System and method for file scanning between source and client in zero-trust environment

Abstract

Embodiments of the present disclosure relate to systems and methods for file scanning between a source and a client in a zero-trust environment. A system and method for providing file scanning between a client device and a resource over a zero trusted network environment (ZTNE) is disclosed. The method includes detecting, in a network traffic between a client device and the ZTNE, a request to receive a first content from a resource deployed in a private network, wherein the resource is accessible through the ZTNE by a user equipment making the first request; detecting, in network traffic between the client device and the ZTNE, a second request to send a second content from the client device to a public network, wherein the public network is accessible through the ZTNE by the user equipment making the second request; in response to determining that the second content is allowed, sending a request to the public network; and blocking the request to the public network in response to determining that the second content is not allowable network traffic.

Description

Technical Field

[0001] The present disclosure relates generally to secure web gateways, and more particularly, to providing secure web gateways through a zero-trust network environment. Background Art

[0002] Organizations increasingly allow users to work physically both inside and outside the organization. When outside the organization, users will connect to the organization's internal computer network, private cloud network, hybrid network, etc., in order to access resources stored thereon. Often, users will use their own devices in a bring your own device (BYOD) setting. All of this leads to security vulnerabilities that can expose the organization. For example, a user can download content from the organization's secure network to a device exposed to the public network, potentially compromising sensitive information.

[0003] One of the preventive solutions to limit this exposure is through the deployment of a secure web gateway (SWG). SWG is configured to connect user devices to network resources and additionally perform content filtering, content inspection, and apply security controls to network services. SWG solutions generate a dedicated network space and connect user devices and, for example, web applications that the user devices attempt to access to the dedicated network space. Therefore, in order to utilize the SWG solution, network resources must be pre-configured in the network space. In addition, SWG solutions designed as standalone applications are generally not easily integrated into an organization's workflow, log monitoring, reporting, etc.

[0004] Therefore, it would be advantageous to provide a solution that would overcome the above challenges. Summary of the invention

[0005] An overview of several example embodiments of the present disclosure is as follows. This overview is provided for the convenience of the reader to provide a basic understanding of these embodiments, and does not completely limit the scope of the present disclosure. This overview is not an extensive review of all contemplated embodiments, and is neither intended to identify the main or key elements of all embodiments, nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a preface to a more detailed description presented later. For convenience, the term "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of the present disclosure.

[0006] A system of one or more computers may be configured to perform specific operations or actions by installing software, firmware, hardware, or a combination thereof on the system, which in operation causes the system to perform these actions. One or more computer programs may be configured to perform specific operations or actions by including instructions that, when executed by a data processing device, cause the device to perform these actions.

[0007] In one general aspect, a method may include detecting, in a network service between a client device and a zero-trust network environment, a first request to receive a first content from a resource deployed in a private network, wherein the resource is accessible to a user device making the first request through the zero-trust network environment. The method may also include detecting, in a network service between the client device and the zero-trust network environment, a second request to send a second content from the client device to a public network, wherein the public network is accessible to the user device making the second request through the zero-trust network environment. The method may also include: in response to determining that the second content is an allowable network service based on the first request and the attributes of the second content, sending a request to the public network. The method may also include: in response to determining that the second content is not an allowable network service based on the attributes of the first request and the second content, blocking a request to the public network. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform method actions.

[0008] Implementations may include one or more of the following features. In the method, the content is any of the following: a text file, a document, a spreadsheet, a presentation, a database, a comma separate value (CSV) file, a multimedia file, a video, and a picture. The method may include: inspecting the first content by a deep packet inspection (DPI) unit; and generating a signature based on the first content. The method may include: inspecting the second content by the DPI unit; generating a signature based on the second content; and comparing the signature based on the first content with the signature based on the second content. In the method, determining that the second content is allowable is in response to determining that the first content signature does not match the second content signature. In the method, determining that the second content is not allowable is in response to determining that the first content signature matches the second content signature. The method may include: generating an activity log by storing each request as an event in the activity log, wherein the event includes a timestamp. The method may include: determining that the second content is not allowable in response to determining that the event with the first timestamp representing the first request occurs within a time period less than a predetermined threshold from the event with the second timestamp representing the second request. In the method, a zero-trust cloud environment includes any of the following: an access portal server, a secure web gateway, a backend server, and any combination thereof. In the method, the backend server is configured to connect to a connector deployed in a secure network environment. Implementations of the described technology may include hardware, methods or processes, or computer tangible media.

