308 can provide the result to the object layer 306. The object layer 306 can then index the findings against the object identity of the content (for example URL with content checksum) and record the findings for future use. Thereafter, a check at the objection layer 306 can identify the content as infected, and a separate process in the content layer 308 need not be initiated. This information can be stored in the threat data 114 and shared with other processing nodes 110 and/or the authority node 120, as described above.
By way of another example, the content layer 308 may detect contents from a specific address as pornographic content. The object layer 306 can record the specific page as a pornographic page and provide this information to the network parameter layer 304. After a sufficient number of pages from destination (e.g., internet protocol address or domain name) are identified as pornographic, the network parameter layer 304 can then index a specific destination as pornographic using the internet protocol address or domain name. Thereafter, a check at the network parameter layer 304 can identify the page or content as objectionable, and a separate process at layers 306 and 308 can be precluded. This information can be stored in the threat data 114 and shared with other processing nodes 110 and/or the authority node 120, as described above.
At a highest level, a user's continued violation of security policies can result in either a lock out or limited access to resources from the user account. For example, if network layer 304 feeds back data identifying the detection of frequent security violations (e.g., attempted access to sites having malware, attempted access to pornographic sites, and the requesting of infected files) associated with a user account, then the user account may itself be locked down or access privileges curtailed (e.g., the user may only be allowed access within an enterprise intranet, and all requests outside of the enterprise firewall may be precluded). This information can be stored in the threat data 114 and shared with other processing nodes 110 and/or the authority node 120, as described above.
In some implementations, the content layer 308 processes can be implemented in the data inspection engines 116 of a processing node 110, and the user layer 302, network layer 304 and object layer 306 processes can be implemented in the processing node manager 118. Other layer distributions can also be used.
The example implementations described above perform security functions for external systems external to the network edges of the external systems, saving network resources in the external systems. All transactions are logged as log data 142 in one or more logging nodes 140 by a logging node manager 148. Thus, security log data can be collected and/or stored external to the network edges of the external systems, resulting in very little security log related traffic within the external systems. The security log data, however, can be readily accessed by the user interface front-end 130. For example, a user interface manager 132 can be used to generate log reports, execute security scenarios, monitor network traffic, etc.
§4.0 Example Processes for Providing Distributed Security Provisioning
FIG. 4 is a flow diagram of an example process 400 for providing distributed security provisioning. The process 400 can, for example, be implemented in the system 100 of FIGS. 1 and 2, or in other security systems having a distributed architecture. The stages shown in FIG. 4 are each processes that can be executed independently and concurrently as appropriate.
Stage 402 provides data communication from a plurality of processing nodes to a plurality of external systems. For example, the processing nodes 110 can be used to establish data communication with the external system 200, 220 and 230.
Stage 404 stores security policies received from an authority node. For example, the processing nodes 110 can store the security policy data 113 received from an authority node 120. The authority node 120 can provide the security policy data 113 in response to accessing the master security policy data 123.
Stage 406 monitors content items requested by or sent from the external systems. For example, the processing nodes 110 can monitor files, URL requests, and e-mail communications sent to and requested by the external systems 200, 220 and 230. Data communications can be monitored by the system 100 in a variety of ways, depending on the size and data requirements of the external system. For example, the enterprise 200 may have multiple routers that are used to communicate over the Internet, and the routers may be configured to establish communications through the nearest (in traffic communication time) processing node 110. The mobile device 230 may be configured to communicate to a nearest processing node 110 through any available wireless access device, such as an access point, or a cellular gateway. The single computer device 220, such a consumer's personal computer, may have its browser and e-mail program configured to access the nearest proxy node 110, which, in turn, serves as a proxy for the computer device 220. Alternatively, an Internet provider may have all of its customer traffic processed through processing nodes 110.
Stage 408 threat detects content items to classify the content items according to threat classifications. For example, the data inspection engines 116 of a processing node 110 can perform threat detection processes such as virus scans and URL malware detection to classify the content items according to virus and malware classifications.
Stage 410 enforces the security policies for the plurality of external systems in accordance with the security policies and the classifications of the content item. For example, the processing node 110 can manage the content items according to the threat classifications on the content items and the security policies of each external system 200, 220 and 230.
