Cloud Gateway Security Scanning via Remote Signature Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional firewall systems have limited storage capacity for malware signatures and content ratings, leading to restricted coverage and a tedious update process across multiple systems, which hampers effective intrusion detection and content filtering in networked systems.
Innovation Solution
Implementing a cloud-based gateway security scanning system where a gateway device forwards file identifications to a remote datacenter for signature matching, leveraging the datacenter's updated malware signatures and content ratings to determine whether to block incoming files, thereby offloading security screening tasks and enhancing coverage and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall stores malware signatures and content ratings locally, then security screening can be performed at the firewall, but storage capacity is limited and coverage is restricted
Solution Approach 1:
The patent introduces a cloud-based service as an intermediary between the firewall and malware signatures. The firewall sends file hashes to the cloud service, which returns malware verdicts. This mediator enables the firewall to access extensive signature databases without local storage constraints.
Solution Approach 2:
The patent moves the signature storage from the local dimension (firewall device) to a remote dimension (cloud infrastructure). This dimensional shift allows virtually unlimited storage capacity while maintaining fast local screening capabilities through hash-based identification.
2Reliability
If multiple firewalls are deployed in the system, then network coverage is improved, but updating signatures across all firewalls becomes tedious and time consuming
Solution Approach 1:
The cloud service acts as a centralized intermediary that manages signature updates for all firewalls. Each firewall queries the cloud service independently, automatically receiving updated verdicts without manual intervention. This eliminates the time-consuming process of synchronizing updates across multiple devices.
Solution Approach 2:
The firewalls perform self-updates by automatically querying the cloud service for current malware verdicts. Each firewall independently retrieves updated information without requiring administrative intervention, enabling the system to maintain itself across multiple deployment points.
3Measurement precision
If firewall performs deep packet inspection locally, then security detection accuracy is improved, but processing speed and efficiency are reduced
Solution Approach 1:
The patent extracts the computationally intensive signature matching operation from the firewall and relocates it to the cloud service. The firewall performs only lightweight hash computation and sends results to the cloud, which performs the heavy lifting of comparing against extensive signature databases. This division preserves detection accuracy while dramatically improving processing speed.
Solution Approach 2:
The patent replaces the mechanical approach of local deep packet inspection with a cloud-based query system. Instead of performing full signature matching locally, the system substitutes this with hash-based identification and remote verification, reducing local processing overhead while maintaining detection capability.
Data Source
AI summary
Some embodiments of cloud-based gateway security scanning have been presented. In one embodiment, some data packets are received sequentially at a gateway device. The data packets constitute at least a part of a file being addressed to a client machine coupled to the gateway device. The gateway device forwards an identification of the file to a remote datacenter in parallel with forwarding the data packets to the client machine. The datacenter performs signature matching on the identification and returns a result of the signature matching to the gateway device. The gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.