CASB In-Memory Data Store for Cloud Scanning Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud Access Security Broker (CASB) systems face challenges in efficiently scanning and reporting on Data Loss Prevention (DLP) violations and malware in cloud-based SaaS applications, particularly due to the 'shadow IT' problem where enterprise data is compromised by reused login credentials, and the need for near-real-time scanning across geographically distributed users and multiple SaaS applications.
Innovation Solution
Implementing a CASB system with an in-memory data store that uses multi-level hashing for efficient incident reporting, active user identification, and load balancing, leveraging Webhook integration for real-time data modifications and geolocation for routing scans to the closest scanner, ensuring compliance with local regulations and supporting massive scale without permanent data storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional CASB systems scan through large numbers of files in cloud or SaaS applications, then data security monitoring is achieved, but system latency increases and scanning completeness deteriorates
Solution Approach 1:
The system performs preliminary hashing of file content during the scanning process, creating a hash value that can be stored and compared against known malicious patterns. This preliminary action enables faster subsequent scans by comparing hashes rather than re-scanning entire files, thus improving scanning speed while maintaining security monitoring capability
Solution Approach 2:
The patent extracts the essential identifying feature of files (their hash values) and stores only these extracted features in the data store rather than storing complete file contents. This extraction approach reduces storage requirements and accelerates scanning operations while maintaining the ability to detect DLP violations and malware
2Reliability
If CASB systems implement comprehensive logging and reporting for incident detection, then security monitoring capability is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent introduces an intermediary in-memory data store that sits between the scanning operations and the logging/reporting systems. This intermediary buffer stores incident data in memory using efficient hashing, allowing comprehensive logging and reporting capabilities to be implemented without directly increasing the complexity of the core scanning architecture. The in-memory store acts as a mediator that simplifies the overall system design
3Reliability
If CASB systems store incident data permanently for auditing and reporting, then compliance capability is improved, but storage requirements and data management complexity increase
Solution Approach 1:
The patent employs an in-memory data store that holds incident data temporarily during active scanning and reporting operations. This ephemeral storage approach provides the necessary compliance and auditing capability for active incidents while avoiding the need for permanent long-term storage of all incident data. The in-memory store acts as a temporary holding area that satisfies compliance requirements without creating permanent storage obligations
4Reliability
If CASB systems scan data at multiple cloud locations to provide comprehensive coverage, then security monitoring coverage is improved, but network latency and scanning time increase
Solution Approach 1:
The system performs preliminary hashing of file content at the source location before transmission or further processing. By calculating and storing the hash value in advance, the system enables rapid comparison against malicious patterns without requiring time-consuming re-scanning at multiple cloud locations, thus reducing scanning time while maintaining comprehensive security coverage
Data Source
AI summary
A method performed by a cloud system includes, subsequent to the cloud system connecting to one of a cloud provider and a Software-as-a-Service (SaaS) application, scanning data stored therein for one or more users associated with a tenant of a plurality of tenants of the cloud system; detecting an incident in the data during the scanning; maintaining details of the incident in an in-memory data store; and providing a notification to the tenant of the incident.