Stage 412 distributes updates to threat data and/or process filter data based on monitoring of content items and threat detection of content items. For example, the processing node 110 and/or the authority node 120 can distributes updates to threat data and/or process filter data based on monitoring of content items and threat detection of content items. The updates can be distributed by any of the push/pull schemes described above, or according to any one of the flow diagrams of FIGS. 5-8 below.
FIG. 5 is a flow diagram of an example process for handling threats in a distributed security system. The process 500 can, for example, be implemented in the system 100 of FIGS. 1 and 2, or in other security systems having a distributed architecture.
Stage 502 accesses threat data. For example, the processing node manager 118 can access threat data 114 stored in a processing node data store, e.g., a hard drive, a database, or in random access memory.
Stage 504 determines whether a content item is classified by threat data. For example, the processing node manager 118 can determine whether a content item requested by or transmitted from an external system is classified by the threat data 114.
If the content item is determined to be classified by the threat data 114, then stage 510 manages the content item in accordance with the security policy data 113 and the classification of the content item. For example, the processing node manager 118 can manage the content item according to the security classification of the content item and the security policy of the external system.
If however, the content item is determined to not be classified by the threat data 114, then stage 506 classifies the content item according to threat classification. For example, the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification.
Stage 508 then generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process and transmits the threat data to an authority node. For example, the processing node manager 118 can generate the threat data updates and can transmit the threat data update to an authority node 120.
The process then executes stage 510 as described above.
In response to the execution of stage 508, stage 550 updates threat data according to threat data update received from processing node. For example, the authority node manager 128, in response to receiving the threat data update, updates the master threat data 124 stored in the authority node data store according to the threat data update received from the processing node 110.
Stage 552 transmits the updated threat data to other processing nodes. For example, the authority node manager 128 can automatically transmit the updated threat data to other processing nodes 110.
FIG. 6 is a flow diagram of an example process for handling threats in a distributed security system. The process 600 can, for example, be implemented in the system 100 of FIGS. 1 and 2, or in other security systems having a distributed architecture.
Stage 602 accesses threat data. For example, the processing node manager 118 can access threat data 114 stored in a processing node data store, e.g., a hard drive, a database, or in random access memory.
Stage 604 determines whether a content item is classified by threat data. For example, the processing node manager 118 can determine whether a content item requested by or transmitted from an external system is classified by the threat data 114.
If stage 604 determines that the content item is classified by the threat data 114, then stage 614 manages the content item in accordance with the security policy data 113 and the classification of the content item. For example, the processing node manager 118 can manage the content item according to the security classification of the content item and the security policy of the external system.
If stage 604 determines that the content item is not classified by the threat data, then stage 606 requests responsive threat data from an authority node. For example, the processing node manager 118 can request responsive threat data for the content item from the authority node 120.
Stage 608 determines if a reply received from the authority node in response to the request indicates whether the content item is classified by threat data. For example, the processing node manager 118 can determine if the reply received from the authority node 120 includes responsive threat data. If the processing node manager 118 determines that the reply received from the authority node 120 includes responsive threat data, then stage 614 can be executed as described above.
Conversely, if stage 608 determines that the reply received from the authority node does not include responsive threat data, then stage 610 classifies the content item according to threat classification. For example, the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification.
Stage 612 then generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process and transmits the threat data to an authority node. For example, the processing node manager 118 can generate the threat data updates and can transmit the threat data update to an authority node 120.
The process then executes stage 614 as described above.
In response to the execution of stage 606, stage 650 accesses threat data. For example, the master threat data 124 at an authority node can be accessed by an authority node manager 128.
Stage 652 determines if the content item is classified by the accessed threat data. For example, the authority node manager can determine if the content item is classified by the master threat data 124.
If stage 652 determines that the content item is classified by the accessed threat data, then stage 654 transmits a reply to the requesting processing node that includes responsive threat data. For example, the authority node manager 128 can transmit a reply that includes the responsive threat data, after which stage 608 is executed.
Conversely, if stage 652 determines that the content item is not classified by the accessed threat data, then stage 656 transmits a reply to the requesting processing node that includes responsive threat data. For example, the authority node manager 128 can transmit a reply that does not include the responsive threat data, after which stage 608 is executed.
Stage 658 receives threat data update transmitted in response to the execution of stage 612 and updates threat data according to the treat data update received. For example, the authority node manager 128 can then update the master threat data 124 based on the threat data update received from the processing node manager 118.