[0009] In one general aspect, a non-transitory computer-readable medium may include one or more instructions that, when executed by one or more processors of a device, cause the device to: detect in a network service between a client device and a zero-trust network environment a first request to receive a first content from a resource deployed in a private network, wherein the resource is accessible to a user device that makes the first request through the zero-trust network environment. The medium may also detect in a network service between the client device and the zero-trust network environment a second request to send a second content from the client device to a public network, wherein the public network is accessible to the user device that makes the second request through the zero-trust network environment. The medium may also: in response to determining that the second content is an allowable network service based on the first request and the attributes of the second content, send a request to the public network. The medium may also: in response to determining that the second content is not an allowable network service based on the attributes of the first request and the second content, block a request to the public network. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform method actions.

[0010] In one general aspect, a system may include a processing circuit system. The system may also include a memory, the memory containing instructions, when executed by the processing circuit system, the instructions configure the system to: detect a first request to receive a first content from a resource deployed in a private network in a network service between a client device and a zero-trust network environment, wherein the resource is accessible to a user device that makes the first request through the zero-trust network environment. The system may also detect a second request to send a second content from a client device to a public network in a network service between the client device and the zero-trust network environment, wherein the public network is accessible to a user device that makes the second request through the zero-trust network environment. The system may also: in response to determining that the second content is an allowable network service based on the first request and the attributes of the second content, send a request to the public network. The system may also: in response to determining that the second content is not an allowable network service based on the attributes of the first request and the second content, block a request to the public network. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform method actions.

[0011] Implementations may include one or more of the following features. In the system, the content is any of the following: a text file, a document, a spreadsheet, a presentation, a database, a comma-separated value (CSV) file, a multimedia file, a video, and a picture. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, further configure the system to: inspect the first content by a deep packet inspection (DPI) unit; and generate a signature based on the first content. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, further configure the system to: inspect the second content by the DPI unit; generate a signature based on the second content; and compare the signature based on the first content with the signature based on the second content. In the system, determining that the second content is permissible is in response to determining that the first content signature does not match the second content signature. In the system, determining that the second content is impermissible is in response to determining that the first content signature matches the second content signature. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, further configure the system to: generate an activity log by storing each request as an event in the activity log, wherein the event includes a timestamp. In the system, the memory includes additional instructions, which, when executed by the processing circuit system, further configure the system to: in response to determining that an event with a first timestamp representing a first request occurs within a time period less than a predetermined threshold from an event with a second timestamp representing a second request, determine that the second content is not permissible. In the system, the zero trust cloud environment includes any of the following: an access portal server, a secure web gateway, a back-end server, and any combination thereof. The back-end server is configured to connect to a system of connectors deployed in a secure network environment. Implementations of the described technology may include hardware, methods or processes, or computer tangible media. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features and advantages of the disclosed embodiments will be apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0013] Figure 1 is an example of a network diagram of a user device communicating with a zero trust network for describing an embodiment.

[0014] Figure 2 is an example schematic diagram of a client device according to an embodiment.

[0015] Figure 3 is an example of a schematic diagram of a zero trust network for describing an embodiment.

[0016] Figure 4is an example flow chart of a method for providing a secure web gateway to client devices through a zero-trust network environment, according to an embodiment.

[0017] Figure 5 is a flow chart of a method for directing network traffic to resources through a secure web gateway of a zero-trust network, implemented according to an embodiment.

[0018] Figure 6 is a flow chart of a method for performing file scanning through a zero-trust network environment according to an embodiment.

[0019] Figure 7 is an example schematic diagram of a secure web gateway according to an embodiment. DETAILED DESCRIPTION

[0020] It is important to note that the embodiments disclosed herein are merely examples of many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. In addition, some statements may apply to some inventive features but not to other features. In general, unless otherwise indicated, singular elements may be plural and vice versa without loss of generality. In the accompanying drawings, the same numerals refer to the same parts in several views.

[0021] Various disclosed embodiments include methods and systems for providing a secure web gateway (SWG) in a zero-trust network environment. The system configures a client device operated by a user to install an agent on the client device. When executed on the client device, the agent configures the client device to generate a virtual network interface (VNI). The agent also configures the client device to communicate with the zero-trust network environment through the VNI. When the client device requests a network resource (which can be any type of network resource), the agent configures the VNI to expose the network resource to the client device as a resource accessible through the local network of the VNI. The VNI exposes the client device to a virtual local area network, where various external network resources can be represented as if they were local resources in the virtual local area network. Using this method, all communications from the user device are always passed through the zero-trust network, thereby allowing the user device to connect to a secure network and authorized public network access. By not requiring a virtual private network (VPN) to connect the user device and the web application, resources outside the VPN can also be exposed to the user device.

