Security Gateway Trickle and Repair Malicious Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security gateways often experience unnecessary delays and channel closures due to inactivity timeouts while scanning for malicious code, and when malicious code is detected, they can only abnormally terminate connections, making it impossible to deliver repaired data since part of the infected data has already been transferred.
Innovation Solution
A method that allows data to be trickled to a target computer system, where it is scanned for malicious code; if detected, the trickle is terminated, and if the data is repairable, repaired data is generated and sent back to the target system using an out-of-band communication channel, enabling complete data transfer without delivering infected data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the security gateway holds the entire data resource before scanning, then the scanning can be performed on complete data, but it causes unnecessary delay and may cause the communication channel to close due to inactivity timeouts
Solution Approach 1:
The patent segments the data transfer process into two phases: a trickling phase where data is transmitted in small portions while scanning continues, and a completion phase where the remaining data is sent after scanning finishes. This segmentation allows scanning to occur without requiring the entire data buffer to be held, resolving the contradiction between scanning completeness and transfer delay.
Solution Approach 2:
The patent performs preliminary scanning actions on data portions as they arrive during the trickling phase, rather than waiting for complete data transmission. This preliminary action allows the security gateway to detect malicious code early and make decisions about data delivery before the entire resource is transferred, eliminating unnecessary delays.
2Productivity
If the security gateway forwards data to the destination before scanning completes, then data transfer speed is improved, but malicious code may be transferred to the destination
Solution Approach 1:
The patent implements a feedback mechanism where the security gateway continuously monitors scan results during the trickling phase and adjusts data transmission accordingly. When malicious code is detected, the gateway receives feedback about the infection status and can terminate the trickling process, preventing harmful data from reaching the destination while maintaining high transfer speeds for clean data.
Solution Approach 2:
The patent makes the data transmission process dynamic by allowing the security gateway to adjust the trickling rate and transmission timing based on real-time scan results. The system transitions from a static all-or-nothing approach to a dynamic process where data transmission is controlled according to the evolving understanding of the data's safety, enabling both speed and security.
3Object-affected harmful factors
If the security gateway abnormally terminates the connection upon detecting malicious code, then the infected data transfer is stopped, but it is impossible to deliver a repaired version of the data
Solution Approach 1:
The patent changes the parameter of data transmission from a binary state (complete transfer or complete block) to a graduated state where partial transfer, repair, and retransmission are possible. By modifying the transmission parameters to allow controlled trickling and selective completion, the system enables both blocking of harmful data and delivery of repaired data, increasing adaptability to different scenarios.
Solution Approach 2:
The patent implements self-service by enabling the security gateway to automatically determine whether data can be repaired and to initiate the repair process without external intervention. The system scans data, identifies malicious portions, determines repairability, and automatically generates repaired versions, making the system self-sufficient in handling infected data while maintaining the ability to block when necessary.
4Measurement precision
If the security gateway scans entire data resources before forwarding, then scanning accuracy is improved, but communication channel inactivity timeouts occur
Solution Approach 1:
The patent segments the scanning process into incremental steps that correspond with data trickling, rather than requiring a single comprehensive scan of entire data resources. This segmentation allows the security gateway to maintain communication channel activity by performing small scanning operations on small data portions, preventing inactivity timeouts while preserving scan detection accuracy through continuous monitoring.
Data Source
AI summary
In one embodiment, a trickle and repair application receives data from a sending computer system and trickles the data to a target computer system over an in-band communication channel. The received data is evaluated for the presence of malicious code. When malicious code is detected in the data, trickling of the data is terminated. If the infected data is repairable, the data is repaired and an out-of-band target data notification is generated and sent to the target computer system. In one embodiment, receipt of the out-of-band target data notification causes the target computer system to flush the current buffer and any local files containing the trickled data. The target computer system returns an out-of-band target acknowledgement to the trickle and repair application and the repaired data is sent to the target computer system.