FIG. 7 is a flow diagram of an example process for handling threats in a distributed security system. The process 700 can, for example, be implemented in the system 100 of FIGS. 1 and 2, or in other security systems having a distributed architecture.
Stage 702 accesses a detection process filter. For example, the processing node manager 118 can access the detection process filter 112 stored in a processing node data store, e.g., a hard drive, a database, or in random access memory.
Stage 704 determines whether a content item has been previously processed. For example, the processing node manager 118 can determine whether a content item requested by or transmitted from an external system has been previously processed by a processing node based on the detection processing filter 112 output.
If stage 704 determines that the content item has been previously processed, then stage 706 accesses the threat data to determine the classification of the content item, and stage 708 determines if the content item is classified by the threat data. For example, the processing node manager 118 can access the threat data 114 and determine whether a content item requested by or transmitted from an external system is classified by the threat data 114.
If the content item is determined to be classified by the threat data, then stage 710 manages the content item in accordance with the security policy data and the classification of the content item. For example, the processing node manager 118 can manage the content item according to the security classification of the content item and the security policy 113 of the external system.
If however, the content item is determined to not be classified by the threat data 114, then stage 712 classifies the content item according to threat classification. For example, the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification.
Stage 714 then generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process and transmits the threat data to an authority node. For example, the processing node manager 118 can generate the threat data updates and can transmit the threat data update to an authority node 120.
The process then executes stage 710 as described above.
In response to the execution of stage 714, stage 750 updates threat data according to threat data update received from processing node. For example, the authority node manager 128, in response to receiving the threat data update, updates the master threat data 124 stored in the authority node data store according to the threat data update received from the processing node 110.
Also in response to the execution of stage 714, stage 752 updates the detection process filter according to threat data update received from processing node. For example, the authority node manager 128, in response to receiving the threat data update, updates the master detection process filter 122 stored in the authority node data store according to the threat data update received from the processing node 110.
Stage 754 transmits the updated threat data to other processing nodes. For example, the authority node manager 128 can automatically transmit the updated threat data and detection process filter to other processing nodes 110.
FIG. 8 is a flow diagram of an example process for handling threats in a distributed security system. The process 800 can, for example, be implemented in the system 100 of FIGS. 1 and 2, or in other security systems having a distributed architecture.
Stage 802 accesses a detection process filter. For example, the processing node manager 118 can access the detection process filter 112 stored in a processing node data store, e.g., a hard drive, a database, or in random access memory.
Stage 804 determines whether a content item has been previously processed. For example, the processing node manager 118 can determine whether a content item requested by or transmitted from an external system has been previously processed by a processing node based on the detection processing filter 112 output.
If stage 804 determines that the content item has been previously processed, then stage 806 accesses the threat data to determine the classification of the content item, and stage 808 determines if the content item is classified by the threat data. For example, the processing node manager 118 can access the threat data 114 and determine whether a content item requested by or transmitted from an external system is classified by the threat data 114.
If the content item is determined to be classified by the threat data, then stage 810 manages the content item in accordance with the security policy data and the classification of the content item. For example, the processing node manager 118 can manage the content item according to the security classification of the content item and the security policy 113 of the external system.
If stage 804, however, initially determines that the content item has not been previously processed, then stage 806 requests responsive threat data from authority node. For example, the processing node manager 118 can request responsive threat data for the content item from the authority node 120.
The process then returns to stage 808, which then determines if the content item is classified by the threat data. For example, the processing node manager 118 can determine if the reply received from the authority node 120 includes responsive threat data. If the processing node manager 118 determines that the reply received from the authority node 120 includes responsive threat data, the stage 810 can be executed as described above. Additionally, the detection process filter 112 stored at the processing node 110 can also be updated to indicate that the content item has been processed, and the responsive threat data can be stored in the threat data 114 stored at the processing node.
Conversely, if stage 808 determines that the reply does not include responsive threat data, then stage 812 classifies the content item according to threat classification. For example, the processing node manager 118 can cause one or more of the data inspection engines 116 to perform the threat detection processes to classify the content item according to a threat classification.
Stage 814 then generates a threat data update that includes data indicating the threat classification for the content item from the threat detection process and transmits the threat data to an authority node. For example, the processing node manager 118 can generate the threat data updates and can transmit the threat data update to an authority node 120.
