Method and system for caching at secure gateways

• US 20050005107A1
• Filed: 05/03/2004
• Published: 01/06/2005
• Est. Priority Date: 11/06/1997
• Status: Active Grant

• Current Assignee: Finjan Holdings, Inc. (SoftBank Group Corp.)
• Original Assignee: Finjan Software Limited (SoftBank Group Corp.)
• Inventors: Touboul, Shlomo
• Granted Patent: US 7,418,731 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A computer gateway for an intranet of computers, including a scanner for scanning incoming files from the Internet and deriving security profiles therefor, the security profiles being lists of computer commands that the files are programmed to perform, a file cache for storing files, a security profile cache for storing security profiles for files, and a security policy cache for storing security policies for client computers within an intranet, the security policies including a list of restrictions for files that are transmitted to intranet computers. A method and a computer-readable storage medium are also described and claimed.

Claims

1. A computer gateway for an intranet of computers, comprising:

a scanner for scanning incoming files from the Internet and deriving security profiles therefor, and the security profiles being lists of computer commands that the files are programmed to perform;

a file cache for storing files;

a security profile cache for storing security profiles for files; and

a security policy cache for storing security policies for intranet computers within an intranet, the security policies including a list of restrictions for files that are transmitted to intranet computers.

2. The computer gateway of claim 1 wherein security policies include at least one alternate action to take when transmission of a file to an intranet computer is restricted.

3. The computer gateway of claim 1 wherein the file cache indexes files according to their Universal Resource Identifiers (URIs).

4. The computer gateway of claim 1 wherein the file cache indexes files according to file IDs.

5. The computer gateway of claim 4 wherein the file IDs are hash values of files.

6. The computer gateway of claim 5 wherein the file IDs are used to ensure that duplicate files are not cached more than once.

7. The computer gateway of claim 5 wherein the file IDs are used to ensure that a file is not re-scanned if its security profile is already resident in the security profile cache.

8. The computer gateway of claim 1 wherein the security profile cache indexes security profiles according to URIs of corresponding files.

9. The computer gateway of claim 1 wherein the security profile cache indexes security profiles according to files IDs of corresponding files.

10. The computer gateway of claim 9 wherein the file IDs are hash values of files.

11. The computer gateway of claim 1 wherein the security policy cache indexes security policies according to groups of intranet users.

12. A method for operation of a network gateway for an intranet of computers, comprising:

receiving a request from an intranet computer for a file on the Internet;

determining whether the requested file resides within a file cache at the network gateway;

if said determining is affirmative;

retrieving a security profile for the requested file from a security profile cache at the network gateway, the security profile including a list of at least one computer command that the file is programmed to perform; and

if said determining is not affirmative;

retrieving the requested file from the Internet;

scanning the retrieved file to determine computer commands that the file is programmed to perform;

deriving a security profile for the retrieved file;

storing the retrieved file within the file cache; and

storing the security profile for the retrieved file within a security profile cache;

retrieving a security policy for the intranet computer from a security policy cache at the network gateway, the security policy defining restrictions for transmitting files to the intranet computer; and

comparing the security profile for the requested file vis a vis the security policy for the intranet computer, to determine whether transmission of the requested file to the intranet computer is to be restricted.

13. The method of claim 12 wherein security policies include at least one alternate action to take when transmission of a file to an intranet computer is restricted, the method further comprising taking such an alternative action if said comparing determines that transmission of the requested file to the intranet computer is to be restricted.

14. The method of claim 12 further comprising indexing the file cache so that files are indexed according to their Universal Resource Identifiers (URIs).

15. The method of claim 12 further comprising indexing the file cache so that files are indexed according to file IDs.

16. The method of claim 15 wherein the file IDs are hash values of files.

17. The method of claim 16 further comprising managing the file cache using the file IDs so that duplicate files are not cached more than once.

18. The computer gateway of claim 16 further comprising ensuring that a file is not re-scanned if its security profile is already resident in the security profile cache, using the file IDs.

