Distributed cloud-based security systems and methods

• US 10,609,083 B2
• Filed: 12/29/2017
• Issued: 03/31/2020
• Est. Priority Date: 07/24/2008
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: Kailash, Kailash, Nanjundaswamy, Shashidhara Mysore, Mullick, Amarnath, Rappel, Jose Kolenchery
• Primary Examiner(s): Pham, Luu T
• Assistant Examiner(s): Le, Canh
• Application Number:
  US15/857,720
• Publication Number:
  US 20180146012A1
• Time in Patent Office: 823 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A distributed security method is implemented in a processing node of a distributed security system comprising one or more processing nodes and one or more authority nodes, wherein the distributed security system is located external to a network edge of an enterprise and external from one of a computer device and a mobile device associated with a user. The distributed security method includes monitoring a content item sent from or requested by an external system which is external from a network edge of the external system; and responsive to a security policy associated with the external system, performing one of allowing the content item through the processing node; precluding the content item at the processing node; and threat detecting the content item at the processing node and one of allowing or precluding the content item based on the threat detecting.

Claims

1. A method comprising:

monitoring, in a processing node in a distributed security system, a content item sent from or requested by an external system, wherein the processing node is external from a network edge of the external system and communications between the processing node and the external system are via a proxy, a tunnel, and redirection such that all the communications from the external system which are destined for or received from the Internet are processed through the processing node; and

determining, responsive to a security policy associated with the external system, a threat classification of the content item utilizing a hash of an information key associated with the content item to generate an index that is compared with a detection processing filter, the information key including an identification of a file name of an executable file associated with the content item and an identification of a file size of the executable file associated with the content item that are represented in the index generated by the hash; and

performing one of in the processing node based on comparison of the index with the detection processing filter;

allowing the content item through the processing node if the threat classification is clean;

precluding the content item at the processing node if the threat classification is violating; and

threat detecting the content item at the processing node if the threat classification is unknown and one of allowing or precluding the content item based on the threat detecting,

wherein the content item is one of spyware, malware, a virus, spam, and undesirable content which is precluded based on the security policy, and

wherein the information key further includes an address of the content item.

2. The method of claim 1, further comprising:

obtaining the security policy from an authority node based on a specific enterprise associated with the external system.

3. The method of claim 1, wherein the threat detecting utilizes one or more data inspection engines the content item at the processing node.

4. The method of claim 3, wherein the one or more data inspection engines are a plurality of data inspection engines and the content item is precluded if any one of the plurality of data inspection engines has a violation.

5. The method of claim 3, wherein master security policy for the one or more data inspection engines is provided by an authority node based on updates received from other nodes in the distributed security system.

6. The method of claim 1, wherein the detection processing filter is a Bloom filter.

7. A processing node in a distributed security system, comprising:

one or more processors; and

memory storing instructions that, when executed, cause the one or processors to

communicate with an external system, wherein the processing node is external from a network edge of the external system and communications between the processing node and the external system are via a proxy, a tunnel, and redirection such that all the communications from the external system which are destined for or received from the Internet are processed through the processing node;

monitor a content item sent from or requested by an external system; and

determine, responsive to a security policy associated with the external system, a threat classification of the content item utilizing a hash of an information key associated with the content item to generate an index that is compared with a detection processing filter, the information key including an identification of a file name of an executable file associated with the content item and an identification of a file size of the executable file associated with the content item that are represented in the index generated by the hash; and

perform one of based on comparison of the index with the detection processing filter;

allow the content item through the processing node if the threat classification is clean;

preclude the content item at the processing node if the threat classification is violating; and

threat detect the content item at the processing node if the threat classification is unknown and one of allow or preclude the content item based on the threat detection,

wherein the content item is one of spyware, malware, a virus, spam, and undesirable content which is precluded based on the security policy, and

wherein the information key further includes an address of the content item.

8. The processing node of claim 7, wherein the memory storing instructions that, when executed, further cause the one or processors to

obtain the security policy from an authority node based on a specific enterprise associated with the external system.

9. The processing node of claim 7, wherein the threat detection utilizes one or more data inspection engines the content item at the processing node.

10. The processing node of claim 9, wherein the one or more data inspection engines are a plurality of data inspection engines and the content item is precluded if any one of the plurality of data inspection engines has a violation.

11. The processing node of claim 9, wherein master security policy for the one or more data inspection engines is provided by an authority node based on updates received from other nodes in the distributed security system.

12. An external system comprising one of a computer device and a mobile device, comprising:

one or more processors; and

memory storing instructions that, when executed, cause the one or processors to

communicate on a Wide Area Network (WAN) through a processing node in a distributed security system, wherein the processing node is external from a network edge of the external system and communications between the processing node and the external system are via a proxy, a tunnel, and redirection such that all the communications from the external system which are destined for or received from the Internet are processed through the processing node; and

one of send and request a content item over the WAN, wherein, responsive to a security policy associated with the external system, the content item is threat classified by the processing node utilizing a hash of an information key associated with the content item to generate an index that is compared with a detection processing filter, the information key including an identification of a file name of an executable file associated with the content item and an identification of a file size of the executable file associated with the content item that are represented in the index generated by the hash, and, based on comparison of the index with the detection processing filter, one of;

allowed through the processing node if a threat classification is clean;

precluded at the processing node if the threat classification is violating; and

threat detected at the processing node if the threat classification is unknown and one of allowed or precluded the content item based on the threat detection,

wherein the content item is one of spyware, malware, a virus, spam, and undesirable content which is precluded based on the security policy, and

wherein the information key further includes an address of the content item.

13. The external system of claim 12, wherein the threat detection utilizes one or more data inspection engines the content item at the processing node.

14. The external system of claim 13, wherein the one or more data inspection engines are a plurality of data inspection engines and the content item is precluded if any one of the plurality of data inspection engines has a violation.

15. The external system of claim 13, wherein master security policy for the one or more data inspection engines is provided by an authority node based on updates received from other nodes in the distributed security system.