Thereafter, stage 810 is executed.
In response to the execution of stage 816, stage 850 accesses threat data. For example, the master threat data 124 at an authority node can be accessed by an authority node manager 128.
Stage 852 determines if the content item is classified by the accessed threat data. For example, the authority node manager can determine if the content item is classified by the master threat data 124.
If stage 852 determines that the content item is classified by the accessed threat data, then stage 854 transmits a reply to the requesting processing node that includes responsive threat data. For example, the authority node manager 128 can transmit a reply that includes the responsive threat data, after which stage 808 is executed.
Conversely, if stage 852 determines that the content item is not classified by the accessed threat data, then stage 856 transmits a reply to the requesting processing node that includes responsive threat data. For example, the authority node manager 128 can transmit a reply that does not include the responsive threat data, after which stage 808 is executed.
Stage 858 receives threat data update transmitted in response to the execution of stage 814 and updates threat data according to the treat data update received. For example, the authority node manager 128 can then update the master threat data 124 based on the threat data update received from the processing node manager 118.
The various data exchange processes of FIGS. 4-8 are example processes for which the threat data and/or detection process filters can be updated in the system 100 of FIGS. 1 and 2. Other update processes, however, can also be used.
a plurality of processing nodes external to network edges of a plurality of external systems, each processing node including one or more computers and comprising:
a processing node data store storing security policy data defining security policies for each of the external systems;
a plurality of data inspection engines, each data inspection engine configured to perform a threat detection process to classify content items according to a threat classification for a corresponding threat; and
a processing node manager in data communication with the data inspection engines and configured to access the security policy data stored in the processing node data store and manage the classified content item in accordance with the security policy data so that security policies for a plurality of external systems in data communication with the processing node are implemented external to the network edges for each of the external systems; and
an authority node in data communication with the processing nodes, the authority node including one or more computers and comprising an authority node data store storing security policy data for each of the plurality of external systems, and including an authority node manager configured to provide the security policy data to each of the processing nodes;
wherein the data store in each processing node includes threat data classifying content items by threat classifications and a detection process filter indicating whether content items have been processed by one or more of the data inspection engines, and the processing node manager in each process node is configured to:
determine whether a content item is classified by the threat data by accessing the detection processing filter to determine whether the content item has been processed;
if the content item is determined to have not been processed and thus not classified by the threat data, then:
cause the data inspection engines to perform the threat detection processes to classify the content item according to a threat classification;
generate a threat data update that includes data indicating the threat classification for the content item from the threat detection process; and
transmit the threat data update to the authority node;
if the content item is determined to have been processed and thus classified by the threat data, then manage the content item in accordance with the security policy data and the classification of the content item;
wherein the authority node manager is further configured to:
update threat data stored in the authority node data store according to the threat data update received from the processing node, and transmit the updated threat data to the processing nodes; and
update a detection process filter stored in the authority node data store according to the threat data update and transmit the updated detection process filter to the processing nodes.
the authority node manager is further configured to update threat data stored in the authority node data store according to the threat data update received from the processing node, and to transmit the updated threat data to other processing nodes; and
each processing node manager is further configured to store the updated threat data received from the authority node in its processing node data store.
3. The system of claim 2, wherein one of the data inspection engines comprises a virus scanning engine and the threat classifications include infected and clean.
4. The system of claim 2, wherein one of the data inspection engines comprises a uniform resource locator filter and the threat classifications include allowed and restricted.
5. The security system of claim 1, wherein the processing node manager in each process node is configured to:
request responsive threat data for the content item from the authority node if the content item is determined to not be classified by the threat data;
determine whether a reply from the authority node in response to the request includes the responsive threat data classifying the content item;
if the reply did not include the responsive threat data classifying the content item, then:
transmit the threat data update to the authority node; and
if the reply did include responsive data classifying the content item, then manage the content item in accordance with the security policy data and the classification of the content item.
the authority node manager is further configured to receive the responsive threat data request from the processing node, and determine if the responsive threat data is stored in the authority node data store;
if responsive threat data is stored in the authority node data store, then provide a reply that includes the responsive threat data to the processing node in response to the threat data request; and
if the responsive threat data is not stored in the authority node data store, then:
provide a reply to the processing node that does not include the responsive threat data; and
update threat data stored in the authority node data store according to the threat data update received from the processing node.