19. The method of claim 12 further comprising indexing the security profile cache so that security profiles are indexed according to URIs of corresponding files.

20. The method of claim 12 further comprising indexing the security profile cache so that security profiles are indexed according to file IDs of corresponding files.

21. The method of claim 20 wherein the file IDs are hash values of files.

22. The method of claim 12 wherein the security policy cache indexes security policies according to groups of intranet users.

23. The method of claim 12 further comprising synchronizing the file cache and the security profile cache.

24. A computer-readable storage medium storing program code for causing a computer to perform the steps of:

receiving a request from an intranet computer for a file on the Internet;

determining whether the requested file resides within a file cache at the network gateway;

if said determining is affirmative;

retrieving a security profile for the requested file from a security profile cache at the network gateway, the security profile including a list of at least one computer command that the file is programmed to perform; and

if said determining is not affirmative;

retrieving the requested file from the Internet;

scanning the retrieved file to determine computer commands that the file is programmed to perform;

deriving a security profile for the retrieved file;

storing the retrieved file within the file cache; and

storing the security profile for the retrieved file within a security profile cache;

retrieving a security policy for the intranet computer from a security policy cache at the network gateway, the security policy defining restrictions for transmitting files to the intranet computer; and

comparing the security profile for the requested file vis a vis the security policy for the intranet computer, to determine whether transmission of the requested file to the intranet computer is to be restricted.

25. A method for operation of a network gateway for an intranet of computers, comprising:

receiving a request from an intranet computer for a file on the Internet;

retrieving a security profile for the requested file from a security profile cache at the network gateway, the security profile including a list of at least one computer command that the file is programmed to perform;

retrieving a security policy for the intranet computer from a security policy cache at the network gateway, the security policy defining restrictions on files that can be transmitted to the intranet computer; and

comparing the security profile for the requested file vis a vis the security policy for the intranet computer, to determine whether transmission of the requested file to the intranet computer is to be restricted.

26. The method of claim 25 further comprising:

retrieving the requested file from a file cache at the network gateway; and

transmitting the requested file to the intranet computer if said comparing determines that transmission of the requested file to the intranet computer is not to be restricted.

27. The method of claim 25 further comprising synchronizing the file cache and the security profile cache.

28. The method of claim 25 wherein security policies include at least one alternate action to take when transmission of a file to an intranet computer is restricted, the method further comprising taking such an alternative action if said comparing determines that transmission of the requested file to the intranet computer is to be restricted.

29. A computer-readable storage medium storing program code for causing a computer to perform the steps of:

receiving a request from an intranet computer for a file within the Internet;

retrieving a security profile for the requested file from a security profile cache at the network gateway, the security profile including a list of at least one computer command that the file is programmed to perform;

retrieving a security policy for the client computer from a security policy cache at the network gateway, the security policy defining restrictions on files that can be transmitted to the intranet computer; and

comparing the security profile for the requested file vis a vis the security policy for the intranet computer, to determine whether transmission of the requested file to the intranet computer is to be restricted.

30. A method for operation of a network gateway for an intranet of computers, comprising:

retrieving a requested file from the Internet;

scanning the retrieved file to determine computer commands that the file and the web objects are programmed to perform;

deriving a security profile for the retrieved file, the security profile including a list of at least one computer command that the retrieved file is programmed to perform;

storing the retrieved file within a file cache; and

storing the security profile for the retrieved file within a security profile cache.

31. The method of claim 30 further comprising indexing the file cache so that files are indexed according to their Universal Resource Identifiers (URIs).

32. The method of claim 30 further comprising indexing the file cache so that files are indexed according to file IDs.

33. The method of claim 32 wherein the file IDs are hash values of files.

34. The method of claim 33 further comprising managing the file cache using the file IDs so that duplicate files are not cached more than once.

35. The computer gateway of claim 33 further comprising ensuring that a file is not re-scanned if its security profile is already resident in the security profile cache, using the file IDs.