[0022] Figure 1 is an example of a network diagram of a user device communicating with a zero-trust network for describing an embodiment. Figure 2The user device 110 discussed in more detail in FIG. 1 is communicatively connected to the zero trust network environment 120. The user device 110 may be, for example, a personal computer device, a laptop, a tablet, etc. In one embodiment, the zero trust network (ZTN) environment 120 is implemented as a virtual private cloud (VPC) on a cloud computing environment. The cloud computing environment may be, for example, Web Services Web Service, AWS), Azure, Cloud Platform( Cloud Platform, GCP) etc. Figure 3 Examples of the ZTN environment 120 are discussed in more detail in .

[0023] The ZTN environment 120 provides connectivity to a private network 130 and a public network 140. In this example, the user of the user device 110 and the private network 130 belong to the same organization. In other embodiments, the user (i.e., user account) is otherwise permitted to access the private network 130. In one embodiment, the private network 130 may be implemented as a VPC on a public cloud (such as AWS) accessible via the public network 140. The public network 140 may be, for example, the Internet. The public network 140 is generally accessible to any user, while the private network 130 is limited to authorized users who provide credentials that can be authenticated (e.g., via the zero trust network environment 120).

[0024] In some embodiments, the connector application can be deployed in the private network 130 to facilitate the connection between the resources of the private network 130 and the backend servers (such as Figure 3 The resources of the private network 130 may be, for example, an RDP server, an SSH server, a file server, an object database, a transaction database, an SQL database, a NoSQL database, a network server, a data repository, a web application, etc.

[0025] Figure 2 2 is an example schematic diagram of a client device 110 according to an embodiment. The client device 110 includes a processing circuitry 210 coupled to a memory 220, a storage device 230, and a network interface 240. In one embodiment, the components of the client device may be communicatively connected via a bus 250.

[0026] The processing circuit system 210 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic components that can perform calculations or other manipulations of information.

[0027] The memory 220 may be volatile (eg, random access memory, etc.), non-volatile (eg, read-only memory, flash memory, etc.), or a combination thereof.

[0028] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 230. In another configuration, memory 220 is configured to store such software. Software should be broadly interpreted as representing any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language or other. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit system 210, the instructions cause processing circuit system 210 to perform various processes described herein.

[0029] The storage device 230 may be a magnetic storage device, an optical storage device, etc., and may be implemented as, for example, flash memory or other memory technology, a compact disk-read only memory (CD-ROM), a digital versatile disk (DVD), or any other medium that may be used to store the desired information.

[0030] The network interface 240 allows the client device 110 to communicate with, for example, a zero trust network (ZTN) 120. In one embodiment, the client device 110 receives agent software from the ZTN 120. The agent software includes instructions that, when executed by the processing circuit system 210 of the client device 110, configure the client device 110 to implement a virtual network interface (VNI) 242. When executed, the instructions may also configure the client device 110 to communicate exclusively through the VNI 242. In one embodiment, the VNI 242 includes a routing table based on a network namespace. In some embodiments, the network namespace is an isolated network namespace. In some embodiments, the agent software may specifically update the routing table to expose various resources.

[0031] For example, the proxy software may update the routing table to indicate that a resource (e.g., a web server) has IP address 10.0.0.115. In reality, the resource has a local private network (e.g., Figure 1 In one embodiment, the packet may be altered to include the IP address of the ZTN 120, the IP address of the resource (i.e., a different address), etc. To the client device 110, the resource is thus viewed as a resource accessible on the local network, when in fact it is only accessible through the ZTN 120. Using this technique, any resource can be mapped through the VNI 242 to be exposed to the client device 110. Using this technique, resources from public and / or private networks can be exposed. This is advantageous because it provides additional functionality and access to the client device 110.

