Network Gateway Proxy for Remote File System Content Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote file-system access protocols, such as SMB and CIFS, pose security challenges due to complexity, making content filtering difficult, especially in network gateways, and often rely on server-side filtering, which can leave shared resources vulnerable to malware spread.
Innovation Solution
Implementing a proxy within a network gateway that buffers and scans data from remote file-system access protocols, using a shared holding buffer and efficient content filtering mechanisms to detect malicious content, thereby preventing malware spread and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If content filtering is performed on remote file-system access protocol streams at the network gateway, then data security is improved by detecting malicious content, but device complexity increases due to the need to buffer and scan protocol data
Solution Approach 1:
The patent introduces a proxy as an intermediary component within the network gateway that mediates between client applications and server programs. This proxy intercepts remote file-system access protocol streams, buffers data in shared holding buffers, and performs content filtering scans. By placing this intermediary layer, the gateway can securely filter content without requiring complex modifications to existing clients or servers, thus improving data security while managing device complexity through a dedicated intermediary component.
2Quantity of substance
If a shared holding buffer is used to buffer data from multiple clients accessing the same file, then memory usage is optimized, but synchronization complexity increases to manage concurrent access
Solution Approach 1:
The patent merges multiple client access streams into a single shared holding buffer for each file being accessed. Instead of allocating separate buffers for each client, the system combines data from multiple clients into one shared buffer, significantly reducing memory usage. The proxy manages this shared buffer by coordinating reads and writes from different clients, ensuring data integrity through centralized control, thus optimizing memory while managing synchronization through a single point of control.
3Reliability
If content filtering is performed in real-time on protocol streams, then malware transmission is prevented, but processing time increases due to scanning operations
Solution Approach 1:
The patent performs content filtering scans on buffered data before the data is fully processed and transmitted. By scanning the holding buffer in advance and triggering scans based on predetermined events (such as buffer fullness or specific protocol commands), the system prevents malware transmission proactively. This preliminary scanning approach allows real-time malware prevention while optimizing processing time by avoiding repeated scans of the same data and by preparing filtered content ahead of transmission.
Data Source
AI summary
Methods and systems for content filtering of remote file-system access protocols are provided. According to one embodiment, a proxy, implemented within a network gateway device of a private network, monitors remote file-system access protocol sessions involving client computer systems and a server computer system associated with the private network. For each file on a share of the server computer system being accessed by one or more of the client computer systems: (i) a shared holding buffer corresponding to the file is created within a shared memory of the network gateway device; (ii) data being read from or written to the file by the monitored remote file-system access protocol sessions is buffered into the shared holding buffer; and (iii) responsive to a predetermined event, content filtering is performed on the shared holding buffer to determine whether malicious, dangerous or unauthorized content is contained within the shared holding buffer.