Native Cloud Storage Mounting for Malware Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems are reactive and inefficient in scanning files stored in public cloud storage, leading to potential malware exposure, as they require complex and resource-intensive methods like duplicating file transfers or attaching cloud storage to virtual machines, which are limited by size and lack protection against zero-day threats.
Innovation Solution
Implementing a system that continuously scans and sandboxes files by natively mounting public cloud file stores, segregating newly introduced files for security checks before making them accessible, ensuring only clean files are accessed by users, using a network security device to apply security checks and transfer verified files to a sanitized storage area.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are scanned by passing through a security inspection virtual machine, then malware detection capability is improved, but device complexity and resource costs increase
Solution Approach 1:
The patent extracts the security scanning function from the complex virtual machine infrastructure and implements it directly on the network security device. The cloud file store is natively mounted on the network security device, allowing files to be scanned in-place without requiring separate VM instances, sandbox connectors, or proxy servers. This extraction eliminates the need for complex multi-component architectures while maintaining detection capability.
Solution Approach 2:
The network security device is designed to perform multiple functions: it natively mounts cloud file stores, continuously scans files for malware, and manages file access permissions. This multi-functionality consolidates what previously required separate systems (cloud VM attachment, sandbox connectors, local AV scanners) into a single integrated device, reducing overall system complexity.
2Reliability
If cloud storage is attached to a cloud VM for scanning, then malware detection is improved, but productivity and resource efficiency deteriorate
Solution Approach 1:
The patent removes the intermediate cloud VM layer from the scanning process. Instead of attaching cloud storage to a VM and then scanning through the VM, the network security device directly mounts the cloud file store and performs scanning operations natively. This extraction eliminates redundant data transfer steps and VM overhead, significantly improving resource efficiency and productivity.
Solution Approach 2:
When a file is scanned and determined to be malicious, the system creates a copy of the file in a quarantine location rather than modifying the original. This copying mechanism allows the original file to remain accessible for legitimate purposes while the copy is isolated for analysis or deletion, maintaining productivity while ensuring security.
3Device complexity
If static AV scanning is performed on cloud storage, then device complexity is reduced, but reliability deteriorates due to inability to detect zero-day threats
Solution Approach 1:
The system performs preliminary scanning of files before they are made accessible to users. Files are continuously monitored and scanned in advance, and only after passing security checks are they granted access permissions. This preliminary action ensures that potential threats are identified and blocked before they can cause harm, improving reliability without requiring complex real-time interception mechanisms.
Solution Approach 2:
The patent implements continuous scanning of files in the cloud file store rather than relying on periodic or on-demand static scans. This continuous monitoring ensures that newly uploaded files are immediately detected and analyzed, providing ongoing protection against zero-day threats while maintaining a relatively simple architecture based on native mounting and continuous file system monitoring.
4Ease of operation
If files are made accessible to users before scanning, then ease of operation is improved, but harmful factors increase due to potential malware exposure
Solution Approach 1:
The system applies preliminary anti-action by blocking file access until security verification is complete. The network security device monitors file access requests and only permits access to files that have been scanned and confirmed as safe. This preliminary blocking mechanism prevents malware exposure while maintaining ease of operation for legitimate files, as users experience no disruption once files pass security checks.
Solution Approach 2:
The network security device acts as an intermediary between the cloud file store and users. It natively mounts the cloud file store and controls all access requests, scanning files and managing permissions before allowing user access. This intermediary role ensures that files are verified for malware while maintaining seamless access for legitimate files, effectively mediating between security requirements and user convenience.
Data Source
AI summary
Systems and methods for continuously scanning and/or sandboxing files to protect users from accessing infected files by natively mounting public cloud file stores are provided. According to one embodiment, a determination is made by a network security device that is protecting the enterprise network regarding whether an untrusted file stored within a first repository of a public cloud file store, which is natively mounted on the network security device, is a clean file that is free of malicious content by applying one or more security checks to the untrusted file. When a result of the determination is affirmative, the network security device makes the clean file accessible to the users by copying the clean file from the first repository to a second repository that is accessible to the users.