[0032] It should be understood that the embodiments described herein are not limited to Figure 2 Specific architectures are shown, and other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0033] Figure 3is an example of a schematic diagram of a zero trust network 120 for describing an embodiment. The zero trust network (ZTN) 120 includes workloads such as a policy engine 310, a front-end server 320, a back-end server 330, a secure web gateway (SWG) 340, a deep packet inspection (DPI) unit 350, and an identity and access management (IAM) server 360. In one embodiment, the ZTN 120 can be implemented as a VPC on a cloud computing environment (such as AWS). In one embodiment, each workload can be implemented on a bare metal, as a virtual machine, as a container, as a serverless function, and as any combination thereof.

[0034] User devices connected to ZTN 120 may be directed to front-end server 320. Front-end server 320 is configured to receive user devices (such as Figure 1 The ZTN 120 receives communications from user devices 110, sends communications to user devices, and communicates with other components of the ZTN 120 (such as backend server 330, SWG 340, policy engine 310, and IAM server 360).

[0035] In one embodiment, the front-end server 320 is configured to generate a request for credentials of a user account. The credentials may include, for example, a username, a password, a cryptographic key, a secret, a one-time passcode (OTP), biometric information, etc. In one embodiment, the credentials are supplied to the IAM server 360. The IAM server 360 may authenticate the credentials. In one embodiment, the IAM server 360 may issue a multi-factor authentication (MFA) challenge. The challenge may include a request to receive additional credentials (e.g., by sending a unique PIN, a temporary PIN, etc. to a predetermined mobile phone number associated with a user account that supplies credentials from a user device).

[0036] In some embodiments, front-end server 320 is configured to provide agent software to the user device in response to successfully authenticating the credentials provided by the user device. When executed by a processing unit of the user device, the agent software can configure the user device to perform the methods described in more detail herein.

[0037] The back-end server 330 is configured to connect to a private network (e.g., via a connector application deployed in the private network). The private network is a network external to the ZTN 120, not a public network. The back-end server 330 can be configured to communicate with the front-end server 320 to establish a communication line between the client device and the front-end server, the back-end server, and the resources in the private network.

[0038] The secure web gateway (SWG) 340 is configured to perform actions on network traffic received from a user device. The actions may include, for example, filtering uniform resource locators (URLs), content inspection, policy enforcement, malicious code detection, and providing application control for web-based applications (e.g., instant messaging applications). In one embodiment, the SWG 340 may be configured to receive incoming network traffic, such as IP packets, from the front-end server 320. The incoming network traffic may be filtered (e.g., based on policies retrieved from the policy engine 310). The policy engine 310 is configured to store policies related to user accounts, IP addresses, domain directories, etc. thereon. In some embodiments, the SWG 340 is also configured to initiate inspection of the network traffic (e.g., by providing the IP packets to the DPI 350). The DPI 350 is configured to inspect the content of the network traffic (e.g., by performing signature matching to detect network attacks, blocking certain protocols, etc.).

[0039] In some embodiments, SWG 340 may determine when to provide network traffic to DPI 350 (e.g., based on a policy retrieved from policy engine 310). This may be beneficial because performing DPI on every packet may cause network congestion due to a bottleneck on DPI unit 350. SWG 340 may be configured to read only the header of a packet and determine whether the packet should be provided to DPI 350 based on the header information and the policy retrieved from policy engine 310.

[0040] Figure 4 is an example flow chart 400 of a method for providing a secure web gateway to client devices via a zero-trust network environment, implemented in accordance with an embodiment.

[0041] At S410, a software agent is sent to a client device. The software agent includes instructions that, when executed by a processing unit of the client device, configure the client device to perform the steps detailed in the method.

[0042] At S412, a virtual network interface (VNI) is generated. In one embodiment, the VNI includes a routing table based on a network namespace. In some embodiments, the network namespace is an isolated network namespace. The client device can be assigned a name in the namespace, which allows the client device to communicate with other resources with names in the VNI namespace through the VNI.

[0043] At S414, resources are exposed through the VNI. In some embodiments, the routing table may be updated to expose various resources. For example, the routing table may be updated to indicate that a resource (e.g., a web server) is accessible through the IP address 10.0.0.115. In fact, the resource has a local private network (e.g., the above Figure 1 The VNI may be configured to include a different address on the private network 120 of the ZTN. When a client device generates a packet directed to that address, the VNI allows it to pass through and sends the packet to the zero trust network (ZTN) for resolution. In one embodiment, the packet may be altered to include the IP address of the ZTN, the IP address of the resource (i.e., a different address), etc.

