Serverless Cloud File Scanning via Intermediary Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Third-party cloud service cybersecurity solutions face performance and cost issues due to the need to copy and scan customer data, violating privacy laws and increasing scanning time and cost.

Innovation Solution

Implementing serverless functions within the customer's cloud account to scan files, using AWS CloudFormation templates, and employing a coordination step function to orchestrate scanning processes, including snapshot creation, parsing, and anomaly detection, while maintaining encryption key control within the customer's account.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If third-party cybersecurity services copy customer data to their own account for scanning, then scanning can be performed, but data transfer time increases and scanning cost increases

Engineering Contradiction:

Improvescanning capabilityVSAvoiddata transfer time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent introduces an intermediary mechanism (encrypted data transfer with decryption keys remaining in customer account) that enables third-party scanning services to access customer data without physically copying it to the service provider's account, thereby eliminating data transfer time while maintaining scanning capability

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the scanning process into independent scanning serverless functions that can operate on individual files or groups of files within the customer's account, allowing parallel processing and reducing overall scanning time without requiring complete data copying

Inventive Principle:

Principle #1Segmentation

2Reliability

If third-party cybersecurity services copy customer data to their own account for scanning, then scanning can be performed, but scanning cost increases

Engineering Contradiction:

Improvescanning capabilityVSAvoidscanning cost

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent uses encrypted data transfer as an intermediary approach where data remains in the customer's account with encryption keys secured there, eliminating the need for costly data copying operations while still enabling third-party scanning services to perform security analysis

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent avoids creating full copies of customer data by using selective data access mechanisms where only specific files or data portions are decrypted and scanned, reducing the computational resources and costs associated with copying and processing entire data sets

Inventive Principle:

Principle #26Copying

3Reliability

If third-party cybersecurity services move complete copy of customer data into their account, then scanning can be performed, but privacy laws are violated

Engineering Contradiction:

Improvescanning capabilityVSAvoidprivacy violation

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces encryption as an intermediary protective layer that allows scanning services to access and analyze customer data without actually possessing or storing the plaintext data, thereby enabling scanning capability while preventing privacy violations through cryptographic protection

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements self-service encryption where the customer's own encryption keys remain in their account, allowing them to control access to their data while still enabling third-party scanning services to perform security analysis without compromising privacy or violating laws

Inventive Principle:

Principle #25Self-service

4Productivity

If serverless functions are used for scanning within customer account, then scanning efficiency improves, but system complexity increases

Engineering Contradiction:

Improvescanning efficiencyVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent creates scanning serverless functions that are universal and can scan any file type or format within the customer's account, providing multi-functional scanning capability that improves efficiency while the serverless architecture abstracts away the underlying system complexity

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12130922B1Scanning of files in a customer account of a cloud service for cybersecurity

Publication Date: 2024.10.29 TREND MICRO INC

AI summary

A cloud computing infrastructure hosts a web service with customer accounts. In a customer account, files of the customer account are listed in an index. Files indicated in the index are arranged in groups, with files in each group being scanned using scanning serverless functions in the customer account. The files in the customer account include a compressed tar archive of a software container. Member files of a compressed tar archive in a customer account are randomly-accessed by way of locators that indicate a tar offset, a logical offset, and a decompressor state for a corresponding member file. A member file is accessed by seeking to the tar offset in the compressed tar archive, restoring a decompressor to the decompressor state, decompressing the compressed tar archive using the decompressor, and moving to the logical offset in the decompressed data in memory.