36. The method of claim 30 further comprising indexing the security profile cache so that security profiles are indexed according to URIs of corresponding files.

37. The method of claim 30 further comprising indexing the security profile cache so that security profiles are indexed according to file IDs of corresponding files.

38. The method of claim 37 wherein the file IDs are hash values of files.

39. A computer-readable storage medium storing program code for causing a computer to perform the steps of:

retrieving a requested file from the Internet;

scanning the retrieved file to determine computer commands that the file is programmed to perform;

deriving a security profile for the retrieved file, the security profile including a list of at least one computer command that the retrieved file is programmed to perform;

storing the retrieved file within a file cache; and

storing the security profile for the retrieved file within a security profile cache.

40. A computer gateway for an intranet of computers, comprising:

a file cache for storing files;

a security profile cache for storing security profiles for files, the security profiles being lists of computer commands that the files are programmed to perform; and

a security policy cache for storing security policies for intranet computers within an intranet, the security policies including a list of restrictions for files that are transmitted to intranet computers.

41. A method for operation of a network gateway for an intranet of computers, comprising:

receiving a request from an intranet computer for a file on the Internet;

determining whether the requested file resides within a file cache at the network gateway;

if said determining is affirmative;

retrieving a security profile for the requested file from a security profile cache at the network gateway, the security profile including a list of at least one computer command that the file is programmed to perform; and

if said determining is not affirmative;

retrieving the requested file from the Internet;

storing the retrieved file within the file cache; and

storing a security profile for the retrieved file within a security profile cache;

retrieving a security policy for the intranet computer from a security policy cache at the network gateway, the security policy defining restrictions for transmitting files to the intranet computer; and

comparing the security profile for the requested file vis a vis the security policy for the intranet computer, to determine whether transmission of the requested file to the intranet computer is to be restricted.

42. A computer-readable storage medium storing program code for causing a computer to perform the steps of:

receiving a request from an intranet computer for a file on the Internet;

determining whether the requested file resides within a file cache at the network gateway;

if said determining is affirmative;

retrieving a security profile for the requested file from a security profile cache at the network gateway, the security profile including a list of at least one computer command that the file is programmed to perform; and

if said determining is not affirmative;

retrieving the requested file from the Internet;

storing the retrieved file within the file cache; and

storing a security profile for the retrieved file within a security profile cache;

retrieving a security policy for the intranet computer from a security policy cache at the network gateway, the security policy defining restrictions for transmitting files to the intranet computer; and

comparing the security profile for the requested file vis a vis the security policy for the intranet computer, to determine whether transmission of the requested file to the intranet computer is to be restricted.

43. A computer gateway for an intranet of computers, comprising:

a scanner for scanning outgoing files from an intranet to the Internet and deriving security profiles therefor, the security profiles being lists of computer commands that the files are programmed to perform; and

a security policy cache for storing security policies for recipient computers within the Internet, the security policies including a list of restrictions for files that are transmitted to recipient computers.

44. A method for operation of a network gateway for an intranet of computers, comprising:

receiving a file from an intranet computer for transmission to a recipient computer on the Internet;

scanning the received file to derive a security profile for the received file, the security profile including a list of at least one computer command that the file is programmed to perform;

retrieving a security policy from a security policy cache at the network gateway, the security policy defining restrictions for transmitting files to recipient computers; and

comparing the security profile for the received file vis a vis the security policy, to determine whether transmission of the requested file to the recipient computer is to be restricted.

45. A computer-readable storage medium storing program code for causing a computer to perform the steps of:

receiving a file from an intranet computer for transmission to a recipient computer on the Internet;

scanning the received file to derive a security profile for the received file, the security profile including a list of at least one computer command that the file is programmed to perform;

retrieving a security policy from a security policy cache at the network gateway, the security policy defining restrictions for transmitting files to recipient computers; and

comparing the security profile for the received file vis a vis the security policy, to determine whether transmission of the requested file to the recipient computer is to be restricted.