[0044] To the client device, the resource is thus treated as a resource accessible on the local network because the VNI exposes the resource as if it were on the same local network as the client device, when in fact it is only accessible through the ZTN. This provides the security of a zero-trust network, which in addition to providing a seamless user experience, can also implement a secure web gateway (SWG). In one embodiment, resources can be exposed from a private network, from a public network, and from a combination thereof. In some embodiments, a request to expose another resource (i.e., to assign a name to another resource in the namespace of the VNI) can be received (e.g., from a client device).

[0045] At S416, a check is performed to determine whether another resource should be exposed to the client device. If so, execution can continue at S414, otherwise, execution can terminate.

[0046] Figure 5 is a flow chart of a method for directing network traffic to resources through a secure web gateway of a zero-trust network, according to an embodiment.

[0047] At S510, network traffic is received from a client device. The network traffic may include, for example, an IP packet having a source, a destination, and a payload. In one embodiment, the client device is configured to communicate using a virtual network interface (VNI), wherein resources are exposed to the client device via the VNI. Resources may be deployed in a private network, a public network, and a combination thereof. Resources may be web applications, RDP servers, SSH servers, file servers, object databases, transaction databases, SQL databases, NoSQL databases, web servers, data repositories, and the like.

[0048] At S520, the network traffic is checked. In one embodiment, checking the network traffic includes reading the header of the IP packet. For example, the source address, the destination address, and the packet size may be read. In some embodiments, the payload of the IP packet may be provided to a deep packet inspection (DPI) unit. The DPI unit is configured to read the contents of the payload and check, for example, network security threats, illegal content (e.g., pirated software), prohibited content (e.g., confidential information), etc.

[0049] At S530, a check is performed to determine whether the network service is an allowed service. In one embodiment, the allowed service is a network service that is allowed based on a policy (e.g., retrieved from a policy engine). For example, the checked network service can be matched with a policy to determine whether it is allowable. A routing table can be used to determine whether a network service is allowed. In certain embodiments, network services may be blocked or partially blocked for a predefined time frame (e.g., based on previous network services). For example, if a user device is downloading content from a private network and is requesting to upload the content to a public network within an amount of time that is less than a predetermined amount of time (e.g., ten minutes), the policy may determine that such a request should be blocked. If the service is allowable, execution continues at S540. If the network service is not allowable, execution continues at S550.

[0050] At S540, the network traffic is sent to the resource. In one embodiment, the address of the resource is determined by reading the header of the IP packet from the network traffic. In some embodiments, the network traffic may be modified to indicate to the resource that the response should be sent to the ZTN instead of to the client device.

[0051] At S550, the network service is blocked. In one embodiment, a notification may be generated and sent to the user device to indicate that the request associated with the network service is blocked.

[0052] At S560, a check is performed to determine whether additional network traffic is received. If so, execution continues at S510. If no additional network traffic is received (e.g., because the connection to the zero-trust network environment is terminated), execution may terminate.

[0053] Figure 6 is a flow chart of a method for performing file scanning through a zero-trust network environment according to an embodiment.

[0054] At S610, a request to receive content from a private network is detected. In one embodiment, the request is directed to a resource of the private network. The content may be, for example, a file, a group of files, etc. The file may be a text file, a document, a spreadsheet, a presentation, a database, a comma-separated value (CSV) file, a multimedia file, a video, a picture, etc. The resource may be a resource accessible to a client device (e.g., using the above method) via a VNI configured on the client device.

[0055] In one embodiment, the content may be inspected (eg, by a DPI unit). The DPI unit may generate a signature based on the content, and may store such a signature in a storage device, such as a zero-trust network environment.

[0056] At S620, a request to upload content to a public network is detected. In one embodiment, the request is directed to a resource in a public network that is accessible to a client device via a VNI. In some embodiments, a log is generated to record network activity. For example, each request for a resource (e.g., a URL request), a request to upload, a request to download, etc. can be stored as an event in a network activity log. Each event can be stored with a timestamp to indicate when the event occurred.

[0057] At S630, a check is performed to determine whether the request to upload the content is allowed. In one embodiment, a deep packet inspection is performed on the uploaded content (e.g., by a DPI unit) to determine whether the uploaded content matches the content downloaded from the private network. For example, a signature can be generated from the uploaded content and matched with a stored signature of the content downloaded from the private network. In some embodiments, the check also includes determining when the last access to the private network occurred. In the event that the private network access occurs within a time period less than a predetermined threshold, the request can be blocked (i.e., denied). If content upload is allowed, execution continues at S650. If content upload is not allowed, execution continues at S640.