7. The system of claim 1, wherein the detection process filter comprises a bloom filter including a hash index and a plurality of binary data indicating whether a content item resolved to a hash index has been processed by a detection engine.
8. The system of claim 1, further comprising a logging node in data communication with the plurality of processing nodes and including a logging data store and a logger configured to store security transaction data each of the plurality of external systems.
9. The system of claim 8, wherein the security transaction data comprises content item logs indicating content item requests from the external systems and corresponding threat classifications of the requested content items.
10. The system of claim 1, wherein the content items include one or more of e-mail messages, web pages, and files.
11. The system of claim 1, wherein the data inspection engines in each processing node comprise a user layer inspection engine configured to perform authentication processes.
12. The system of claim 1, wherein the data inspection engines in each processing node comprise a network layer engine configured to perform network layer processes.
13. The system of claim 12, wherein the network layer processes include identifying internet protocol addresses associated with a content item and allowing or disallowing the content item based on the identified internet protocol address.
14. The system of claim 1, wherein the data inspection engines in each processing node comprise an object layer engine configured to perform object layer processes.
15. The system of claim 14, wherein the object layer processes include identifying an hypertext transfer protocol header associated with a content item and allowing or disallowing the content item based on the identified hypertext transfer protocol header.
16. The system of claim 1, wherein the data inspection engines in each processing node comprise a content layer engine configured to perform content layer processes.
17. The system of claim 16, wherein the content layer processes include virus scanning a content item and allowing or disallowing the content item based on the virus scanning.
18. A computer implemented method of security provisioning, comprising:
providing data communication from a plurality of processing nodes to a plurality of external systems, the processing nodes external to network edges of the plurality of external systems, and in each processing node:
storing security policies defining security policies for each of the external systems and received from an authority node;
storing threat data classifying content items by threat classifications;
monitoring content items requested by or sent from the external systems;
determining whether a content item is classified by the threat data by accessing a detection processing filter indicating whether content items have been processed by one or more data inspection engines to determine whether the content item has been processed;
threat detecting content items using the one or more data inspection engines to classify the content items according to threat classifications for a corresponding threat
generating a threat data update that includes data indicating the threat classification for the content item from the threat detecting;
transmitting the threat data update to an authority node; and
if the content item is determined to have been processed and thus classified by the threat data, then enforcing, external to the network edges of the external systems, the security policies for the plurality of external systems in accordance with the security policies and the classifications of the content items;
providing data communications between the processing nodes and the authority node, and in the authority node:
update threat data stored in the authority node according to the threat data update received from the processing node, and transmit the updated threat data to the processing nodes; and
update a detection process filter stored in the authority node according to the threat data update and transmit the updated detection process filter to the processing nodes.
if the content item is determined to not be classified by the threat data, then requesting responsive threat data for the content item from an authority node;
determining whether a reply from the authority node in response to the request includes the responsive threat data classifying the content item;
threat detection processing to classify the content item according to a threat classification;
generating a threat data update that includes data indicating the threat classification for the content item from the threat detection processing; and
transmitting the threat data update to the authority node; and
if the reply did include responsive threat data classifying the content item, then managing the content item in accordance with the security policy data and the classification of the content item.
20. The method of claim 18, wherein threat detecting content items comprises: detecting threats at a user layer;
detecting threats at a network layer;
detecting threats at an object layer; and
detecting threats at a content layer.
21. One or more machine readable storage device storing software comprising instructions executable by a processing node system and an authority node system, and in response to such execution causes the processing node system to perform operations comprising:
receiving and storing security policy data defining security policies for each of a plurality of the external systems, threat classification data defining threat classifications for a plurality of content items, and detection processing filtering data defining whether content items have been threat detection processed;
identifying a content item requested by or sent from a external system;
determining whether the content item is classified by the threat classification data by accessing the detection processing filter data;
threat detecting content items using the one or more data inspection engines to classify the content items according to threat classifications for a corresponding threat;
if the content item is determined to have been processed and thus classified by the threat data, then enforcing, external to the network edges of the external systems, the security policies for the plurality of external systems in accordance with the security policies and the classifications of the content items; and
upon such execution cause the authority node system to perform operations comprising:
updating threat data stored in the authority node according to the threat data update received from the processing node system;
transmitting the updated threat data to the processing node system; and
updating a detection process filter stored in the authority node according to the threat data update and transmit the updated detection process filter to the processing node system.