[0058] At S640, the network service is blocked. In one embodiment, a notification may be generated and sent to the user device to indicate that the request is blocked. In some embodiments, the notification may also include a policy, a portion of a policy, an identifier of a policy, etc., based on which the network service is blocked.

[0059] At S650, the network traffic is allowed. The content is sent to the public network for upload thereto. In some embodiments, a notification may be generated to an administrator of the zero-trust network environment to notify that a policy was accessed, regardless of the outcome (i.e., whether the network traffic was blocked).

[0060] Figure 7 is an example schematic diagram of a secure web gateway 340 according to an embodiment. The secure web gateway (SWG) 340 includes processing circuitry 710 coupled to a memory 720, a storage device 730, and a network interface 740. In one embodiment, the components of the SWG 340 may be communicatively connected via a bus 750.

[0061] Processing circuit system 710 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic component that can perform calculations or other manipulations of information.

[0062] The memory 720 may be volatile (eg, random access memory, etc.), non-volatile (eg, read-only memory, flash memory, etc.), or a combination thereof.

[0063] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 730. In another configuration, memory 720 is configured to store such software. Software should be broadly interpreted as representing any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language or other. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit system 710, instructions cause processing circuit system 710 to perform various processes described herein.

[0064] Storage device 730 may be magnetic storage device, optical storage device, etc. and may be implemented as, for example, flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD), or any other medium that can be used to store the desired information.

[0065] The network interface 740 allows the secure web gateway 340 to communicate with, for example, client devices, front-end servers, back-end servers, DPI units, policy engines, etc.

[0066] It should be understood that the embodiments described herein are not limited to Figure 7 Specific architectures are shown, and other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0067] In addition, front-end servers, back-end servers, DPI units, policy engines, etc. can use similar Figure 7 The present invention may be implemented with the architecture described in without departing from the scope of the disclosed embodiments.

[0068] Various embodiments disclosed herein can be implemented as hardware, firmware, software or any combination thereof. In addition, the software is preferably implemented as an application program tangibly embodied in a program storage unit or a computer readable medium (composed of components or certain devices and / or device combinations). The application program can be uploaded to a machine including any suitable architecture and executed by a machine including any suitable architecture. Preferably, the machine is implemented on a computer platform with hardware such as one or more central processing units ("CPU"), memory and input / output interfaces. The computer platform may also include an operating system and microinstruction codes. The various processes and functions described herein may be a part of a microinstruction code, or a part of an application program, or any combination thereof, which may be executed by a CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units may be connected to a computer platform, such as an additional data storage unit and a printing unit. In addition, a non-transitory computer readable medium is any computer readable medium other than a temporary propagation signal.

[0069] All examples and conditional language recorded herein are for teaching purposes, to help the reader understand the principles of the disclosed embodiments and the concepts contributed by the inventor to promote this field, and should be interpreted as not being limited to these specifically recorded examples and conditions. In addition, all statements of the principles, aspects and embodiments of the disclosed embodiments and their specific examples recorded herein are intended to cover their structural equivalents and functional equivalents. In addition, it is intended that such equivalents include currently known equivalents and equivalents developed in the future, that is, any element developed to perform the same function, regardless of the structure.

[0070] It should be understood that any reference to elements using reference numerals such as "first", "second", etc. herein generally does not limit the number or order of these elements. Rather, these reference numerals are generally used herein as a convenient method of distinguishing two or more elements or element instances. Therefore, reference to a first element and a second element does not mean that only two elements can be used there, or that the first element must be in some way before the second element. In addition, unless otherwise stated, a group of elements includes one or more elements.

[0071] As used herein, the phrase "at least one of" followed by a list of items means that any of the listed items may be utilized individually, or any combination of two or more of the listed items may be utilized. For example, if a system is described as including "at least one of A, B, and C," the system may include: only A; only B; only C; 2A; 2B; 2C; 3A; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2A and C; a combination of A, 3B, and 2C; and so on.

Claims

1. A method for providing file scanning between a client device and a resource via a zero-trust network environment, comprising: detecting, in network traffic between a client device and a zero-trust network environment, a first request to receive first content from a resource deployed in a private network, wherein the resource is accessible to a user device making the first request through the zero-trust network environment; detecting, in network traffic between the client device and the zero-trust network environment, a second request to send second content from the client device to a public network accessible to a user device making the second request through the zero-trust network environment; In response to determining that the second content is an allowable network service based on the first request and the attributes of the second content, sending the request to the public network; as well as In response to determining that the second content is not allowable network traffic based on the first request and attributes of the second content, the request to the public network is blocked.

2. The method of claim 1, wherein the content is any one of the following: a text file, a document, a spreadsheet, a presentation, a database, a comma-separated value (CSV) file, a multimedia file, a video, and a picture.

3. The method according to claim 1, further comprising: Inspecting the first content by a deep packet inspection (DPI) unit; as well as A signature is generated based on the first content.

4. The method according to claim 3, further comprising: checking, by the DPI unit, the second content; generating a signature based on the second content; as well as A signature based on the first content is compared with a signature based on the second content. 5 . The method of claim 4 , wherein determining that the second content is permissible is in response to determining that the first content signature does not match the second content signature.

6. The method of claim 4, wherein determining that the second content is not permissible is in response to determining that the first content signature matches the second content signature.

7. The method according to claim 1, further comprising: The activity log is generated by storing each request as an event in the activity log, wherein the event includes a timestamp.

8. The method according to claim 7, further comprising: In response to determining that the event with the first timestamp representing the first request occurs within a time period less than a predetermined threshold from the event with the second timestamp representing the second request, determining that the second content is not permissible.

9. The method of claim 1, wherein the zero-trust cloud environment comprises any one of the following: an access portal server, a secure web gateway, a backend server, and any combination thereof.

10. The method of claim 9, wherein the backend server is configured to connect to a connector deployed in the secure network environment.

11. A non-transitory computer-readable medium storing a set of instructions for providing file scanning between a client device and a resource via a zero-trust network environment, the set of instructions comprising: One or more instructions that, when executed by one or more processors of a device, cause the device to: detecting, in network traffic between a client device and a zero-trust network environment, a first request to receive first content from a resource deployed in a private network, wherein the resource is accessible to a user device making the first request through the zero-trust network environment; detecting, in network traffic between the client device and the zero-trust network environment, a second request to send second content from the client device to a public network accessible to a user device making the second request through the zero-trust network environment; In response to determining that the second content is an allowable network service based on the first request and the attributes of the second content, sending the request to the public network; as well as In response to determining that the second content is not allowable network traffic based on the first request and attributes of the second content, the request to the public network is blocked.

12. A system for providing file scanning between a client device and a resource via a zero-trust network environment, comprising: Processing circuit system; as well as a memory comprising instructions which, when executed by the processing circuit system, configure the system to: detecting, in network traffic between a client device and a zero-trust network environment, a first request to receive first content from a resource deployed in a private network, wherein the resource is accessible to a user device making the first request through the zero-trust network environment; detecting, in network traffic between the client device and the zero-trust network environment, a second request to send second content from the client device to a public network accessible to a user device making the second request through the zero-trust network environment; In response to determining that the second content is an allowable network service based on the first request and the attributes of the second content, sending the request to the public network; as well as In response to determining that the second content is not allowable network traffic based on the first request and attributes of the second content, the request to the public network is blocked.

13. The system of claim 12, wherein the content is any of the following: a text file, a document, a spreadsheet, a presentation, a database, a comma-separated value (CSV) file, a multimedia file, a video, and a picture.

14. The system of claim 12, wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to: inspecting the first content by a deep packet inspection (DPI) unit; and A signature is generated based on the first content.

15. A system according to claim 14, wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to: checking, by the DPI unit, the second content; generating a signature based on the second content; and A signature based on the first content is compared with a signature based on the second content.

16. The system of claim 15, wherein determining that the second content is permissible is in response to determining that the first content signature does not match the second content signature.

17. The system of claim 15, wherein determining that the second content is not permissible is in response to determining that the first content signature matches the second content signature.

18. The system of claim 12, wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: The activity log is generated by storing each request as an event in the activity log, wherein the event includes a timestamp.

19. The system of claim 18, wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to: In response to determining that the event with the first timestamp representing the first request occurs within a time period less than a predetermined threshold from the event with the second timestamp representing the second request, determining that the second content is not permissible.

20. The system of claim 12, wherein the zero-trust cloud environment comprises any of the following: an access portal server, a secure web gateway, a backend server, and any combination thereof.

21. The system of claim 20, wherein the backend server is configured to connect to a connector deployed in the secure network environment.

Images