US12/128,371 2008-05-28 2008-05-28 Distributed security provisioning Active 2029-08-18 US7899849B2 (en)
US12/128,371 US7899849B2 (en) 2008-05-28 2008-05-28 Distributed security provisioning
EP09767257.0A EP2283611B1 (en) 2008-05-28 2009-05-22 Distributed security provisioning
EP17186321.0A EP3270564A1 (en) 2008-05-28 2009-05-22 Distributed security provisioning
CN200980129035.2A CN102106114B (en) 2008-05-28 2009-05-22 Distributed security provisioning method and its system
PCT/US2009/044972 WO2009154945A2 (en) 2008-05-28 2009-05-22 Distributed security provisioning
US13/016,158 US8185510B2 (en) 2008-05-28 2011-01-28 Distributed security provisioning
US13/016,158 Continuation US8185510B2 (en) 2008-05-28 2011-01-28 Distributed security provisioning
US20090300045A1 US20090300045A1 (en) 2009-12-03
US7899849B2 true US7899849B2 (en) 2011-03-01
ID=41381079
US12/128,371 Active 2029-08-18 US7899849B2 (en) 2008-05-28 2008-05-28 Distributed security provisioning
US13/016,158 Active US8185510B2 (en) 2008-05-28 2011-01-28 Distributed security provisioning
US (2) US7899849B2 (en)
EP (2) EP3270564A1 (en)
CN (1) CN102106114B (en)
WO (1) WO2009154945A2 (en)
US9332029B1 (en) 2014-12-24 2016-05-03 AO Kaspersky Lab System and method for malware detection in a distributed network of computer nodes
US10237286B2 (en) 2016-01-29 2019-03-19 Zscaler, Inc. Content delivery network protection from malware and data leakage
EP2385676B1 (en) * 2010-05-07 2019-06-26 Alcatel Lucent Method for adapting security policies of an information system infrastructure
US9032070B1 (en) * 2012-05-01 2015-05-12 Amazon Technologies, Inc. Methods and apparatus for providing inline network traffic monitoring
US10366229B2 (en) 2016-06-20 2019-07-30 Jask Labs Inc. Method for detecting a cyber attack
JP2009504104A (en) * 2005-08-03 2009-01-29 カリプティクス セキュリティＣａｌｙｐｔｉｘ Ｓｅｃｕｒｉｔｙ System and method for realizing adaptive security by dynamically learning network environment
CN100349448C (en) * 2005-10-21 2007-11-14 重庆邮电学院 EPA network safety management entity ad safety processing method
EP1960867A4 (en) 2005-12-13 2010-10-13 Crossbeam Systems Inc Systems and methods for processing data flows
CN101035128B (en) * 2007-04-18 2010-04-21 大连理工大学 Three-folded webpage text content recognition and filtering method based on the Chinese punctuation
2008-05-28 US US12/128,371 patent/US7899849B2/en active Active
2009-05-22 CN CN200980129035.2A patent/CN102106114B/en active IP Right Grant
2009-05-22 WO PCT/US2009/044972 patent/WO2009154945A2/en active Application Filing
2009-05-22 EP EP17186321.0A patent/EP3270564A1/en active Pending
2009-05-22 EP EP09767257.0A patent/EP2283611B1/en active Active
2011-01-28 US US13/016,158 patent/US8185510B2/en active Active
PCT International Search Report and the Written Opinion, PCT/US2009/044972, Dec. 31, 2009, 12 pages.
US8185510B2 (en) 2012-05-22
EP2283611A2 (en) 2011-02-16
EP2283611A4 (en) 2013-02-20
WO2009154945A2 (en) 2009-12-23
CN102106114A (en) 2011-06-22
WO2009154945A3 (en) 2010-04-01
CN102106114B (en) 2014-10-22
EP3270564A1 (en) 2018-01-17
US20090300045A1 (en) 2009-12-03
US20110138468A1 (en) 2011-06-09
EP2283611B1 (en) 2017-08-16
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHAUDHRY, JAY;SCHEKOCHIKHIN, ARCADY V.;DEVARAJAN, SRIKANTH;AND OTHERS;SIGNING DATES FROM 20080519 TO 20080630;REEL/FRAME:021327/0291